Ente

End-to-end encryption means Ente cannot access your files or biometric data even if it wanted to; no cookies are used anywhere; app usage metrics are not collected; and crash reports are anonymised — one of the leanest collection profiles of any cloud storage service.

No selling, no renting, no trading of personal information — a categorical commitment with no asterisk; all 19 third-party service providers are named with their use cases and privacy policy links; the main exposures are US-based infrastructure for email sending and some cloud storage, and a standard merger/sale clause.

Full GDPR rights for EU users (access, rectification, erasure, portability, restriction, withdrawal), a named and contactable Data Protection Officer, cryptocurrency payment options for reduced financial traceability, and self-service account deletion with clear file purging commitments; the 60-day data retention window post-termination is reasonable but worth noting.

Open source apps make E2EE claims independently verifiable; regular penetration tests and security scans are cited; 72-hour breach notification commitment exceeds GDPR minimum; European server infrastructure (Scaleway, Hetzner) for primary storage; the structural weakness is US/Delaware incorporation, which creates FISA and NSL exposure despite European data residency.