If it's not running locally you have no privacy, so what they say should be assumed in all cases that something is hosted unless it somehow operates across encr

If it's not running locally you have no privacy, so what they say should be assumed in all cases that something is hosted unless it somehow operates across encrypted data. The only exception might be if the agreement explicitly prohibits the provider from doing anything with your data or even viewing it without your permission, but that's rare.