Sounds pretty bad...
I am a user a pCloud, but fortunately I use it as a backend for Restic, so I send encrypted stuff there :-). I believe it is better anyway. I have been a happy user of Mega for years, and I like the end-to-end encryption, but the fact remains that I need to trust Mega entirely because the encryption/decryption is made on their website/app.
Similar to e.g. ProtonMail: they PGP-encrypt the email on the client side, but the client is a website that gets reloaded everytime. They could totally serve me a different client one day.
Of course I have to trust Restic (or whatever similar system, there are alternatives), but:
1. There is a separation between Restic and pCloud/Mega
2. Restic is a program I have on my computer (that I can even compile from sources), and not a website that gets loaded everytime (and that I will obviously not audit every single time).
