Google confirms that private Gmail messages can sometimes be read by third-party app developers.