People should really read the privacy policies before using any email app these days. Many popular ones state that they, at minimum, will keep access tokens on their servers, and many outright cache copies of your messages.
If a hacker gained access to my Gmail access tokens, they're a password reset link away from taking over most of my other online accounts and probably more than a few banking accounts. And then deleting the password reset emails.
Having worked for large and small companies (including ones that handle emails), security is always second (or third) compared to other business priorities. It takes a large effort to make sure everything is locked down and most companies don't have the skills, resources, and commitment to properly secure everything even if they nominally claim that security is important.
https://www.theregister.co.uk/2019/05/29/protonmail_dismisse...
As a result, I gave up bothering to read them unless they're one or two paragraphs long. I simply assume they say what 90% of them really say: they can take any data they like, do whatever they like with it, and they can unilaterally change the agreement any time they want.