Reference
Common questions
Direct answers to the questions people actually ask about Dropbox — sourced from Dropbox's own help documentation and this archive's documented record.
What can the Dropbox Dash Chrome extension see?
Quite a lot, by design. Dropbox's own help documentation says the Dash browser extension requires the broad permission to "read and change all your data on all websites," plus a separate permission to read your browsing history — and Dash's privacy documentation says it imports up to 90 days of that history to power its AI search.
Read the full answer →Are Dropbox links safe?
A real dropbox.com share link is a legitimate file host, not a scam by itself. But that legitimacy is exactly what phishers exploit: this archive documents years of criminals hosting credential-harvesting pages on Dropbox's own domain, and building convincing fake Dropbox login pages, so the link — or the email carrying it — looks completely genuine.
Read the full answer →How long does Dropbox keep deleted files and activity logs?
It depends entirely on your plan. Dropbox's own help documentation gives three tiers — 30, 180, or 365 days of file-recovery window depending on your plan — after which deleted files are marked for permanent deletion and can't be recovered. Dropbox's help center doesn't state a retention period for how long personal or team activity-log entries themselves are kept.
Read the full answer →Is Dropbox FedRAMP or CMMC compliant?
There is no evidence that it is, as of 6 September 2026. An independent compliance tracker found no Dropbox listing in the FedRAMP Marketplace in August 2026, and Dropbox's own compliance page lists SOC 2 Type II, ISO 27001, HIPAA business-associate agreements, GDPR, and PCI DSS — with no mention of FedRAMP or CMMC anywhere on that page.
Read the full answer →Was Dropbox hacked in 2026?
Yes. Between 4 and 21 August 2026, an attacker used a flaw in Lenovo's own email-verification process — not a flaw in Dropbox's password system — to register a Lenovo ID on a victim's email address, and Dropbox's 'Continue with Lenovo' sign-in link then trusted that identity without asking for a Dropbox password, reaching roughly 5,000 linked Dropbox accounts.
Read the full answer →Does Dropbox give refunds?
In most cases, no: Dropbox's own help documentation says payments for Dropbox and Dropbox Dash subscriptions aren't refundable. The one carved-out exception is a statutory 14-day right for EU, UK, and Turkey residents on Dropbox Plus, Family, Professional, or Essentials, counted from signing up, upgrading, or renewing. Outside that window, cancelling stops the next charge — it does not refund the one Dropbox already took.
Read the full answer →Why was my Dropbox account disabled?
Disabling an account cuts off all access immediately: Dropbox's own help documentation says "[w]hen an account is disabled, all access to the account and content on Dropbox is terminated," and lists the grounds as things like malware, phishing, spam, child sexual abuse material, and extreme violence or terrorism content. The core problem this archive documents is the appeal route: Dropbox's entire published recourse is a web form, with no stated response timeline and no guarantee a human reviews the request before or after your files become unreachable.
Read the full answer →Does Dropbox delete inactive accounts?
Yes, for free accounts. Dropbox's own help center says it "may close and delete inactive Dropbox Basic accounts" once there's been no log-in and no file activity for 12 months, and defines activity narrowly as "log-ins and file activity (adding, editing, or deleting)" on Dropbox itself — activity on separate products like Dropbox Sign or DocSend doesn't count. And Dropbox states this is final: "Dropbox doesn't reopen accounts that were closed because of inactivity."
Read the full answer →Why did my Dropbox files disappear?
There's no single answer: Dropbox's own help documentation lists several distinct causes, from an ordinary delete or a failed sync to Selective Sync removing local copies while leaving the cloud copy intact. The asymmetry worth knowing is that Dropbox can also delete files for its own reasons — an over-quota account or 12 months of inactivity — and whichever way it happened, the recovery window is finite and depends on your plan, not indefinite.
Read the full answer →Does Dropbox protect against ransomware?
Not in the sense of stopping an infection. Dropbox's own recovery documentation treats ransomware as something that already happened to your files, not something it screens out: when malware encrypts files on a synced device, the encrypted versions sync to Dropbox and to every other linked device like any other change. What Dropbox offers instead is recovery — version history for individual files, and Dropbox Rewind to roll back an entire account or folder at once — but Rewind is 'only available to customers on paid Dropbox plans,' so free Dropbox Basic users get the shortest recovery window and no Rewind at all.
Read the full answer →Is Dropbox HIPAA compliant?
There is no official HIPAA/HITECH certification, and Dropbox says so directly on its own help pages: "There is no official HIPAA/HITECH certification." What Dropbox offers instead is a business associate agreement (BAA), and only on its Standard, Advanced, Enterprise, and Education plans — Basic, Plus, and Family aren't in that list. Even with a BAA signed, Dropbox's own documentation puts the rest of the compliance work — sharing settings, deletion policy, access monitoring, and vetting any third-party app — on the customer.
Read the full answer →Is that HelloSign or Dropbox Sign email a scam?
It could be any of three things: a genuine notice from someone who really does need your signature, an outright spoof built to look like HelloSign, or — the case that beats the usual checks — a real email sent from HelloSign's own servers on behalf of a stranger who simply opened a HelloSign account. Dropbox's own domain list verifies app.hellosign.com specifically, not the bare hellosign.com domain, and security researchers have documented attackers using genuine HelloSign accounts to pass SPF, DKIM, and DMARC while running an HR/payroll signing lure. The 2024 Dropbox Sign breach is part of why some of these lures land convincingly at all: it exposed customer and counterparty email addresses tied to real signature activity.
Read the full answer →Does Dropbox use my files to train AI?
Dropbox's own AI Principles page says no in as many words: "We will not build generative AI models using customer content without consent." The catch, as this archive's own review of Dropbox's AI-data assurances has found, is that this is a policy promise rather than a technical impossibility — Dropbox holds the encryption keys to standard accounts and can read file content server-side — and that AI features Dropbox does turn on, like the 2023 "third-party AI" setting, do send file content to an outside company (Dropbox named OpenAI) whenever a user actually invokes them.
Read the full answer →Does Dropbox have a support phone number?
It depends entirely on what you pay. Dropbox's own support-options table shows phone support unavailable on Basic, on Plus, Professional, and Essentials, and on Family — it's only switched on for Standard, Advanced, Business, Business Plus, and Enterprise (or via a paid add-on), and even then Dropbox routes email and live chat through an AI assistant first. A free Basic user gets no phone, no live chat, and no email support at all.
Read the full answer →Does Dropbox scan my files?
Yes. Dropbox's own Terms of Service say so in one sentence: "To provide these and other features, Dropbox accesses, stores, and scans Your Stuff." The Terms attach that sentence to features such as search, previews and OCR, and do not say what the scanning looks for. For child sexual abuse material (CSAM), Dropbox's safety page describes hash-matching plus a classifier, and its transparency page counts 14,810 reports to NCMEC in the second half of 2025. For viruses and malware, and for copyright, the pages this archive captured do not describe a file-scanning programme: the words "malware" and "virus" do not appear in the Terms, and the DMCA policy describes acting on claims that are reported to Dropbox.
Read the full answer →These answers are informational, not legal or security advice. Dropbox Watchdog is independent and not affiliated with Dropbox, Inc.