Dropbox: Secure Cloud Storage

"Dropbox uses certain trusted third parties (for example, providers of customer support and IT services) for the business purposes of helping us provide, improve, protect, and promote our Services. These third parties will access your information to perform tasks on our behalf. Dropbox shares infrastructure, systems, and technology with other Dropbox Companies to provide, improve, protect, and promote Dropbox Company Services. We process your information across the Dropbox Companies for these purposes."

Dropbox shares user data with an unspecified number of 'trusted third parties' and across multiple Dropbox Companies, with details deferred to an FAQ rather than disclosed directly in the policy.

"We also collect information from and about the devices you use to access the Services. This includes things like IP addresses, the type of browser and device you use, the web page you visited before coming to our sites, and identifiers associated with your devices. We use technologies like cookies and pixel tags to provide, improve, protect, and promote our Services. We may also use third-party service providers that set cookies and similar technologies to promote Dropbox services."

Dropbox collects device identifiers, tracks the web pages you visited before arriving, and uses third-party cookies and pixel tags, enabling cross-device and cross-site tracking.

"Your devices (depending on their settings) may also transmit location information to the Services. For example, we use device information to detect abuse and identify and troubleshoot bugs."

Dropbox collects location information from user devices, with the justification of abuse detection and bug troubleshooting rather than core file-storage functionality.

"If you delete your account, we'll initiate deletion of this information after 30 days. But please note: (1) there might be some latency in deleting this information from our servers and back-up storage; and (2) we may retain this information if necessary to comply with our legal obligations, resolve disputes, or enforce our agreements."

Deletion only begins 30 days after account closure, with additional unspecified latency, and Dropbox reserves the right to retain data indefinitely for legal reasons, disputes, or agreement enforcement.

"We may revise this Privacy Policy from time to time, and will post the most current version on our website. If a revision meaningfully reduces your rights, we will notify you."

Dropbox can change the privacy policy at any time and only commits to notifying users when changes 'meaningfully reduce' rights — a subjective threshold determined solely by Dropbox.

"You may choose to give us access to your contacts to make it easy for you, and your Dropbox Team if you're a Dropbox Team user, to do things like share and collaborate on Your Stuff, send messages, and invite others to use the Services. If you do, we'll store those contacts on our servers."

Dropbox requests access to your device contacts and stores them on its servers, which goes beyond core file storage functionality even though it is framed as optional.