Google has confirmed that private emails sent and received by Gmail users can sometimes be read by third-party app developers, not just machines.