It's client side! Not on by default, you yourself are responsible

Yep. That is the line that matters. If oblak can decrypt, paying in bitcoin mostly hides the billing trail, not the files. Client-side keys are what turn “please don’t look” into actual privacy.