The privacy marketing vs. the privacy reality

Apple's privacyprivacy marketing is some of the most effective in tech. "What happens on your iPhone stays on your iPhone." "Apple does not sell your data." These claims are technically true and carefully worded — but they obscure a more complex reality about iCloud specifically.

iCloud data is encryptedencrypted on Apple's servers. That is real encryption. But Apple's standard iCloud encryption is not zero-knowledge encryption. Apple holds the encryption keys, which means Apple has the technical capability to access your iCloud data. Their policies, legal obligations, and stated commitments prevent them from doing so casually — but the architectural access exists.

What Apple can access by default

With standard iCloud settings, Apple can technically access the following data categories:

• iCloud Photos: Encrypted on Apple's servers but Apple holds the keys
• iCloud Backup: Full device backup including app data, settings, and photos
• iCloud Drive: File storage and sharing with Apple-managed keys
• iCloud Mail: Email content stored with Apple-managed encryption
• Notes, Contacts, Calendars: Sync services with Apple-managed encryption
• Safari browsing data: Synced across devices with Apple-managed keys

This is the standard provider-controlled encryption model used by most major cloud providers. It protectsprotects your data from external breaches but not from the provider itself.

iCloud+ Advanced Data Protection: the real privacy option

Apple introduced Advanced Data Protection for iCloud in late 2022. When enabled, it adds end-to-end encryption to 25 iCloud data categories — meaning only you hold the decryption keys. Apple cannot access this data under any circumstances.

Protected categories with Advanced Data Protection:

• iCloud Photos, iCloud Backup, iCloud Drive
• Notes, Contacts, Calendars, Reminders
• Safari bookmarks and reading list
• Voice memos, health data (with some exceptions)
• Wallet passes

Categories still NOT protected by Advanced Data Protection (Apple holds keys):

• iCloud Mail, Contacts, Calendar (requires interoperability)
• Shared calendars, shared photo libraries
• Some enterprise and education accounts

How iCloud privacy compares to fii.one

fii.one uses zero-knowledge encryption by default for all stored data — not as an optional add-on. There is no Advanced Data Protection tier to enable. There is no choicechoice between convenience and privacy. Privacy is the architecture.

• iCloud default: Apple holds encryption keys. Apple can access your data.
• iCloud+ Advanced: You hold keys for most categories. Apple cannot access most data. Some categories remain Apple-accessible.
• fii.one default: Zero-knowledge encryption for all data. No exceptions. No add-on required.

When iCloud privacy is sufficient

• You trust Apple not to access your data and are comfortable with their legal commitments
• You do not have specific threat models that require zero-knowledge from your storage provider
• You are comfortable enabling Advanced Data Protection and managing your own recovery key
• Your primary concern is protection from external breaches, not provider access

When to look for stronger privacy

• You have specific privacy requirements that require zero-knowledge from all providers
• You are in a jurisdiction where government access to Apple data is a realistic concern
• You want privacy without the complexity of managing Advanced Data Protection settings
• You want zero-knowledge encryption as the default, not as an optional tier

Compare: fii.one vs iCloud.

Frequently asked questions