Playing chicken with cat.jpg
  I won't post to say "I haven't looked at the contents of the 
  file, but it's named 'cat.jpg'" either. I won't even post to 
  announce that the one hundred millionth file has been stored. 
  [...] This is because I have no way to obtain that information. 
  The contents of files [...] is all hidden from me by Tarsnap's 
  strong client-side encryption.

I agree that cat.jpg was a privacy violation and I do believe they did more than simply look at the filename. However, I'll take the unpopular position that this is within the limits of what one can reasonably expect from a website providing a service as 37signals does. Admins will, and are completely expected to, look at the data - if only to make sure everything is working. Looking at a file called cat.jpg because it's the gazillionth file is pushing the boundary a bit, but I still think this is OK. The moment I opt to use a hosted project management software, I implicitly accept that things like this (and potentially much worse) might happen.Forgive me cperciva, but to me your post looks just like a giant plug for your own service. Client-side encryption is not warranted for everything, nor is it a reasonable goal for every app that shares data on the web. It's fine that Tarsnap does this, and frankly I would expect the same from a service like, say, DropBox - but it's not a reasonable expectation when it comes to the type of apps 37signals provides.