They can, but they say they don't. Of course if you're uploading data to their servers (and to a lesser extent, using their OS), you are trusting them to some degree.