“I even opted out of their tracking widget thing!”
A backup company put a Facebook pixel inside the page that lists your private files. The file names and sizes went to Facebook along with the page. He only noticed because the browser said it was waiting on facebook.com. The opt-out did nothing. Marketing tags do not belong behind a login.