Unless you're encrypting everything client-side before it touches their servers, assume they can read everything. Whether they DO read it is another question, but technically they absolutely can