Does Cryptomator train on your data?
Cryptomator encrypts your files on your own device and says it will never receive them. An absolute commitment — but the policy never says it *cannot*, which is what separates an A from a B here.
No opt-out found in this policy
"Any such data is processed solely on the user's local device. Under no circumstances will we receive any of this data."
- 18 Aug 2026
- 5 Oct 2026
- All versions
- global
- Fetched from the company
- 62D66250…2042
How we read it: A deliberately strict call, and the closest miss on the site. Cryptomator is local-first software; the vault never leaves your device unencrypted, and it is very likely the company could not read your files if it wanted to. But the A grade is awarded on what the document states, and this document states an intention — "under no circumstances will we receive" — where Bitwarden's says "cannot access" and Tuta's says "has no access to". A commitment, however absolute, is revocable by editing the page it is written on; that is the whole reason the line is drawn where it is. What the policy does disclose is modest: update checks, error codes, and log files you choose to send.
cannot, unable, no access, technically, zero-knowledge, never receive
What the document does offer
- "An exception is made in cases where prior consent cannot be obtained for factual reasons" — about consent, not about file access
- "In such a case the conversation cannot be continued" — about support correspondence
Why none of it applies: Both uses of "cannot" are about other things entirely, and "unable", "no access" and "zero-knowledge" appear nowhere. So the document promises that files are encrypted on your device and never reach Cryptomator, and never says the company could not read them if they did. That gap is the whole distance between this B and an A, which is why the headline draws attention to it.
What each plan can refuse
The same questions, asked of every plan we could identify. Every cell comes from a quoted clause or a documented search - see the evidence above.
- Nothing to switch off
- Not stated
- 18 / 100
- Not stated
- Unknown
How to opt out of Cryptomator AI training
Plan by plan, from what Cryptomator's own policy says about refusing. Where it publishes the steps, they're listed here with the limits they carry. Where there's nothing to switch off, or nothing graded, this says so instead of inventing a menu path.
All versions
Nothing to switch off: Cryptomator's policy says training is off here.
What this policy has done since we started watching
The record starts here. Cryptomator's policy was first captured on 18 Aug 2026, and there's no earlier copy to compare it against, so this verdict has no history behind it yet. From now on every re-read is diffed against that copy, and anything that moves appears here.
Everything we read
Vendor response
We haven't yet written to Cryptomator about this verdict, and they haven't disputed, clarified or announced a change to any clause quoted above. When either happens it's published here, word for word.
Report a wrong clauseShow this verdict on your site
Cryptomator is graded B, and a company that's earned that can say so with the verdict itself. The image below links back to this page and shows the live grade. If the grade changes, the badge changes the same day, wherever it's embedded. It's free and it isn't for sale.
