Node-red-node-dropbox token expiration

I thought Microsoft's privacy policy guarantees they will not look at private repositories. If so then, if it were shown that they had been looking, there would be a big fuss and legal suits I think.