pCloud

Only an email address is required to create an account; pCloud explicitly does not process special categories of sensitive data; but tracking services collect behavioral data including visited pages, navigation paths, and usage patterns, and standard file storage is not end-to-end encrypted — pCloud holds the keys to your stored files and can technically access them.

pCloud explicitly does not sell personal data and does not share it with third parties for their marketing purposes; sharing with advertising companies requires user consent; but a business transfer clause could expose data in an acquisition, and aggregated statistical data is shared with third parties including other businesses.

Users can choose EU or US server storage and change that choice at any time — a meaningful data sovereignty control; account deletion results in permanent file removal after 30 days; standard GDPR rights apply; but the policy accepts changes via continued use with no advance notice requirement, and the policy itself has not been updated since March 2023.

Swiss jurisdiction provides genuine data protection advantages and EU adequacy status; pCloud's no-sell commitment is unusually strong; but there are no named security certifications, no published independent audits, encryption is described only generically, the policy is three years out of date, and the standard service does not offer zero-knowledge encryption for stored files.