Comment by jasonsync | Hacker News Reader

Comment by jasonsync | Hacker News Reader

Parent Full thread

Easy for a community manager to say, but she didn't agree to the blanket terms of service. You did.

The binding TOS explicitly states they may analyze your content, and the analysis occurs as the content is sent, received, AND when it is stored.

If what the community manager says is true, it would be awesome if Google actually updated the TOS to clarify that file AND file meta data in Google Drive are exempt. I mean I love my Chromebook, and it came with 100 GB of Google Drive free. But I have no idea how much access Google has to the files, so I can only assume the TOS is accurate.

==

There's many choice quotes from Google employees that contradict, skirt around or gloss over these issues:

Are files stored on Google Drive Encrypted?

You'll note the first response doesn't answer the question. Then finally a contradicting response:

That's a valid question. Google Drive does NOT currently encrypt files on the server. Our team and our company take the security and privacy of our users very seriously.

https://productforums.google.com/d/msg/drive/6AdrOutSoFU/sgi...

==

Here's a funny conversation regarding web search history being on by default across all your devices:

I can't believe that this option is enabled by default! Clearly it should be DISabled by default if Google cares at all about their users' security and privacy. It's one thing that Google collects anonymous data about what people search for and do online, but to collect a database of detailed personally identifiable information on an opt-out instead of an opt-in basis?

The product manager isn't quite sure either:

I'm a PM at Google working on Personalized Search / Web History ... We've found that it is difficult to articulate the usefulness of having Web History turned on without trying it out for yourself.

https://productforums.google.com/forum/#!msg/websearch/12cW5...

==

My concern here is that you're making really quite a strong statement about what google do with your files on google drive, and the only information I can find is a very generic TOS and a statement on googles forum that they don't use your files like this.

Have you tried contacting google to get confirmation?

I hear you. Perhaps I'm overly paranoid. I don't think so though!

Many people (eg. http://www.inc.com/larry-kim/5-online-privacy-tips-from-edwa...) have asked Google to clarify their policy in this regard, but the "generic" TOS you agreed to is the best they could come up with. The trouble with using soft language is that anything goes.

Data monetization goes way beyond serving relevant ads.

While companies like Sync.com encrypt your data end-to-end (making this a non-issue - shameless plug I know - you should check us out though), if you do continue to use Google Drive you may want to investigate third-party Google Drive encryption software such as https://www.boxcryptor.com/en (I hate to recommend a competitor, but it's better than nothing).

I'm making a strong statement, because I value my privacy.

> I hear you. Perhaps I'm overly paranoid. I don't think so though!

I think perhaps there's a misunderstanding here. I'm less concerned with your point of "google might be reading my files", that's a perfectly valid concern. That's different to making the statement "google are monetising your files, so pay for my service instead".

> I'm making a strong statement, because I value my privacy.

You are making a strong statement about a competitor that I'm not sure you can back up. That is not the same as valuing your own privacy. Not using google drive because you aren't sure what they're doing is fine.

I wasn't trying to imply that paying for Google drive would eliminate the data monetization model. In fact, the terms of service appear to be identical for free or paid if you're using Google Drive for personal use, so perhaps that's where the disconnect is.

However, it's interesting to note that Google mentions that they are willing to negotiate the terms of service for businesses using the paid Apps service: note that additional terms may apply for negotiated Google Apps agreements.

https://support.google.com/drive/answer/2450387?hl=en

In the case of HIPAA compliance for healthcare, or data privacy compliance requirements for industries that store files with personally identifiable information (PII) in the cloud, I wonder if Google would amend the TOS to include server-side encryption, or other safeguards, which would mitigate the issue.

This is something I will investigate further, as I'm not sure what the answer is.

Regardless of what a Google Product Manager states (marketing rhetoric or current policy), Google's legally binding terms of service are the only terms that matter at the end of the day:

Our automated systems analyze your content (including emails) to provide you personally relevant product features, such as customized search results, tailored advertising, and spam and malware detection. This analysis occurs as the content is sent, received, and when it is stored.

It would be great if Google updated their terms to be clearer. In the mean time I'll take their word on it.

Reply on news.ycombinator.com