Assuming sincerity: much of the technical stack is based on GNU tools, projects, libraries, etc.
What? Gmail and privacy in one sentence? How does that fit?
How?
Client side encryption\decryption(can be done in javascript) with Gmail storing and passing nothing but encrypted data they themselves have no means of reading.
Of course, that would mean Google has no means of directing ads based on content so they would have no incentive to run Gmail in the first place...