Dropbox
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared only with the providers who run the service.
- The policy describes staff access for safety and legal checks.
You keep your files; they scan them to run the service, keep data ~30 days after delete.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account info, your files, usage, device IDs, cookies, and optional contacts and location.
Read the exact line
Privacy policy
“We also collect information from and about the devices you use to access the Services. This includes things like IP addresses, the type of browser and device you use, the web page you visited before coming to our sites, and identifiers associated with your devices.”
Training
They store and scan your files to run features, and use data to improve, protect, and promote Dropbox.
Read the exact line
Terms of service
“To provide these and other features, Dropbox accesses, stores, and scans Your Stuff. You give us permission to do those things, and this permission extends to our affiliates and trusted third parties we work with.”
Sharing
They say they will not sell to advertisers; providers, Dropbox companies, and collaborators can see data.
Read the exact line
Privacy policy
“We may share information as discussed below, but we won’t sell it to advertisers or other third parties.”
Kept
They keep your stuff while the account exists, then start deleting 30 days after you delete the account.
Read the exact line
Privacy policy
“If you delete your account, we’ll initiate deletion of this information after 30 days.”
Controls
You can access, edit, download, and delete data from account settings, and unsubscribe from marketing.
Read the exact line
Privacy policy
“You can access, amend, download, and delete your personal information by logging into your Dropbox account and going to your account settings page.”
Fine print
U.S. paid plans auto-renew with few refunds.
No exact line could be verified.
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Opt out of U.S.
Terms: submit the opt-out form within 30 days of first registering or agreeing to the Terms
Download a copy of Your Stuff
Privacy: Dropbox account, as outlined in the access/download help they link
Cancel a paid plan before renewal
Paid Accounts section of the Terms; annual plans also get a reminder email
Unsubscribe from marketing or email privacy@dropbox.com
Unsubscribe link in emails, Notifications in personal account, or privacy@dropbox.com
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
If something goes wrong, they usually will not pay more than $20 or what you paid this plan period.
Read the exact line
Terms of service
“WE TO YOU TO THE GREATER OF $20 USD OR 100% OF ANY AMOUNT YOU'VE PAID UNDER YOUR CURRENT SERVICE PLAN WITH DROPBOX.”
For example, if a bug wiped important work files, they might cap what they owe at $20 if you are on a free plan.
Paid storage keeps charging until you cancel. Refunds are only when the law says they must.
Read the exact line
Terms of service
“We’ll automatically bill you from the date you convert to a Paid Account and on each periodic renewal until cancellation.”
For example, if you forget to cancel an annual plan, they charge again and generally will not refund.
They read and scan your files so features like search, previews, and OCR can work.
Read the exact line
Terms of service
“To provide these and other features, Dropbox accesses, stores, and scans Your Stuff.”
For example, a photo or PDF you upload can be scanned so Dropbox can show a thumbnail and searchable text.
Third parties can set cookies to advertise Dropbox, with an opt-out described elsewhere.
Read the exact line
Privacy policy
“We may also use third-party service providers that set cookies and similar technologies to promote Dropbox services.”
For example, after visiting Dropbox you might see Dropbox ads on other sites.
Your phone or computer may send location data depending on settings.
Read the exact line
Privacy policy
“Your devices (depending on their settings) may also transmit location information to the Services.”
For example, using the mobile app with location on could send where you are when you open Dropbox.
Account deletion starts after 30 days, but backups and legal needs can keep some data longer.
Read the exact line
Privacy policy
“If you delete your account, we’ll initiate deletion of this information after 30 days.”
For example, after you close the account, files may still sit on backups for a while.
In many cases they warn you and let you download files before closing the account, but not always.
Read the exact line
Terms of service
“We’ll provide you with reasonable advance notice via the email address associated with your account to remedy the activity that prompted us to contact you and give you the opportunity to export Your Stuff from our Services.”
For example, if they think you broke the rules in a serious way, they may lock you out with no export.
You still own your files; they only get permission to run the product.
Read the exact line
Terms of service
“Your Stuff is yours. These Terms don’t give us any rights to Your Stuff except for the limited rights that enable us to offer the Services.”
For example, they cannot claim they own a novel you stored in Dropbox.
They say they do not sell your personal data to advertisers.
Read the exact line
Privacy policy
“We may share information as discussed below, but we won’t sell it to advertisers or other third parties.”
For example, they say they will not sell your email list to an ad network.
Kids under those ages are not allowed; it is based on what you say, not a strong ID check in these terms.
Read the exact line
Terms of service
“to use our Services, you must be at least 13 if you reside in the United States, and 16 if you reside anywhere else.”
For example, a 12-year-old in the U.S. is not supposed to have an account.
Words to know
Legal words from the lines above, in plain English.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- limitation of liability
- A cap on what the company will ever pay you if something goes wrong, often only what you paid in the last year. For example, if a leak of your data costs you thousands, the most you may get back is a month's subscription fee.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
How we got here · grade A · score 60/100 · 15 of 15 policy answers backed by a verified quote · 3 not stated
What does the app collect beyond what it needs to work?
They collect account info, your files, usage actions, device IDs, IP, cookies, and optional contacts. Devices may also send location.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
They may review content for Acceptable Use and use automated tools against abuse; they do not describe routine sampling of private files for training.
Are you profiled or tracked for advertising?
Third parties can set cookies to promote Dropbox, and they point to an advertising opt-out.
Do they sell or share your data, and can you opt out?
They say they will not sell to advertisers. They share with trusted providers, other Dropbox companies, and people you collaborate with.
What rights do they take over what you type and what the AI makes?
They say your stuff is yours and they only take limited rights needed to offer the service, including scanning files.
How long do they keep your data after you delete it, and can you delete it in the app?
You can delete from the account. After you delete the account they start deleting after 30 days, with backup delay and legal holds.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe a security team, two-factor authentication, encryption of files at rest, and device alerts. No independent audit is named here.
Is there a real age gate, and are teens protected?
You must be 13 in the U.S. and 16 elsewhere, or older if local law requires parental consent. No extra age check is described.
Will they tell you when the rules change, and is the policy specific?
Policies are dated. Material terms changes get at least 30 days’ email or in-product notice. Privacy says they notify if a revision meaningfully reduces your rights.
Can they close your account without warning, and can you get your data out first?
They usually give email notice and a chance to export. For serious breaches or legal bans they may close access with no export.
If something goes wrong, who pays?
The service is “as is.” Where allowed, liability is capped at $20 or 100% of what you paid on the current plan.
Do subscriptions renew on their own, and can you get a refund?
Paid accounts auto-renew until you cancel. Refunds only if required by law. Fee changes get 30 days’ notice.
The privacy policy is 2,854 words at a college level (Flesch reading ease 48.7); the terms are 4,103 words at a college level.
