Content creation has a storage problem that most creators discover the hard way. The raw files behind a finished YouTube video, a photography client shoot, a podcast recording session, or a design portfolio are not public content — they are working assets that contain far more information than the published versions, and they need to go somewhere while you are working.
Most creators default to the same platforms they use for everything else: Google Drive, Dropbox, iCloud, or Amazon Photos. These are familiar, convenient, and optimized for the feature set that matters to consumers. They are not optimized for the privacy profile of professional creative work, and the gap between what creators assume these services do and what they actually do with uploaded content is wider than most expect.
What Creative Files Actually Contain
The privacy risk with creative assets is not just the content itself — it is the metadata and context layered into every file.
RAW photo files and unedited video footage. A RAW image file from a professional camera contains full EXIF metadata: the exact GPS coordinates where the photo was taken, the precise timestamp, the camera model, lens, shutter speed, and aperture. For a photographer shooting at a client’s home, a confidential business location, or a sensitive editorial location, that metadata is an exact record of where you were and when. The client who appears in that unedited shoot appears with their face fully identifiable, in a context they may not have approved for storage on a third-party cloud service.
Drafts, cut footage, and deleted takes. The finished product is what the creator controls. The working files include everything that did not make the cut: outtakes with candid moments, draft scripts with notes about editorial decisions, footage of locations or people who were ultimately cut from the final edit. These are often stored in the same cloud locations as finished assets, without any differentiation in who can access them.
Contract documents and client communications. Creators who store their project folders in cloud drives often include the full project context: client briefs, contracts, rates, and email chains. A drive search that returns “project assets” often also returns the contract specifying the terms.
Location intelligence from geotagged files. A full library of geotagged photos from a travel photographer, a food blogger, or a real estate photographer maps that creator’s professional movement in significant detail. Over months or years, that location data describes working relationships, client locations, and geographic patterns that the creator almost certainly did not intend to share with a cloud provider.
How Major Platforms Handle Creative Uploads
Google Drive and Google Photos
Google’s terms give it broad rights to analyze, process, and use content uploaded to its services. The specific application of these rights to professional creative work — particularly content involving other people, shot at client locations — is not always addressed with specificity in the terms, which are written at a level of generality that covers many different use cases.
Google Photos actively runs AI analysis on every photo and video uploaded. This includes face recognition (building identifiers for every person who appears in your library), scene and location recognition, and content classification. The AI-derived data becomes part of Google’s understanding of the contents of your library, linked to your Google account and — through Google’s identity systems — to everything else Google knows about you.
For a photographer whose library includes hundreds of clients’ faces, confidential location shoots, and unpublished work, this analysis is occurring without explicit consent from anyone depicted in the images.
Google Drive handles documents with similar analysis for features like Smart Search, suggested files, and integration with Google Workspace AI features. The line between “analysis to improve your experience” and “analysis that uses your content to improve Google’s systems” is less clear than Google’s top-level marketing language suggests.
Dropbox
Dropbox announced in 2023 that it would enable new AI features that could analyze the content of stored files to improve Dropbox’s AI products. Users raised significant objections; Dropbox subsequently clarified that users needed to opt in to allow their content to be used for AI training, while using AI on their content to power features is described differently. Reading the current terms carefully, rather than relying on summary statements, is the appropriate approach.
Dropbox also operates a content scanning system for illegal content detection, which means uploaded content is subject to analysis beyond just indexing for search.
iCloud Drive and Photos
Apple processes photos uploaded to iCloud through its own photo analysis systems, though its stated model is that much of the analysis for features like People and Scene recognition happens on-device rather than server-side. The resulting metadata — the face groupings, labels, and album structures generated by that analysis — is synced through iCloud, meaning Apple’s servers receive and store the derived data even where the raw analysis was local.
For content creators using iCloud, the key question is whether Advanced Data Protection is enabled. Standard iCloud encryption means Apple holds decryption keys and can access file contents. ADP extends end-to-end encryption to iCloud Drive and Photos, preventing Apple from reading those files — a meaningful difference for creators concerned about confidential client work.
The AI Training Problem for Creators
The intersection of cloud storage and AI training is particularly relevant for creative professionals. Content creators produce original work — photographs, video, audio, written material — that has been a primary target for AI training data collection.
Several major platforms have updated their terms in recent years to include provisions that could allow uploaded content to be used for AI training, often buried in lengthy terms or quietly added through updates. For a creator who stores their portfolio, client work, or unpublished drafts in a cloud service, those terms govern what the provider can do with that work.
The specific concern is not hypothetical. Text-to-image models have been trained on photography datasets assembled from cloud-hosted sources. Audio generation models have been trained on podcast recordings and voice memos. Style-transfer models have been trained on photography portfolios. Whether specific platforms have specifically trained on creator content stored in personal cloud accounts varies by service and has been the subject of ongoing litigation — but the commercial incentive to do so exists.
A cloud storage service that explicitly does not use stored content for AI training represents a genuinely different risk profile for this specific concern.
What Creators’ Clients Need to Know
If you are a photographer, videographer, or any creator who works with other people, the people depicted in your files have privacy interests in where those files are stored. A portrait client who signed a contract for their images to be delivered to them has a reasonable expectation that those images are not also being stored in a cloud service where AI systems are building face embeddings from their likeness.
This is not a purely theoretical concern. Several countries’ biometric privacy frameworks — Illinois BIPA in the US, GDPR in Europe — impose restrictions on who can collect biometric data and under what circumstances. Uploading a client’s portrait to a cloud service that runs facial recognition on its stored images may constitute collection of that client’s biometric data without the consent of that client.
Whether the creator or the platform bears legal responsibility for this is a question that has not been comprehensively resolved. The practical answer is that creators who work with other people’s faces and locations should care about where those files go, not just for their own privacy but for their subjects’.
Copyright and Unpublished Work
The privacy framing of cloud storage is often discussed in terms of personal data. For creators, there is a parallel concern about intellectual property. Unpublished work stored in a cloud service is protected by copyright from the moment it is created, but copyright protection does not prevent a cloud service from using content in ways its terms permit.
Draft material — unfinished writing, unreleased footage, speculative projects — has particular value precisely because it has not been published. A creator’s working files represent the creative process as well as the outputs. Storing that material in a service that can analyze it, index it, and potentially use it for AI development introduces risk that does not apply to finished, published work.
The practical implication for creators: working files, especially unreleased material, should live in storage with the smallest possible footprint. The fewer entities that can access and analyze your drafts, the better your control over what does and does not become part of your published record.
What Secure Creative Storage Actually Requires
No Content Analysis
A storage service that stores your files without running them through recognition pipelines, AI training systems, or content indexing is fundamentally different from a service that does. The distinction determines whether uploading a RAW file with your client’s face means submitting that face to a facial recognition system.
Reasonable Encryption
At minimum, encryption at rest (meaning files are not readable by anyone who gains access to the storage layer without the encryption key) and in transit (TLS for all file transfers). Better is a service that explicitly does not hold keys that would allow it or governments to access decrypted content.
Clear Terms on AI Training
The storage service’s terms should state clearly whether it can use your content for AI training. Ambiguous language — “to improve our services” or “to develop new features” — without specificity about whether that includes AI model training is a yellow flag. Explicit language excluding your content from AI training is what you are looking for.
Reasonable Data Sharing Policies
A service that does not sell data and does not share content with advertising networks removes a category of commercial exposure for both your work and your clients’ information.
Organizing Your Creative Workflow Around Privacy
Separate personal and professional storage. Your personal photos do not belong in the same cloud account as client files. Mixing them creates confusion about access controls, retention, and what is subject to what terms.
Strip metadata before cloud upload where possible. EXIF removal tools can strip GPS, timestamp, and device metadata from files before they leave your machine. For finished deliverable files, stripping metadata is straightforward. For working files where you need that information for your own records, store metadata-stripped versions in the cloud and keep the originals local or in encrypted local storage.
Keep client deliverables separate from working files. The finished, delivered version of a project has different storage requirements than the raw shoot. Finished files can often be stored in standard cloud with appropriate sharing controls. Working files with full metadata and outtakes are better suited to encrypted, content-neutral storage.
Delete promptly. Working files have a shelf life. After a project is delivered and any revision window has closed, there is little reason to maintain cloud copies of raw footage and outtakes. Deletion that is genuinely permanent — not just moved to trash with a long retention window — reduces the long-term surface area of stored sensitive content.
daftei does not run content analysis on uploaded files, does not train third-party AI on user content, does not sell data, and does not show ads. Files are encrypted in transit with TLS 1.3 and at rest with AES-256. For creators who want cloud access to working files without feeding those files into AI systems, these properties describe the relevant baseline.
The Asymmetry of Creative Work
Finished content that creators publish carries the privacy costs and benefits they choose. The working files behind that content carry all the same metadata and sensitive information as the finished work, plus everything that did not make the final cut, in storage arrangements the creator often chose for convenience rather than privacy.
The gap between what major consumer cloud platforms do with uploaded content and what creators assume they do is worth closing — not because the risks are inevitable, but because understanding them allows for deliberate choices about what goes where.
Creative work is inherently collaborative, often involves other people, and represents both intellectual property and personal expression. The storage layer for that work is worth choosing with the same care as any other professional tool.