Is NotebookLM (Gemini Notebook) private? What Google says — and what a browser extension adds

Before you upload a client file, a thesis draft or three years of a group chat into NotebookLM, the question is reasonable: who can read it afterwards. There are two honest answers. One is Google’s, written in its own help pages. The other concerns anything you install on top — a browser extension that works inside your signed-in notebook sees what it touches, and the only thing that matters is where it sends it.

This post gives both. Google’s side is quoted from its pages as checked on 2026-08-21, with links, because these sentences change. The extension side describes source-lm, the one we can vouch for, and ends with how to check any other one yourself.

What Google says

NotebookLM was renamed Gemini Notebook on July 16, 2026 — Google’s announcement — and the help pages now use the new name. The privacy terms are the same product’s terms.

Which terms apply depends on the account you are signed in with. Google’s privacy and terms page says work accounts fall under the Google Cloud Terms of Service, school accounts under the Workspace for Education terms, and everyone else under the general Google Terms of Service. The practical consequence is below.

Does NotebookLM train on your data?

On a personal account, Google’s statement is: “The content in Gemini Notebook will not be used to directly train our foundational AI models, unless you choose to provide feedback.” Feedback is the exception — if you send a thumbs-down, the submission collects “your prompts, customizations, sources, uploads, and the outputs received”, and humans review it: “Human review is necessary to help identify, address, and report potential problems raised in feedback.” Google says it disconnects feedback from your account before reviewers see it, and keeps reviewed feedback “for up to 3 years, disconnected from your Google Account”. All of that is on the same page.

On a Workspace or Education account the line is firmer: “Your uploads, queries and the model’s responses in Gemini Notebook will not be reviewed by human reviewers even when you provide thumbs up or down feedback, and will not be used to train AI models.” Google’s Workspace privacy hub adds that prompts and responses are “Not retained after session ends”, that uploaded files and notebooks follow the Cloud Data Processing Addendum, and that admins can switch the product on or off per organisational unit.

Is NotebookLM HIPAA compliant?

No, as of the date above. The same privacy hub states: “Gemini Notebook does not support ISO, SOC, or FedRAMP compliance and is not covered by the Google Business Associate Agreement (BAA) for HIPAA compliance.” Google says it plans to work toward those certifications. Its HIPAA Included Functionality list dated May 14, 2026 names Gmail, Drive, Meet, the Gemini app and others — Gemini Notebook is not on it. If your material is protected health information, that is the answer until Google’s page changes.

There is also Gemini Notebook Enterprise, a Google Cloud edition where data stays in your own Cloud project, with VPC Service Controls, customer-managed encryption keys and sharing limited to the project; whether it is covered by the BAA is not stated on that page, so ask Google, not us.

Is NotebookLM secure?

It is a Google web application: it runs under your Google account, your data sits on Google’s servers under Google’s privacy policy, and the access controls are Google’s — sharing a notebook is the main way its contents reach someone else. Google separately states that “Chat responses in Gemini Notebook only use data from your sources” and that “Chat history is retained and kept private to you” (help page). What Google does not publish for the consumer product is a security certification, per the HIPAA answer above. “Secure” here means “as secure as the rest of your Google account”, which for most people is the real boundary: a weak password or a shared notebook is a bigger risk than the model.

What a browser extension adds to that surface

Any extension that does anything inside your notebook — adds sources, deletes them, reads a page for you — runs with access to that page while you are signed in. That is unavoidable; it is how extensions work. So the question is not whether it can see things, but where it sends them and whether you can verify that.

For source-lm, the answer is in its code, and the privacy policy says the same thing in longer form:

• It makes exactly four kinds of outbound request. The notebook’s own origin (notebooklm.google.com / notebook.google.com, the same RPCs the web app makes), that origin’s resumable-upload endpoint, the Google upload host it hands back, and api.lemonsqueezy.com for a licence-key check — sent with credentials omitted, carrying the key and an OS name, nothing about your notebooks. There is no server run by the author, no proxy, no telemetry, no analytics, no crash reporting, no remote code.
• It collects only on a click. The JSON file you pick in the popup, parsed in the popup’s memory. The active tab’s text, only when you click “Add page as .md”. Video links and titles on a YouTube page, only when you click one of its “Add to notebook” buttons. Its scripts on youtube.com and the notebook host read the page only to place those buttons and to cache your notebook list; nothing is collected or sent until you click.
• Permissions are three, per its manifest.json: activeTab, storage, scripting. Host access covers four domains: the two notebook hosts, www.youtube.com, and api.lemonsqueezy.com. No tabs, no <all_urls>, no background service worker.
• What it stores stays on your side, with one caveat. Settings, the licence key and the free plan’s counter live in chrome.storage.sync, which Chrome syncs to your own Google account. That is Chrome’s sync, not a transfer to us — but it is why we say “no backend of ours, no third-party server” and not “nothing leaves your browser”.
• You can check it. The code is source-available under the PolyForm Noncommercial License 1.0.0 and ships unminified, so the bundle you install reads the same as the source.

How to check any extension yourself

• Read the manifest. permissions and host_permissions are the whole standing surface. <all_urls> or tabs on a tool that only needs your notebook is a question to ask.
• Look for remote code. A script fetched from a URL at runtime can change after review; an extension that ships all of its code cannot.
• Read the privacy policy’s “where it goes” section, not the summary. If it names a server of the vendor’s, your sources pass through it.
• Prefer unminified, source-available code. If you cannot read it, you are taking the description on trust.

Limits

• This is not legal advice, and it does not cover your organisation’s own rules about where data may go.
• Google’s statements are quoted as checked on 2026-08-21. They move; the linked pages win over this post.
• Enterprise edition compliance (BAA, certifications) is not confirmed on the page we could read.
• The extension facts describe source-lm only. Other extensions have their own manifests and policies — the checklist above is how to read them.

Not affiliated with Google. NotebookLM and Gemini are Google trademarks; this is an independent extension that automates a signed-in session.

Get source-lm — adding one page, one link or one video is free and unmetered, with no account and no server of ours.