Does Google actually use Google Docs content to train Gemini?

Google's terms permit it under the same Workspace Labs and product-improvement provisions that cover Gmail and other consumer Workspace products, and Google has stated that content is used to develop and improve its AI features unless an admin or user opts out through the relevant Workspace settings. For personal Google accounts, the default posture is more permissive than for paid Workspace Business/Enterprise tiers, where admins can disable smart features and AI training use. The practical takeaway is the same either way: the text of your document is legible to Google's systems by default, and turning that off requires an active setting change, not silence.

Is Proton Docs actually end-to-end encrypted, including real-time collaboration?

Yes. Proton Docs encrypts document content client-side before it syncs, and collaborators decrypt it locally on their own devices — Proton's servers store and relay encrypted data without holding a readable copy. This applies to real-time multi-cursor editing, not just static storage, which is the harder engineering problem most encrypted-docs claims quietly skip. Comments and version history are encrypted under the same model.

Can I use Proton Docs if my team is on Google Workspace or Microsoft 365?

Partially, and this is the honest limitation. Proton Docs works well for documents you fully control — your own drafts, internal notes, anything where you choose every collaborator. It does not integrate with Google's or Microsoft's collaboration ecosystems, so a document a client shares with you via Google Docs stays in Google Docs unless you export and re-import it, which loses live collaboration. Most privacy-conscious tech workers run a hybrid setup: sensitive drafting happens in Proton Docs, client-mandated collaboration happens wherever the client already works.

Does switching to Proton Docs mean giving up features like Google Docs add-ons or Office-compatible formatting?

Yes, largely. Proton Docs is intentionally minimal — it supports core rich-text editing, comments, and real-time collaboration, but it does not have the add-on ecosystem, advanced formatting, or Office-file fidelity that Google Docs and Microsoft 365 have built over a decade. It exports to standard formats (.docx, .pdf) for anything that needs to leave the encrypted environment. Treat it as the tool for documents where privacy matters more than feature depth, not a full replacement for every document you touch.

Your AI Stack Is Private. Your Google Docs Aren't.

If you've already moved your AI workflow local — running models through Ollama, scrubbing PII before anything touches a cloud API, picking privacy-respecting tools over ChatGPT by default — you've solved the part of the privacy problem that's easy to see. The prompt window is the part everyone locks down first, because it's the part that obviously talks to an AI model.

The part that doesn't get locked down is the document sitting open in another tab: the spec you're drafting, the meeting notes, the client deliverable, the code review checklist. If that document lives in Google Docs, it's sitting inside the same company that trains Gemini, under terms that permit using its content to develop and improve AI features by default. Microsoft 365 runs the same play with Copilot. The LLM you're careful with isn't the only AI touching your work — it's just the one you remember to think about.

This is the same audience, the same threat model, and a genuinely different tool from the one you already solved for.

The Blind Spot Most Private-AI Setups Miss

The instinct to protect prompt content is correct — a prompt is often the most sensitive single artifact in a workflow, because it's where you spell out exactly what you're trying to do with exactly what data. But a document you draft over the course of a week contains more raw information than any single prompt: full client context, unredacted names and figures, early-stage thinking you'd never paste into a chat window because it's not "a question" yet, it's just a working file.

Three things make this worse than it looks at first glance:

It's persistent, not transactional. A prompt exists for one exchange. A Google Doc exists for the life of the project, gets revised fifty times, gets shared with three more people, and sits in a Drive folder indefinitely after the project ends — a much longer exposure window than any single AI interaction.

It's the input to AI features you didn't ask for. Gemini in Workspace can summarize, extend, and reference the content of your open documents by default in many configurations. You don't have to invoke it for it to have access to what's on the page — "Help me write" and "Summarize this doc" are features sitting one click away from content you never explicitly submitted to an AI.

You can't scrub it the way you scrub a prompt. People who are careful about AI privacy have usually built a habit of stripping identifying details before they send something to a model. Nobody redacts their own working drafts before saving them — that would defeat the purpose of the document.

What "Private" Document Editing Actually Requires

The bar is the same one you'd apply to a local LLM setup: does the platform holding this content have the technical ability to read it, independent of what its policy says it will do with that ability.

Standard cloud document tools — Google Docs, Microsoft 365, Notion — encrypt data in transit and at rest, but hold the decryption keys themselves. That's the same distinction that matters for cloud storage and email: encryption without end-to-end key control means the provider can read the content whenever it wants to, whether for AI training, a subpoena, an internal investigation, or a breach. Policy is the only thing standing between your document and a third party reading it, and policy changes — Workspace's AI terms today aren't the ones it shipped five years ago.

End-to-end encrypted document editing removes that variable. The provider stores and syncs ciphertext it cannot read, full stop, regardless of what its terms of service say this quarter.

Proton Docs — Built on the Same Model as Proton Mail

Proton Docs applies the zero-access encryption model Proton built for Mail and Drive to real-time document editing, which is a harder problem than encrypting a static file — multiple people typing into the same document simultaneously, with each keystroke encrypted client-side before it syncs, decrypted locally by collaborators, and never readable by Proton's servers in between.

What it covers:

Rich-text documents with real-time multi-cursor collaboration, comments, and suggestions
Full version history, encrypted under the same model as the live document
Access controls scoped per-document, not per-account — you choose exactly who can open a given file
Export to .docx and .pdf for anything that needs to leave the encrypted environment
Storage that counts against your Proton Drive quota, since Docs lives inside Drive rather than as a separate product

What it doesn't try to be: a full Google Docs or Microsoft 365 replacement. There's no add-on marketplace, no advanced formatting engine, no decade of Office-file fidelity. It's built for the documents where the content matters more than the feature set — internal specs, client deliverables with sensitive figures, anything you'd think twice about before pasting into an AI chat window.

Documents your AI provider can't read, by design

Proton Docs applies zero-access encryption to real-time collaborative editing — the same model Proton uses for Mail, extended to the documents most privacy setups never think to cover.

Learn More

Affiliate Disclosure: This article may contain affiliate links. If you make a purchase through these links, we may earn a small commission at no extra cost to you. We only recommend products we genuinely believe in. This helps support our work and allows us to continue providing free content.

The prompt window was never the whole workflow — it's just the part that was obviously an AI interaction. The documents around it are where most of the actual sensitive content lives, and they've been exposed to the same category of AI training use the whole time you were being careful about everything else.

Stay ahead of AI and privacy tool changes. We publish a weekly breakdown of new tools, policy changes, and practical guides for keeping your digital life private. No tracking, no third-party ads.

Stay Updated

Join our newsletter for the latest updates.