Which cloud storage services train AI on your data?

MEGA’s policy makes a claim about what it can do, not what it does: “we cannot decrypt Your Files and Chats”, and on that basis it excludes them from the policy altogether. That’s what an A is for on this site. The company can’t reach the content, so the training question doesn’t arise for it. The A says nothing about what MEGA does hold: account data, usage data, IP address, device type and the metadata it gathers about file type.

Cryptomator encrypts your files on your own device and says of them: “Under no circumstances will we receive any of this data”. The commitment is absolute, but it’s a statement of intention, not capability. The document never says the company couldn’t read the files, only that it won’t receive them. The verdict calls the B the closest miss on the site. What the policy does disclose is modest: update checks, error codes, and log files you choose to send.

Dropbox’s commitment is plain, “We will not build generative AI models using customer content without consent”, and it’s graded on that. Where it lives is the finding. The sentence is on a principles page, not in the privacy policy, which still contains no form of the word train and merely points at an FAQ. It’s scoped to generative models, so predictive machine learning isn’t addressed either way, and what granting consent would look like is never described.

Box’s privacy policy has served a challenge page since early September, so the answer comes from the Box AI FAQ in its support centre: “Box also does not train AI models based on customer data”. Its model providers don’t train on what they receive from Box. The future is carved out honestly: custom models trained on a customer’s content, if ever offered, would need that customer’s explicit approval. Customers can switch Box AI off. A B because it’s an undertaking, not a capability.

Backblaze copies whole machines, which makes it the holder of everything on them. Its privacy policy contains no form of train, no machine learning and no AI, and it says why. The notice applies only to information collected in respect of your account and “not to the content that you store on our system”. For that content the account holder is the controller and Backblaze the processor. The document scopes your files out of itself instead of answering for them, so the question has no home in it.

pCloud sells encrypted storage on the strength of holding files privately. Its privacy policy mentions neither AI, machine learning nor model training, and what’s absent matters twice over. There’s no capability statement either, nothing that says pCloud can’t read what it stores. The silence covers both questions this category asks.

Sync.com markets zero-knowledge encryption heavily. The policy captured here doesn’t make that a capability claim in terms this site can grade, and says nothing about training either. Its one use of train is Sync having “trained its staff” on its own privacy practices. A governance statement, not a use of your files.