For all their policies, they're still subject to Australia's "NSL" equivalent that requires they disclose data to law enforcement without notifying you, and in the case of certain agencies, without a warrant.

Their servers are also located in the US, so they're accessible to three-letter agencies as well.

I recently switched to a German service. Data can still be silently disclosed but only if there's imminent danger or a judge issues a warrant. Of course the service is covered by GDPR and European regulators as well.