The parent comment has a point. A layperson (or at least many people not read into this topic) isn't going to read the language in that privacy policy and come to the conclusion that "any private web page you ask Gemini about will be dumped into our training data". The text on Google's privacy page could absolutely be made more explicit.

I'm sceptical a layperson will understand or care what it means that their data will be used in training. If you are concerned about such things this heavily implies you don't want to share your data. Just don't agree to the terms and move on.

If I am looking at a web page that shows me my own API keys for a service in plain text, and I accidentally click the Gemini button while viewing that page, is there a chance that someone in six months time might ask Gemini for an API key for that service and have mine returned to them?

I'd love to get a confident answer to that question.