The Hidden Privacy Cost of WeTransfer, Dropbox, and Drive

If you've sent a file in the last year, statistically you used one of these three. They're free, they're familiar, and they work. They also each make trade-offs that aren't immediately obvious. Here's what their terms of service actually say, in plain English, and why it might matter for your work.

WeTransfer

WeTransfer's pitch is delightful simplicity — drop, email, done. Files expire after 7 days on the free plan. Under the hood, however, they reserve the right to scan content 'for service improvement and personalised advertising'. The ToS allows them to share usage data with advertising partners. Free users see promotional inserts during downloads.

Real-world impact: WeTransfer is fine for shareable creative work where neither sender nor receiver cares if the file is briefly seen by a CDN. It's a poor choice for anything containing personal data, NDAs, or unreleased commercial material.

Dropbox

Dropbox is storage-first; transfer is a side-effect. Their ToS grants them a 'worldwide, royalty-free licence' to use your content 'as necessary to operate the service' — which they interpret very broadly to include indexing for search, generating thumbnails, and (controversially) using anonymised metadata to improve their AI features. They've published a transparency report that they handed over user data to law enforcement 600+ times in 2024.

Real-world impact: Dropbox is fine for non-sensitive collaborative work. Watch out for the 'shared link' feature — by default links are public-readable, and Dropbox has historically been a major source of accidentally-public file leaks.

Google Drive

Drive is the most-used file-sharing tool in the world. Google's terms grant them a licence to host, store, reproduce, modify, create derivative works, communicate, publish, publicly perform, publicly display and distribute your content — though they clarify this is for the purpose of operating the service. Drive content is NOT used to train Gemini by default (Google added this explicitly in late 2024) but anonymised metadata is used to improve search and recommendations.

Real-world impact: Drive's biggest practical privacy issue isn't policy — it's user error. The 'anyone with the link' default has leaked thousands of internal company documents over the years. A 2024 study found 18,000+ internal Drive links indexed in public search engines, despite the users believing the links were private.

The smaller, less obvious tradeoffs

• →All three keep deleted files in soft-delete for 30 days. 'Deleted' is not 'gone'.
• →All three serve ads on file-preview pages to free users.
• →All three retain access logs for at least 12 months. Anyone with subpoena power can ask who downloaded what, when.
• →All three integrate with third-party apps (Mailchimp, Slack, ChatGPT plugins) that gain access to files when you enable them — often without re-confirming consent.

The principles a privacy-respecting tool follows

• →Hard expiry — files actually disappear, not 'soft-deleted'.
• →No content scanning for advertising or personalisation.
• →No content used to train AI models.
• →Minimal metadata retention with published deletion schedules.
• →Transparent law-enforcement response process with notification when legally permitted.

SendMe aims for all five. WeTransfer hits one. Dropbox hits two. Drive hits two (when you turn off Smart Compose explicitly). The differences are small individually but compound over years of usage.

What this means for you

If you're sending stock photography for a magazine spread, any of the three is fine. If you're a lawyer sending discovery documents, a doctor sending scans, an HR rep sending offer letters, or a journalist receiving leaked records — read the ToS of the tool you're using. The trade-offs are real, even when they're invisible.