are there docs on keeping users’ emails private?

I don't understand this question, can you elaborate?

Say my app has user authentication with email/password. I don’t want any old person from querying the graphcool API and seeing all my user’s email addresses

gotcha, you can tweak permissions to make that happen

Oh thanks! I’m a graphcool novice but excited to move to it if all goes as planned