data report card

Data Report Card · Dropbox

Dropbox Data Report Card

Cloud storage · Dropbox, Inc.
Data
Practices
2Access2Portability2Friction2Deletion2Sells1Trains AI
=
A
11/12
Agent
Readiness
2Access 2Portability 2API access
=
A
6/6

Agent Readiness is a derived signal — a synthesis of two existing cells (Access, Portability) plus one sourced factor (API access), not an independently measured grade. API access scale: Best (2) consumer-grantable API · Moderate (1) partial / encumbered · Restrictive (0) manual export only. What is Agent Readiness?

Help me make a request →
Reviewed Jun 2026 · policies are checked weekly for changes  ·  stated — every cell is read from Dropbox's published policy; none has been tested (run by us) yet.
2Accessstated
Dropbox lets you submit a data access request from the Privacy tab in account settings and download a copy of your personal data, satisfying the access right.
Dropbox — Privacy Policy FAQ (access request) · accessed Jun 2026 ↗
2Portabilitystated
Dropbox provides your data in a machine-readable format through in-product export tools and a full OAuth REST API (JSON), and cites the EU Data Act export path, meeting the multi-format machine-readable bar for full portability.
Dropbox — EU Data Act Information / API export · accessed Jun 2026 ↗
2Frictionstated
Access, export, and deletion are all self-serve from the Privacy tab (no email required) and additionally scriptable via the API, placing friction at the low level.
Dropbox — Privacy Policy FAQ (Privacy tab) · accessed Jun 2026 ↗
2Deletionstated
You can delete your account and data self-serve; file deletion is initiated after 30 days, with limited legal-retention and backup-latency caveats, so deletion is scored at the full level.
Dropbox — Privacy Policy (deletion, 30-day) · accessed Jun 2026 ↗
2Sells / sharesstated
Dropbox states plainly "we won't sell your data or information to advertisers, third parties, or anyone else" and "we don't sell personal information," so selling is scored at the full level.
Dropbox — Privacy Policy ("we won't sell your data") · accessed Jun 2026 ↗
1Trains AIstated
Dropbox uses machine learning and may train models on your documents and metadata to power features like search and summaries, and shares content with third-party AI partners (e.g. OpenAI); both are opt-out rather than opt-in, though Dropbox pledges no generative-AI training without consent, so model-training use is scored at the partial level.
Dropbox — AI Principles / third-party AI opt-out · accessed Jun 2026 ↗
2API access — feeds Agent Readiness, not the /12stated
Dropbox offers a full OAuth 2.0 REST API a consumer can grant to an app, with short-lived access tokens plus long-lived refresh tokens (token_access_type=offline) and revocation from account settings, so agent access is scored at the full level.
Dropbox — OAuth Guide (refresh tokens) · accessed Jun 2026 ↗
Reviewed Jun 2026 from Dropbox's Privacy Policy, Privacy FAQ, and AI Principles / opt-out help pages. All cells are "stated", not tested. Dropbox scores strongly: self-serve access, machine-readable export plus a full OAuth API, self-serve deletion, and a plain "we won't sell your data" commitment. The single blemish is AI — Dropbox trains machine-learning models on documents and metadata for features like search and summaries and shares content with third-party AI partners (opt-out, not opt-in), which is scored at the partial level.

Events

Breaches, policy changes, and export-format changes we’ve recorded at Dropbox — other parties’ actions, alongside the enforcement record above. An event never changes a grade by itself. All events →

No events on record for Dropbox.

Grade history

Every change to this company’s grade since it was first published, and why. All grade changes →

No changes since this grade was first published in Jun 2026.

How to request your data from Dropbox

  1. Go to https://www.dropbox.com/privacy — Dropbox's data-request entry point.
  2. Account settings -> Privacy tab: data access / export / deletion request; full OAuth REST API; privacy@dropbox.com.
  3. Expected wait: self-serve Privacy tab for access / machine-readable export / deletion; file deletion initiated after 30 days; OAuth API export available — Dropbox's stated turnaround (we haven't independently timed a request yet).
  4. No self-serve option, or want a formal request? Contact Dropbox — Privacy tab (account settings): mailto:privacy@dropbox.com.

These steps reflect Dropbox's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.

Help me make a request →