The default stance should be that nothing you do is private on the internet. If we're talking spying then no service in any country will be secure unless fully encrypted with audits. Any country with an intelligence agency can force companies in their jurisdiction to give them access to data otherwise.