That's kind of the point of log files. As a contrived example, what if users suddenly couldn't upload files that ended in .jpeg instead of .jpg. How would they be able to diagnose the problem if they didn't store data about image filenames?

Obviously they filter passwords and other sensitive data, but I think they should rightly have access to whatever they judge necessary to do their job.

There will always be people who have the ability to access data they are not supposed to, but in the end it comes down to who you will trust with your data.

To me, the transparency and contributions of 37signals qualifies them to have that trust. With that, I trust them to make good decisions about who they hire and what they store in their log files.