pCloud

Is pCloud safe?

pCloud is safe for ordinary files and a good fit if you want your data in Europe without ad tracking. Its iPhone app declares nothing used to track you, the Swiss company says it never sells personal data, and we found no breaches or fines. The catch is encryption. pCloud only encrypts files so that it cannot read them if you pay extra for its Crypto folder, and university researchers showed in 2024 that the Crypto design had serious holes. We score pCloud 68/100, just above MEGA (67) and well below Proton Drive (88).

How pCloud's Crypto folder works, and where it fails

By default, pCloud protects files with TLS on the way to its servers, and pCloud can read them. pCloud Encryption, sold as a monthly, yearly or one-time lifetime add-on (EUR 150 for lifetime when we checked), adds a Crypto folder. Files you put there are encrypted on your device with 4096-bit RSA and 256-bit AES keys before upload. pCloud's terms say it cannot access your passphrase or decrypt the content.

For years pCloud's best-known proof was a hacking challenge: a $100,000 prize that, according to pCloud, 2,860 people tried to claim over 180 days without success. That tests one narrow scenario, an outsider attacking stored files.

Cryptographers look at a harder case, a server that turns against its users. In a paper for the ACM CCS conference in 2024, Jonas Hofmann and Kien Tuong Truong of ETH Zurich examined five encrypted storage services and found serious flaws in four, pCloud among them. According to the researchers, pCloud did not authenticate the keys it sends to the app, so a compromised server could swap in a folder key of its choosing and read the names of files uploaded afterwards. It could also swap file names, move files between folders, drop parts of a file and plant files that look like the user's own uploads. The researchers notified pCloud in April 2024; by 10 October 2024 it had not replied to repeated attempts to contact it. We did not find a public statement from pCloud about fixes.

None of these attacks has been reported against real users. They matter because the whole point of paying for Crypto is not having to trust pCloud's servers.

What pCloud does with your data

The App Store label has no "Data Used to Track You" section. Under data linked to you, pCloud lists purchase history, email address and user and device IDs used for "Developer's Advertising or Marketing", plus analytics and personalisation. Google Play adds that user IDs, app activity and crash logs are shared with other companies for analytics.

The privacy policy, revised on 20 October 2026, says pCloud has never sold personal information and does not share it with third parties for their own marketing. It also says that with your consent it may share data with "advertising and analytical companies" and use tracking on other websites. You can choose whether your files sit in the EU or the US, and the policy itself warns that US law may give you less protection. An optional Photos AI feature tags pictures and groups faces; it is off unless you turn it on and skips the Crypto folder.

When you delete your account, pCloud says your files and personal data are removed from its servers after 30 days, though some data may be kept longer for legal reasons.

Lifetime plans and the fine print

pCloud is known for lifetime plans: pay once and keep the storage. Its terms define lifetime as your lifetime or 99 years, whichever is shorter. They also say that if pCloud stops operating, accounts are closed without refunds. Free accounts that go 12 months without use are deleted along with their files. There is a 14-day money-back guarantee, but cancelling a subscription does not refund unused days, and discounted purchases may not qualify.

None of that is unusual, but it means a lifetime plan is a bet on one mid-sized company. Keep a second copy of anything you cannot afford to lose.

Who should be careful

The App Store rates pCloud 4+, while the terms say you must be at least 18. Parents should not assume the store rating means the service is meant for children.

Anyone who downloads from a stranger's pCloud link is trusting a file nobody has checked for them. pCloud can restrict or remove links that break its terms, but it does not promise to monitor them.

How to use pCloud safely

1. Turn on two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary.
2. Pick the EU data region when you sign up if you want EU law to apply to stored files.
3. Treat Crypto as protection against outsiders, not against a compromised pCloud server, until pCloud publishes fixes for the 2024 findings.
4. Write down your Crypto passphrase and keep it offline; pCloud cannot recover it.
5. Add a password and expiry date to links for anything private.

How we scored it

Regulatory record (86) is pCloud's strongest factor: we found no fines or orders, but no large regulator has reviewed it. Security (60) is the weakest, because end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary costs extra, the 2024 ETH Zurich paper found key replacement and file injection attacks, and there is no public bug bounty. Privacy (66) credits the absence of tracking and the EU storage option but counts identifiers used for pCloud's own marketing.