Aside from remote images, they store all of your emails on their servers. Not sure why they don't receive the same scrutiny that other email apps like Edison have [1].
I've heard enough fishy stories from former engineers there — people should think twice before logging in and letting them ingest your full account history (as with any third party email app, which Gmail is already cracking down on [2]).
[1] https://www.macrumors.com/2018/07/02/third-party-email-apps-...
[2] https://www.androidpolice.com/2018/10/08/google-updates-gmai...