Hi @akassab,
Please confirm /user endpoint should not have emailAddress field neither for everyone visibility no private.
After my profile been updated I can not receive emailAddress no matter of privacy settings.
Here Guidelines for Testing Profile Visibility Controls
at ‘Examples’ - ‘All fields are unhidden’ emailAddress persists.
Thank you.