Does Google actually use Google Docs content to train Gemini?

Google's terms permit it under the same Workspace Labs and product-improvement provisions that cover Gmail and other consumer Workspace products, and Google has stated that content is used to develop and improve its AI features unless an admin or user opts out through the relevant Workspace settings. For personal Google accounts, the default posture is more permissive than for paid Workspace Business/Enterprise tiers, where admins can disable smart features and AI training use. The practical takeaway is the same either way: the text of your document is legible to Google's systems by default, and turning that off requires an active setting change, not silence.

Is Proton Docs actually end-to-end encrypted, including real-time collaboration?

Yes. Proton Docs encrypts document content client-side before it syncs, and collaborators decrypt it locally on their own devices — Proton's servers store and relay encrypted data without holding a readable copy. This applies to real-time multi-cursor editing, not just static storage, which is the harder engineering problem most encrypted-docs claims quietly skip. Comments and version history are encrypted under the same model.

Can I use Proton Docs if my team is on Google Workspace or Microsoft 365?

Partially, and this is the honest limitation. Proton Docs works well for documents you fully control — your own drafts, internal notes, anything where you choose every collaborator. It does not integrate with Google's or Microsoft's collaboration ecosystems, so a document a client shares with you via Google Docs stays in Google Docs unless you export and re-import it, which loses live collaboration. Most privacy-conscious tech workers run a hybrid setup: sensitive drafting happens in Proton Docs, client-mandated collaboration happens wherever the client already works.

Does switching to Proton Docs mean giving up features like Google Docs add-ons or Office-compatible formatting?

Yes, largely. Proton Docs is intentionally minimal — it supports core rich-text editing, comments, and real-time collaboration, but it does not have the add-on ecosystem, advanced formatting, or Office-file fidelity that Google Docs and Microsoft 365 have built over a decade. It exports to standard formats (.docx, .pdf) for anything that needs to leave the encrypted environment. Treat it as the tool for documents where privacy matters more than feature depth, not a full replacement for every document you touch.

Your AI Stack Is Private. Your Google Docs Aren't.

If you've already moved your AI workflow local — running models through Ollama, scrubbing PII before anything touches a cloud API, picking privacy-respecting tools over ChatGPT by default, maybe following the setup in building a private AI research stack — you've solved the part of the privacy problem that's easy to see. The prompt window is the part everyone locks down first, because it's the part that obviously talks to an AI model.

The part that doesn't get locked down is the document sitting open in another tab: the spec you're drafting, the meeting notes, the client deliverable, the code review checklist. If that document lives in Google Docs, it's sitting inside the same company that trains Gemini, under terms that permit using its content to develop and improve AI features by default. Microsoft 365 runs the same play with Copilot. The LLM you're careful with isn't the only AI touching your work — it's just the one you remember to think about.

This is the same audience, the same threat model, and a genuinely different tool from the one you already solved for.

The Blind Spot Most Private-AI Setups Miss

The instinct to protect prompt content is correct — a prompt is often the most sensitive single artifact in a workflow, because it's where you spell out exactly what you're trying to do with exactly what data. But a document you draft over the course of a week contains more raw information than any single prompt: full client context, unredacted names and figures, early-stage thinking you'd never paste into a chat window because it's not "a question" yet, it's just a working file.

Three things make this worse than it looks at first glance:

It's persistent, not transactional. A prompt exists for one exchange. A Google Doc exists for the life of the project, gets revised fifty times, gets shared with three more people, and sits in a Drive folder indefinitely after the project ends — a much longer exposure window than any single AI interaction.

It's the input to AI features you didn't ask for. Gemini in Workspace can summarize, extend, and reference the content of your open documents by default in many configurations. You don't have to invoke it for it to have access to what's on the page — "Help me write" and "Summarize this doc" are features sitting one click away from content you never explicitly submitted to an AI.

You can't scrub it the way you scrub a prompt. People who are careful about AI privacy have usually built a habit of stripping identifying details before they send something to a model. Nobody redacts their own working drafts before saving them — that would defeat the purpose of the document. This is the same blind spot covered in what happens to the files your AI tools produce: the prompt gets the scrutiny, the output and the working files around it don't.

What "Private" Document Editing Actually Requires

The bar is the same one you'd apply to a local LLM setup: does the platform holding this content have the technical ability to read it, independent of what its policy says it will do with that ability.

Standard cloud document tools — Google Docs, Microsoft 365, Notion — encrypt data in transit and at rest, but hold the decryption keys themselves. That's the same distinction that matters for cloud storage and email: encryption without end-to-end key control means the provider can read the content whenever it wants to, whether for AI training, a subpoena, an internal investigation, or a breach. Policy is the only thing standing between your document and a third party reading it, and policy changes — Workspace's AI terms today aren't the ones it shipped five years ago.

End-to-end encrypted document editing removes that variable. The provider stores and syncs ciphertext it cannot read, full stop, regardless of what its terms of service say this quarter.

Proton Docs — Built on the Same Model as Proton Mail

Proton Docs applies the zero-access encryption model Proton built for Mail and Drive to real-time document editing, which is a harder problem than encrypting a static file — multiple people typing into the same document simultaneously, with each keystroke encrypted client-side before it syncs, decrypted locally by collaborators, and never readable by Proton's servers in between.

What it covers:

Rich-text documents with real-time multi-cursor collaboration, comments, and suggestions
Full version history, encrypted under the same model as the live document
Access controls scoped per-document, not per-account — you choose exactly who can open a given file
Export to .docx and .pdf for anything that needs to leave the encrypted environment
Storage that counts against your Proton Drive quota, since Docs lives inside Drive rather than as a separate product

What it doesn't try to be: a full Google Docs or Microsoft 365 replacement. There's no add-on marketplace, no advanced formatting engine, no decade of Office-file fidelity. It's built for the documents where the content matters more than the feature set — internal specs, client deliverables with sensitive figures, anything you'd think twice about before pasting into an AI chat window.

Documents your AI provider can't read, by design

Proton Docs applies zero-access encryption to real-time collaborative editing — the same model Proton uses for Mail, extended to the documents most privacy setups never think to cover.

Learn More

Affiliate Disclosure: This article may contain affiliate links. If you make a purchase through these links, we may earn a small commission at no extra cost to you. We only recommend products we genuinely believe in. This helps support our work and allows us to continue providing free content.

How the Major Document Tools Actually Compare

The feature checklists for Google Docs, Microsoft 365, Notion, and Proton Docs look similar from a distance — real-time editing, comments, version history. The difference that actually matters for this audience is who holds the decryption key, and what the provider's terms say it's allowed to do with content it can read.

|---|---|---|---|---|

| AI training use of content | Permitted by default on consumer accounts unless opted out | Admin-controlled on paid tiers; Copilot references doc content | Permitted under product-improvement terms | Not possible — provider cannot read content |

| Real-time collaboration | Yes | Yes | Yes | Yes |

| Client/ecosystem integration required | N/A | N/A | N/A | Breaks if collaborators aren't also on Proton |

The pattern across the first three columns is the same one that shows up everywhere else in this space: the tool is free or cheap because the content is also the product. Proton Docs trades the ecosystem depth for a structural guarantee the other three can't offer, no matter how their AI-training settings are configured this month.

A Concrete Example of Where This Bites

Picture a freelance developer who's already careful — Ollama running the model for anything client-related, prompts scrubbed of names and account numbers before they touch any cloud API, source files sitting in encrypted storage, the kind of setup covered in what your client NDA actually requires for encrypted storage. Between calls, they open a Google Doc to draft a technical spec for a client's internal tool: architecture decisions, database schema notes, a rough estimate of what the client's current system is worth replacing, and — because it's a working draft, not a finished deliverable — some blunt commentary on where the client's existing codebase falls short.

None of that ever touches the LLM. It doesn't need to — it's sitting in a document that Google's systems can read by default, on an account where AI-feature settings were never explicitly reviewed. The exact category of content the developer has spent weeks being careful not to expose to a model was sitting in the one tool nobody thought to audit, because it didn't feel like an "AI tool" — it felt like a text editor.

That's the whole point of the blind spot: the risk isn't in the tools that are obviously AI products. It's in the ordinary ones that happen to be owned by a company that also ships an AI product, using the same account and the same default settings.

Where This Fits Next to a Local LLM Setup

If you've already built a private AI workflow, the pieces you likely have in place are: a local model for anything sensitive, a scrubbing step before anything touches a cloud API, and maybe encrypted storage for source documents and outputs. Proton Docs slots into the gap between "documents I'm storing" and "documents I'm actively writing in."

A workable division looks like this:

Drafting and internal work — specs, notes, early client deliverables, anything you control end to end — moves to Proton Docs. This is the highest-value shift, because it's the content that was previously sitting in Google Docs by default with no one deciding it should be there.

Finished output that needs to go somewhere else exports as .docx at the point it actually needs to leave — a client portal, an email attachment, a shared Google Doc a client insists on. The encryption protects the document for the entire period it's yours alone; it stops mattering once you deliberately hand a copy to a system outside your control, which is a decision you're now making consciously instead of by default.

Source material feeding a RAG pipeline or local model stays in whatever encrypted storage you're already using — Proton Drive, Tresorit, or similar (see Tresorit vs. Proton Drive if you haven't picked one), or the kind of self-hosted setup in building a private document Q&A system with Ollama, LangChain, and ChromaDB — with Docs as the editing layer on top when that source material is something you're actively drafting rather than just storing.

The Honest Limitations

This isn't a drop-in replacement, and claiming otherwise would be the kind of overpromise this audience is specifically allergic to.

No ecosystem integration. A document a client shares via Google Docs stays in Google Docs. Proton Docs doesn't plug into Workspace or Microsoft 365's collaboration layer — it's a separate encrypted environment, not a compatible one. If your work requires living inside a client's existing Google or Microsoft setup, that requirement doesn't go away.

Feature depth is genuinely thinner. Advanced formatting, an add-on marketplace, and pixel-perfect Office-file round-tripping aren't there. For a document that needs to look identical after five rounds of Word-to-Docs-to-Word conversion, Google Docs is still the safer bet.

Mobile and offline maturity is behind the incumbents. Proton's document tools are newer than Google's or Microsoft's by more than a decade — expect fewer edge cases handled gracefully, not none.

None of that changes the core trade: for the documents where privacy is the actual requirement — not a nice-to-have — those limitations are the cost of a provider that structurally cannot read the content, versus one that can and has told you, in writing, that it might use it to train the next model.

A Realistic Migration Path

Don't move everything at once. The highest-value first step is identifying the documents you'd never want summarized by an AI feature you didn't invoke — client contracts, anything with unredacted financial figures, early drafts of work product you haven't decided how to position yet — and starting those in Proton Docs going forward. Existing Google Docs don't need a mass export; the point isn't purging history, it's changing where new sensitive drafting happens by default.

If you're already paying for Proton Mail or Proton VPN, Docs comes bundled with Drive storage under Proton Unlimited, which usually makes more sense than paying for Docs-equivalent storage twice across two vendors.

One encrypted stack instead of five separate accounts

Proton Unlimited bundles Mail, VPN, Drive, Docs, and Pass under one zero-access encryption model — the same one your local LLM setup was already trying to extend to the rest of your workflow.

Learn More

The prompt window was never the whole workflow — it's just the part that was obviously an AI interaction. The documents around it are where most of the actual sensitive content lives, and they've been exposed to the same category of AI training use the whole time you were being careful about everything else.

Stay ahead of AI and privacy tool changes. We publish a weekly breakdown of new tools, policy changes, and practical guides for keeping your digital life private. No tracking, no third-party ads.

Stay Updated

Join our newsletter for the latest updates.