pCloud is a Swiss cloud storage and file-sharing service operated by pCloud International AG (registered in the Canton of Zug commercial register, alongside affiliate pCloud AG), founded in 2013 with a self-reported 20-22M+ users. Its privacy policy describes broad, default clear-text collection and processing (account email, IP/device/browser data via first-party 'tracking services', payment-processor data, optional contact-list sync, optional third-party account linking) with EU/US region choice for where files are stored, and states personal data is never sold. Client-side ('zero-knowledge') encryption is not the default: it is a separate paid add-on, pCloud Encryption, marketed with a self-run $100,000 hacking-challenge claiming zero successful attacks. That marketing claim is directly contradicted by an independent, peer-reviewed ETH Zurich study (ACM CCS 2024) that found severe cryptographic vulnerabilities in pCloud's encryption design -- including attacks that let a malicious or compromised server inject files, tamper with file data and metadata, and in some cases gain direct access to plaintext -- placing pCloud among four of five studied E2EE providers found broken (only Tresorit was not). No breach, lawsuit or regulatory action was found in this research.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
9 ON FILE
[2023-03-01] · COLLECTION
pCloud's Privacy Policy (revised 2023-03-01) states it collects registration email, IP address, browser type/version, operating system, referral source and device information for every visitor including anonymous 'Guest Usage', plus payment-processor data (IP, country, email, postcode, name, last four card digits), and optionally contact/friend-list data and third-party account data when the user enables those features.
The Canton of Zug commercial register (accessed via the federal Zefix registry) lists pCloud International AG (UID CHE-404.425.843, registered office Baar, status existing) and a second active Swiss entity, pCloud AG (UID CHE-291.350.765, also Baar), confirming pCloud operates as a registered Swiss stock corporation (AG) rather than an unregistered or offshore shell.
An ETH Zurich Applied Cryptography Group study (ACM CCS 2024, 'End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem') analysed pCloud's client-side encryption under a malicious-server model and found attacks -- including Key Replacement and Key Overwriting -- that break confidentiality of files and file names uploaded after a server compromise, undermining pCloud's own 'not even us' zero-knowledge claim for its paid Crypto-folder add-on.
pCloud's Privacy Policy states it has never sold and has no future plans to sell personal information to third parties, while enumerating disclosure to payment providers, third-party functionality/analytics vendors, law enforcement under legal process, business acquirers in a merger, and advertising/analytics partners with the user's consent.
The ETH Zurich CCS 2024 study analysed five E2EE cloud-storage providers (Sync, pCloud, Icedrive, Seafile, Tresorit) under a malicious-server threat model and found severe cryptographic vulnerabilities in four of the five, including pCloud -- in some cases allowing a malicious server to inject files, tamper with file data, and gain direct access to plaintext -- while Tresorit was the one provider in which no severe vulnerability was found.
pCloud's App Store privacy-nutrition label (pCloud: Cloud Storage, id692002098) discloses data linked to the user's identity -- Contact Info (Email Address) and Identifiers (User ID, Device ID) -- used for 'Developer's Advertising or Marketing' and Analytics purposes (alongside Purchase History), and separately discloses Usage Data (Product Interaction) collected but not linked to identity, also used for Developer's Advertising or Marketing and Analytics.
pCloud's Privacy Policy states cookies are not used to collect Personal Information, while a separate section describes first-party 'tracking services' that collect visit length, page views, navigation paths, timing/frequency of use, operating system, device information and behavior for both registered users and guests.