Emails sent from CRM are not private - no matter the setting regarding email being private or public
When you link your email in CRM via IMAP, all your email correspondence between you and an account/contact/lead in CRM is linked to the CRM record. In the Settings under Channels - Email, where you configure your email server, you'll find settings regarding email privacy.
Let's start with the "Store sent messages on the server" - Zoho CRM uses it's own server for sending emails - these do not go via your server - however, the emails are showing your correct details and reply address. This is done so you can send emails from CRM even if you do not have your email server linked. By ticking this box, all messages sent from CRM are also stored in your "sent items" folder in your email server (if you see your sent messages stored twice in your email server, then you should uncheck this box).
There are three choices of Privacy - Private, Public, and Custom. In Private, all emails you receive from the customer are only viewable by you - that means that another user that has access to this particular contact record, will not be able to see the emails that you receive from this contact. If you set it to Public, all emails received from this contact record are visible by all users with access to this contact account. The final setting, Custom, lets you choose for each record if the email is to be shared, or kept private. Note that this setting is for ALL emails for this particular record, you CANNOT select individual email records.
The workaround - until Zoho has addressed this with a feature update - is to 1. set your emails to Private in CRM, and 2. do NOT SEND emails that need to be kept confidential from the CRM system. The email that you send via your email client (i.e. Outlook) will be recorded against the contact in Zoho CRM, and since it was NOT sent via Zoho CRM, the Private/Public settings in your IMAP configuration will be respected.
-ALL EMAILS SENT VIA CRM ARE PUBLIC, VISIBLE TO ANY USER WITH ACCESS TO THAT CONTACT CARD -
Settings for Private, Public, and Custom pertain emails RECEIVED from your customer only. The reason for this is that the CRM system sends emails via its native email capability. The sent items are therefore not sent via your Email server (hence the checkbox for allowing messages to be stored in your "sent items" folder. We have raised a feature request with Zoho, we see this as a security issue. For example, if you have a confidential email thread with your customer, all emails sent from CRM are automatically shared to anyone with access to that record, regardless of the Private/Public setting. Since your reply will contain all messages in the trail, you may be exposing sensitive data.