The files are the small half: the account, the logs and the metadata are the rest, and backup rotation keeps copies after delete. On a workplace or family plan the account may not be yours to close, and an admin may read what's inside.
A store of your files and correspondence. Worth keeping.
Backups and "anonymised" derived data can persist with no clear end date, and purge lags deletion.
An account needs an email; ID is rare.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
What leaks here is the content itself: the files, the messages, the drafts you never finished. On a work account the breach reaches everyone whose documents sat in it, none of whom picked the vendor.
The files are the small half
Policies separate your content from what they call service data, and only the first gets the strong promises. The second is every file you opened, when, from where, on what device, and for how long, kept as the record of you using the product rather than as anything you made.
The deal can change after you have stored everything
This is the trade where terms have visibly changed under people: model-training rights added by default, then walked back after the backlash, more than once. Switching it off is per workspace and often per admin, so the choice is not always yours to make, and a model already trained does not unlearn.
The account may not be yours to close
Pay for it yourself and you are the customer. If an employer or a school pays, they are, and the vendor answers to them: an administrator can read, export and hand over what is in your account, and a deletion request goes to that organisation rather than to the vendor.
Deletion here comes with a number, and a catch
Unusually, most policies say how long: a trash window, then backups and replicas until the rotation catches up, commonly a month to six. The catch is what deletion does not reach. Anything you shared into someone else's workspace stays theirs, and aggregated usage data sits outside the promise entirely.
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Shared files and contacts map your network.
Two kinds of hold. LAW SETS IT: a statute makes them keep it. THEY SET IT: a ground the company grants itself.
They treat it as no longer being about you, though such data can sometimes be re-identified.
Deleted data sits in backups and replicas until the backup rotation reaches it.
To flag suspected fraud, often on a shared industry database you cannot reach through the company.
Tax and company law makes them keep billing and payment records.
They can keep records to defend a live or possible legal claim.
The pull here is the corpus. Years of documents and conversations in one place is the most valuable training material a company can have without buying any, which is why the terms keep moving toward it. Underneath sits the ordinary commercial appetite for usage analytics, kept in aggregate with no end date on it.
Usage data feeds product analytics; content is generally not sold.
Content may train models unless you opt out, which works only going forward.
Anonymised is their word. Stored content is full of identifiers, and its writing style attributes to you at scale (Staab et al., ICLR 2024).
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
Language models infer where a person lives, their income, and their sex from their writing alone, at near-human accuracy and at scale (Staab et al., ICLR 2024).
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
THE STUDIES Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024, 2024)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation, and increasingly AI training can all ride under it. When they want to do something new with your data, this sentence usually already covers it.
THE MOVE An objection draws the line: use your data to run the service, not to improve, target, or train on it.
“we do not sell your personal information”
Often technically true, and still misleading. It usually means no cash changes hands. Data can still flow to ad networks, analytics firms, and partners: on their definition, sharing is not selling.
THE MOVE Flip the do-not-sell switch where one exists. The written objection on top of it goes on your record.
“service providers, partners, and affiliates”
How data leaves the building with no name attached. Recipients are listed by what they do, never who they are. You cannot send a request to a company you cannot name, which is the point.
THE MOVE An access request can ask for the recipients by name, not just the categories. UK and EU law put that choice with you. The reply, or the silence, goes on your record.
“aggregated or de-identified information”
Stripping the name does not strip the pattern, and the pattern often still points at you. Policies grant themselves free, indefinite use of this data because in their telling it is no longer about you.
THE MOVE If a deletion comes back as 'anonymised', keep the reply. It is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for: legal duties, tax rules, fraud prevention, possible lawsuits, their own business reasons. None of them carries a firm end date. Deletion becomes a negotiation, not an event.
THE MOVE Which reasons apply to you, and how long each runs, is a request of its own. Their reply goes on your record.
“you grant us a licence to use your content”
A contract term, not a data setting, so a privacy request cannot undo it. The careful version ends with your account. The broad version can be passed on, never expires, and survives deletion.
THE MOVE Whether the licence ends with the account is written in their terms, not yours. Closing the account goes on your record.
“your administrator may access, retain, monitor, disclose or remove information in your account”
On an account provided through work or school, someone in that organisation can open what is in it, keep a copy, hand it to a third party, or delete it, without asking you. The vendor treats this as the customer exercising their own rights over their own data.
THE MOVE The request goes to the organisation that bought the account, not to the vendor. What the vendor holds separately is still worth asking for, and both replies go on your record.
“you retain ownership of your content”
Ownership and permission are different things. The same paragraph grants a broad licence to host, copy, transmit, scan and adapt what you upload, because a service cannot run without one. Ownership is the reassuring half; the licence is the operative half.
THE MOVE What the licence covers beyond running the service is theirs to state. Their reply goes on your record.
“deleted content is removed from our active systems immediately and from backups within a set period”
A real limit and a real delay. The copy you can see goes at once; the copies in backups and replicas persist until the rotation reaches them. It is the one number this trade does put in writing, and it is the honest reason deletion is never instant.
THE MOVE A deletion request can ask when the backup copies actually clear. The date they give is the one to keep.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply. Start your record →