Encryption can protect the actual content of a service while still leaving technical traces visible. That is not a contradiction. Content and metadata are separate layers. A realistic privacy assessment should examine both.
What counts as content
Content is typically the information you actually want to protect: note text, document contents, files, messages, or other user data. With client-side encryption, that content can be made unreadable on your device before transfer.
What metadata is
Metadata describes data or events. Depending on the system, it can include:
- account identifiers
- device identifiers
- modification times
- file sizes
- object types
- synchronization state
- IP-related connection information
- billing or account data
Why a server may need some metadata
A synchronization service may need to know that an object changed or which device uploaded a new state. Technical information can therefore be necessary even when the actual content remains encrypted.
Encrypted filenames are a separate question
A service may encrypt file contents while storing filenames in readable form. Another may encrypt both. A statement such as “your files are encrypted” does not tell you which metadata is protected.
Timestamps can reveal information too
Even without readable content, a service may know when a file was changed or synchronized. Depending on the context, that can still be sensitive, even if it reveals much less than the content itself.
Zero access does not automatically mean zero metadata
A provider can be unable to read encrypted content while still processing technical metadata. Zero-access or end-to-end claims should therefore state clearly what they cover.
What to check
- Which content is encrypted?
- Which metadata remains visible?
- Which information is technically required for sync or operation?
- What is logged and for how long?
- Which fields are optional and which are necessary?
Priviot and transparency
Priviot separates encrypted content from technically necessary metadata and documents data paths by feature. The current details are available under Security & Transparency.
Conclusion
Encrypted content can be strongly protected while certain metadata remains technically visible. A useful privacy assessment therefore asks not only “Is it encrypted?” but also “What information remains outside the encryption?”