We're either having drastically different definitions of metadata here or you're just trying to fight (that is more likely). The metadata I meant is collected by the first party (the server) and includes but is not limited to IP, interaction timestamps (the most important thing), file type, user agent (approximate browser name). Also since the data on the server isn't required to be encrypted, all account information (that can contain emails and 2FA keys) is unsafe too. At this point my suspicion of you not keeping the discussion civil is too high to continue it so I'm glad you chose to stop it yourself. I hope I could explain my point clearly and prove my innocence in this situation.