That being said, it's not a terrible idea for a certain customer base. I am disappointed at the apparent lack of first class security features though. That would be a differentiator. But I haven't looked hard... maybe they are below the fold. They talk about securing their platform but not about how I might secure my data.
Edit: why do none of the big cloud drive and sync providers offer basic symmetric local encryption of data? This is easier to implement by far than sync and I for one would pay for this.
I guess I can see this working in the corporate environment where the client machines will always be connected to the internet, and will really only be used for web browsing, word, excel, and ppt (a few 10s of gigs), but I'm very doubtful on its ability to penetrate the personal market. Personally I have absolutely no reason to spread my 100s of gigs of docs, music, and photos across yet another set of servers...and pay a yearly fee for the convenience of having a slightly thinner laptop and not having to plugin my time machine backup every week while opening myself up to trusting another third party service?
> Why do none of the big cloud providers offer local encryption?
- They want to police your files
- Free services typically monetize you through data mining your files (eg. Google Drive)
- It's difficult (not impossible) to build in usability features that might need to access, scan or manipulate your file data, when you don't have access to the file data server-side in the cloud (everything has to be pulled down locally first which adds overhead).
- Browser support for local HTML5 saveAs() etc. handling is still all over the map (Safari is almost a showstopper).
- Easy account recovery options are limited
The tech is getting better though, and there's certainly a number of good options in terms of cloud storage with local encryption built in, including Sync!
Do you have a source that Google drive is mining my files? Free vs paid vs business?
Our automated systems analyze your content (including emails) to provide you personally relevant product features, such as customized search results, tailored advertising, and spam and malware detection. This analysis occurs as the content is sent, received, and when it is stored.
> As with Google Docs previously, we do not target ads to you based on the content of your files. Our servers index the files you put into Drive in order to provide features like fast search, virus detection and optical character recognition.
The binding TOS explicitly states they may analyze your content, and the analysis occurs as the content is sent, received, AND when it is stored.
If what the community manager says is true, it would be awesome if Google actually updated the TOS to clarify that file AND file meta data in Google Drive are exempt. I mean I love my Chromebook, and it came with 100 GB of Google Drive free. But I have no idea how much access Google has to the files, so I can only assume the TOS is accurate.
==
There's many choice quotes from Google employees that contradict, skirt around or gloss over these issues:
Are files stored on Google Drive Encrypted?
You'll note the first response doesn't answer the question. Then finally a contradicting response:
That's a valid question. Google Drive does NOT currently encrypt files on the server. Our team and our company take the security and privacy of our users very seriously.
https://productforums.google.com/d/msg/drive/6AdrOutSoFU/sgi...
==
Here's a funny conversation regarding web search history being on by default across all your devices:
I can't believe that this option is enabled by default! Clearly it should be DISabled by default if Google cares at all about their users' security and privacy. It's one thing that Google collects anonymous data about what people search for and do online, but to collect a database of detailed personally identifiable information on an opt-out instead of an opt-in basis?
The product manager isn't quite sure either:
I'm a PM at Google working on Personalized Search / Web History ... We've found that it is difficult to articulate the usefulness of having Web History turned on without trying it out for yourself.
https://productforums.google.com/forum/#!msg/websearch/12cW5...
==
Have you tried contacting google to get confirmation?
Many people (eg. http://www.inc.com/larry-kim/5-online-privacy-tips-from-edwa...) have asked Google to clarify their policy in this regard, but the "generic" TOS you agreed to is the best they could come up with. The trouble with using soft language is that anything goes.
Data monetization goes way beyond serving relevant ads.
While companies like Sync.com encrypt your data end-to-end (making this a non-issue - shameless plug I know - you should check us out though), if you do continue to use Google Drive you may want to investigate third-party Google Drive encryption software such as https://www.boxcryptor.com/en (I hate to recommend a competitor, but it's better than nothing).
I'm making a strong statement, because I value my privacy.
I think perhaps there's a misunderstanding here. I'm less concerned with your point of "google might be reading my files", that's a perfectly valid concern. That's different to making the statement "google are monetising your files, so pay for my service instead".
> I'm making a strong statement, because I value my privacy.
You are making a strong statement about a competitor that I'm not sure you can back up. That is not the same as valuing your own privacy. Not using google drive because you aren't sure what they're doing is fine.
However, it's interesting to note that Google mentions that they are willing to negotiate the terms of service for businesses using the paid Apps service: note that additional terms may apply for negotiated Google Apps agreements.
https://support.google.com/drive/answer/2450387?hl=en
In the case of HIPAA compliance for healthcare, or data privacy compliance requirements for industries that store files with personally identifiable information (PII) in the cloud, I wonder if Google would amend the TOS to include server-side encryption, or other safeguards, which would mitigate the issue.
This is something I will investigate further, as I'm not sure what the answer is.
Regardless of what a Google Product Manager states (marketing rhetoric or current policy), Google's legally binding terms of service are the only terms that matter at the end of the day:
Our automated systems analyze your content (including emails) to provide you personally relevant product features, such as customized search results, tailored advertising, and spam and malware detection. This analysis occurs as the content is sent, received, and when it is stored.
It would be great if Google updated their terms to be clearer. In the mean time I'll take their word on it.
If you had a Linux client we would consider using this for a lot of things.