alt Hacker NewsPublicly stating to not have access to message contents yet doing otherwise, i.e. outright deception, doesn't seem like something you can EULA your way out of in most jurisdictions.
Beyond that, the GDPR and similar laws also impose limits as to what you can EULA away even without being deceptive about it.
At best, it would come down to the details of what their marketing materials have claimed wrt to keeping contents secret. Do you have anything concrete they've promised? I don't remember anything, but maybe that's just my bad memory.
Anything specific from the GDPR you'd apply here?