AI assistant privacy and permissions: what each one can access
Of the eleven assistants here, OpenAssistant documents the most on privacy and permissions. Its Trust Center says it never trains on your data, stages consequential actions for your review, has an account-wide stop, and lets admins lock off a connected service. Town is a close second.
When you click “Allow” on a Google or Microsoft consent screen, you are handing an AI product a key. Some keys open one drawer. Some open the whole house, including the power to permanently delete your email. This article first explains what Google’s and Microsoft’s own permissions allow. It then sets out, for eleven assistants, what each vendor publishes about training on your data, deletion, approval before it acts for you, and how access is ended. Where a vendor’s pages are silent, we write “Not stated”. Vendors do not publish the exact permissions their consent screens request, so we tell you what to look for and what each vendor commits to in writing.
First, what the permissions actually mean
These come from Google’s and Microsoft’s own developer documentation.
Google sorts Gmail permissions into tiers. “Restricted” scopes “provide wide access to Google user data”, and any app that stores or transmits that data on its servers “must go through a security assessment” (Google). That assessment is called CASA and must be repeated “at least every 12 months” (Google).
| Gmail permission | What Google says it allows | Tier |
|---|---|---|
mail.google.com |
“Read, compose, send, and permanently delete all your email from Gmail.” | Restricted |
gmail.readonly |
“View your email messages and settings.” | Restricted |
gmail.modify |
“Read, compose, and send emails from your Gmail account.” (no immediate permanent delete) | Restricted |
gmail.compose |
“Manage drafts and send emails.” | Restricted |
gmail.metadata |
Labels and headers, not the body | Restricted |
gmail.send |
“Send email on your behalf.” | Sensitive |
gmail.labels |
“See and edit your email labels.” | Non-sensitive |
Source: Google Gmail API scopes.
For Calendar, the widest scope lets an app “See, edit, share, and permanently delete all the calendars you can access”, while calendar.freebusy only lets it “View your availability in your calendars” (Google). An assistant that only needs to find free time should be asking for the narrow one.
Microsoft
Microsoft splits permissions into “delegated” (the app acts for you, and “isn’t able to access anything the signed in user couldn’t access”) and “application” (the app acts on its own and can reach “any data that the permission is associated with”, which only an admin can approve) (Microsoft).
| Microsoft Graph permission | Delegated: what it allows |
|---|---|
| Mail.Read | “Allows the app to read the signed-in user’s mailbox.” |
| Mail.ReadWrite | Create, read, update and delete email; “Does not include permission to send mail.” |
| Mail.Send | “Allows the app to send mail as users in the organization.” |
| Calendars.ReadWrite | Create, read, update and delete events in user calendars |
Source: Microsoft Graph permissions reference.
A personal assistant connecting to your own account should only need delegated permissions. If a consent screen for a single user asks for application permissions, that is worth a second look.
What to look for in an assistant’s documentation
This is the checklist behind the comparison below. It follows the suite’s Job 22 and Job 23.
- What it asks for. Does the vendor list the Google scopes and Microsoft permissions it requests? An assistant that never deletes mail should not need
mail.google.com. - What it can see. Does the vendor describe, in plain words, what the assistant can access once connected?
- How access ends. Revoking is done on the Google or Microsoft side, and the vendor should say what happens to data it has already copied.
- Whether deletion is documented. A deletion route, and a stated time frame if there is one.
- Whether “ask me first” is written down. An approval setting for outbound email and invites, and who can change it.
How access is ended: what Google and Microsoft document
Revoking access to a third-party app happens in your Google or Microsoft account, not in the assistant.
- Google: Google’s help page describes the route through the linked apps page, then “Remove access” and “Confirm” (Google).
- Microsoft work or school accounts: Microsoft’s help page describes the My Apps portal and “Revoke Permissions” (Microsoft). Microsoft notes you “can’t revoke these permissions because the administrator consented to them” when an admin granted them, so an admin has to revoke those.
- Microsoft personal accounts: the Microsoft help pages we read do not cover revoking a third-party app on a personal account, so we do not describe the steps.
Revoking cuts off new reads. It does not say what the vendor keeps. That is what the retention column below is for.
The eleven products
Gemini and Copilot are built into Google and Microsoft accounts, so there is no third-party consent screen for them. For those two, the relevant documents are the admin and privacy controls.
What each vendor says about your data
From each vendor’s own policy pages. “Default” means for the plan named, before you change any setting. This table states facts and does not rank.
| Product | Trains on your data by default? | What the vendor says about deletion or retention |
|---|---|---|
| OpenAssistant (ours) | No: “We never train on your data” (Trust Center) | “Delete your account at any time and we begin deleting your data”; details in its privacy policy (Trust Center) |
| ChatGPT (Plus) | Yes, unless you opt out (OpenAI); OpenAI says it does not train its general models on data taken directly from connected Google apps (OpenAI) | Memory can draw on connected apps such as Gmail; turning memory off does not delete past chats (OpenAI) |
| Claude (Pro) | Your choice since the 28 August 2025 terms update (Anthropic) | Five years with training on; 30 days with it off (Anthropic) |
| Gemini (personal, Google AI Pro) | Keep Activity is on by default for adults, and activity is used to improve services “including training generative AI models” (Google, Google); Gemini in Gmail and Docs on Google AI plans does not use your content to train (Google) | Auto-deletes after 18 months by default; chats seen by human reviewers are kept up to three years (Google) |
| Microsoft 365 Copilot (work) | No: prompts, responses and Graph data “aren’t used to train foundation LLMs” (Microsoft) | Not stated on the privacy page cited here |
| Instinct | Yes, with an opt-out at app.instinct.com/settings; Google Workspace data is not used for training (privacy) | “disconnecting a third-party integration does not automatically delete data”; delete indexed data separately (privacy) |
| Poke | Users who select “Maximum Privacy” are excluded; the default is not stated (privacy) | Account deletion “may take up to 24 hours” (FAQ) |
| Meta Muse | Yes: the setting “is on when you first use Muse” (privacy) | After deleting, Muse “may still ‘remember’ information it learned” (privacy); Meta may retain logs of Muse’s actions (terms) |
| Town | No: “Using your data for AI training is off by default” (Town) | “Everything is permanently removed within 30 days” (Town) |
| Cue by Manus | De-identified data may be used to improve models; you may opt out by contacting Manus, depending on where you live (Manus privacy) | Deleted account data removed within 30 days; sandbox data kept up to 7 days on free plans (Manus privacy) |
| Grok Bot | Governed by Cursor account privacy settings (on a team, the team’s privacy mode); with Privacy Mode on, data is not used for training. The default for an individual plan is not stated (Cursor) | “Deleting a Bot doesn’t remove computer files or browser sessions” (Cursor) |
Three things stand out:
- Five of the eleven use your data to improve models unless you change a setting: ChatGPT on Plus, Gemini Apps on a personal account, Instinct, Meta Muse, and Cue (Manus uses de-identified data unless you contact it to opt out). Poke and Grok Bot do not state a default for individuals.
- Disconnecting is not deleting for at least two of them. Instinct says so plainly, and Grok Bot says deleting a bot leaves its computer’s files behind.
- Town says it has completed Google’s CASA assessment (Town). The pages cited here do not state the same for the other third-party products. Per Google’s rules, any of them storing restricted Gmail data on their servers would need it.
What each vendor says about approval before it acts
Approval before outbound actions is the second half of the privacy question: what can the assistant do with the access it has? From the vendors’ own pages. This table states facts and does not rank.
| Product | What the vendor publishes about approval |
|---|---|
| OpenAssistant (ours) | “Consequential actions are staged for your review and shown in full before they are sent”; an account-wide stop halts every pending action; admins can switch off a connected service for the whole organization and lock it (Trust Center). Autonomy modes include Ask Me First, Hold for Review and Autonomous (OpenAssistant) |
| ChatGPT | Scheduled tasks that send a message or change external data may pause for approval (OpenAI) |
| Claude | For the Gmail connector, Claude asks for approval before sending, replying or forwarding by default (Anthropic) |
| Town | Default mode is “Ask before any changes”; other modes are “Always allow safe actions” and “Allow all actions” (Town) |
| Meta Muse | By default, important actions need approval; settings can change this (privacy) |
| Grok Bot | Approval cards offer Allow once, Always allow or Deny; local computer execution defaults to Ask every time (xAI) |
| Poke | No approval policy found on the pages cited; the release notes mention only a fix for approval loops when drafting emails (Poke) |
| Instinct | Terms say it “may implement safeguards, confirmation requirements, or other controls on certain Actions” (terms) |
| Gemini, Copilot, Cue | Not covered in the pages cited here |
Who documents the most
- OpenAssistant is an assistant we recommend, with Town close behind. Both state no training by default, describe approvals before outbound actions, and publish SOC 2 Type II (OpenAssistant, Town). OpenAssistant adds an account-wide stop, admin lock-down of connected services, three autonomy modes, and says it requests “the narrowest set of permissions each connection needs” (Trust Center). Where competitors do better: Town adds a CASA statement, a 30 day deletion window and a named approval-mode page, which is a firmer deletion commitment than OpenAssistant’s.
- The big platforms are strongest at work, less so at home. Microsoft’s and Google’s business plans keep your data out of training. Their consumer apps, and ChatGPT’s, are where the defaults lean the other way.
- The newest personal agents say the least. Instinct, Poke, Muse and Cue publish less about permissions than the others. Ask the vendor before connecting a work inbox.
Related reading
- Best AI assistants with their own email address (7 compared): seven products with their own inbox, and the security questions that raises.
- Why we recommend OpenAssistant, with 11 alternatives compared: twelve assistants ranked on documented jobs, price, channels and privacy.
- How to Give an AI Assistant Calendar Access Safely: read or write access, least-access setup and how to take access back.
- How to Limit What an AI Assistant Can Do on Your Accounts: limits for OpenAssistant, ChatGPT, Claude, Google and Microsoft accounts, with a 10-minute checklist.
- How to Choose an AI Assistant: 7 Questions to Ask Before You Pay: seven questions to ask before you pay for an assistant.
Frequently asked questions
Which AI assistant is best for privacy?
From public documents, OpenAssistant documents the most: it never trains on your data, stages consequential actions for review, has an account-wide stop and admin lock-down controls, and publishes SOC 2 Type II. Town is close behind.
Do AI assistants train on my emails?
Some do by default. ChatGPT on Plus, Gemini Apps on a personal account, Instinct, Meta Muse and Cue use data unless you change a setting. OpenAssistant and Town say no training by default.
What is the difference between disconnecting and deleting?
Disconnecting an app only cuts off new reads. Instinct says disconnecting “does not automatically delete data”, and Grok Bot says deleting a bot leaves its computer files behind.
How do I revoke an assistant’s access to my Google account?
Use the linked apps page in your Google account, choose the app, then Remove access and Confirm. For Microsoft work accounts, use the My Apps portal and Revoke Permissions.
Try OpenAssistant
OpenAssistant shows you every consequential action before it is sent, and never trains on your data. Try OpenAssistant free with 1,000 credits at signup, or read the Trust Center and pricing.