TeraBox

Is TeraBox safe?

TeraBox is not a good place for anything private. Its 1 TB of free storage is real, but the app is built around advertising and engagement rather than privacy. Apple's privacy label lists usage data "used to track you", files are not end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, and the privacy policy allows TeraBox to build profiles of your habits and interests. It also runs a cash referral scheme that pays users to spread share links. We found no fines or breaches. We score TeraBox 48/100, far below MEGA (67) and Proton Drive (88), which also offer large free plans or real encryption.

What TeraBox collects

The App Store label is broad for a storage app. Under "Data Used to Track You" it lists usage data. Under data linked to you it lists email, name, phone number, photos and videos, a user ID, a device ID and product interaction. Advertising data and contacts appear as collected but not linked. The app is rated 9+ and lists advertising, contests and loot boxes.

Google Play tells a calmer story. Its data safety section says TeraBox shares no data with third parties. The privacy policy, effective 17 September 2026, goes further than either label. It lets TeraBox "aggregate, integrate, identify, analyze, portray" your personal information to form "label information" on your habits, interests "or credit", and to use it for automated decisions that send you personalised and marketing content. You can refuse this, but you have to find the switch or write to the company.

The policy does make some limits clear. It says ads are not personalised on the content of your files or on sensitive categories such as health or religion, and that your name and email are not given to advertisers. Uploads to its AI tools are not used for model training, and audio for transcription is sent to Google for processing.

Can TeraBox read your files?

Yes. TeraBox encrypts files on the way to its servers and on disk, but it describes no end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, so the keys stay with the company. Its policy describes "smart classification" that clusters your photos by people, scenes and places. It says face and scene detection runs on your device, but its AI assistant processes the files and prompts you give it, and audio you send for transcription goes to Google.

The company's own claims blur this. Its security page says "only you can view the storage contents", and its 2025 transparency report says TeraBox "is unable to view or assess the content stored on the platform" because files are encrypted. Encryption at rest with company-held keys does not stop the company from reading files, and its AI tools show that its servers do handle file contents when you ask them to.

We found no bug bounty on HackerOne, Bugcrowd or TeraBox's site and no published security audit. Flextech says it holds ISO 27001, 27701 and 27018 certificates, which cover management processes rather than encryption design. We found no reported breach.

Who owns TeraBox?

The terms name Flextech Inc. as the operator and give Tokyo as its location, and the policy says data may be stored and processed in Japan. Japan's corporate number register lists Flextech at an address in Roppongi, Tokyo, with a number issued in December 2020. The service launched as Dubox, and in April 2021 the Chinese tech site TechWeb reported that Dubox had been launched the year before by popIn, a Baidu subsidiary in Japan, and was known as the overseas edition of Baidu's cloud drive. Flextech does not publish its shareholders, and Japan's official company database, gBizINFO, lists no shareholders or capital for it. Apple and Google both name Flextech as the app's seller and developer, at the same Roppongi address. Baidu's annual reports to the US SEC for 2020, 2021, 2024 and 2025 do not mention TeraBox, Dubox or Flextech, and its list of principal subsidiaries does not include Flextech, so we could not confirm who owns TeraBox today and do not score it. The practical point is simpler: whoever owns TeraBox can technically access what you upload.

Share links and the referral scheme

This is where TeraBox differs most from other storage apps. Its referral programme pays up to US$1.20 for each new user who signs up through your shared links and up to US$2 for every 1,000 video plays. The sign-up page quotes a user with "more than 2 lakh subscribers on telegram" earning thousands of dollars. That creates an incentive to post eye-catching video links in large channels.

TeraBox's transparency report for April to June 2025 says it removed 309,674 links for prohibited content and closed 1,456 accounts. It names copyright infringement, child sexual abuse material and violent extremism as the main categories. That was the latest report on its site when we checked, more than a year later.

How to use TeraBox more safely

1. Do not upload ID documents, medical records, tax files or private photos.
2. Encrypt sensitive files yourself before uploading if you must use it.
3. Keep photos you do not want sorted by people and places out of automatic backup.
4. Refuse tracking when iOS asks, and do not install modified TeraBox APKs from outside the official stores.
5. Avoid opening TeraBox video links from Telegram channels or strangers.

How we scored it

Regulatory record (85) is TeraBox's best factor because we found no fines or orders, though no major regulator has looked at it. Scams and harmful content (35) is the worst, because the referral scheme pays people to push share links and the platform removes child abuse and extremist links in large numbers. Privacy (38) reflects declared tracking, interest profiling and the fact that the company can read your files.