About
About & Methodology
Dropbox Watchdog is an independent, non-affiliated research project documenting the company's failures for the public record. Here is how we work.
Sourcing standards
Every entry in this archive is sourced. We prioritize primary sources in roughly this order: court documents and regulatory filings; Dropbox's own official statements, security disclosures, blog posts, and SEC filings; contemporaneous reporting from established news and security outlets; and reputable technical or academic research. Where a claim cannot be supported by such a source, we either omit it or clearly mark it as unverified.
Each source is labeled by type (news, official/Dropbox, court, academic, or other) so readers can weigh it appropriately. We link directly to sources wherever possible and welcome corrections when a link breaks or a better source exists.
Tone policy: critical, but accountable to the facts
Our stance is critical. Dropbox asks users to trust it with their most important files, and this archive exists to hold that trust to account — so we document breaches, broken promises, and growth-over-users decisions plainly and without euphemism. But a criticism is only useful if it is true, so we also include Dropbox's responses, official positions, and relevant context wherever they exist.
We avoid invented claims, present competing accounts where the facts are disputed, and distinguish clearly between what is documented and what is alleged. When an issue is ongoing or unresolved, we flag it as such rather than implying a settled conclusion.
Security incidents & legal claims
Many entries concern security breaches and litigation. We treat these with particular care. For breaches we describe what was actually compromised according to the disclosure, avoid inflating figures, and note when scope was disputed or revised. For legal matters we distinguish allegations, settlements, dismissals, and judgments, and label an unproven claim as unproven.
Where Dropbox disputes a characterization or has issued a correction, we record that alongside the original reporting so readers can judge for themselves.
How this project is maintained
Dropbox Watchdog is maintained as a structured database. Entries are added and updated over time, drawing on public reporting and documents. The public can submit new issues or corrections, which are reviewed before publication.
This is a living archive: the ongoing-issues category in particular covers situations that are still developing, and those entries are updated as events unfold.
Frequently asked questions
Is Dropbox Watchdog affiliated with Dropbox?
No. Dropbox Watchdog is an independent research project. It is not affiliated with, endorsed by, or associated with Dropbox, Inc. "Dropbox" is a trademark of Dropbox, Inc., used here only for identification and commentary.
How are the issues sourced and verified?
Every entry is backed by primary sources where possible — court filings, regulatory documents, Dropbox's own statements, blog posts and SEC filings, and contemporaneous reporting from established news and security outlets. Each source is labelled by type, and claims that cannot be supported are omitted or marked unverified.
How do you decide an issue's severity?
Severity (critical, high, medium, low) is an editorial judgment: critical for major breaches or data loss affecting millions or core trust; high for serious incidents with large user, legal, or financial impact; medium for real but bounded harm; low for minor UX or feature complaints.
Do you distinguish allegations from proven facts?
Yes. For legal matters we distinguish allegations, settlements, dismissals, and judgments, and label unproven claims as alleged. For breaches we describe what was actually disclosed and note where scope was disputed.
How do I report an error or submit a new issue?
Use the submission form at /submit. Submissions go into a review queue and are checked against sources before anything is published or corrected.