Privacy

Three kinds of data, and nothing else:

• Your account. An email address and a password hash, held by our authentication provider. A display name and default country and language if you set them.
• Your analyses. The query you ran, the search results it returned, the public web pages it read, and the report it produced. Public pages are stored as text so a report can quote its own evidence.
• Your provider keys. Encrypted, and described below.

There is no payment data, because there is nothing to pay for — The Search Project has no pricing, no plans, and no billing of any kind.

You bring your own accounts for search, page reading, and AI. Those keys are encrypted with AES-256-GCM before they are written down, and the encryption key lives in the server environment, never in the database beside them.

A saved key is never sent back to your browser. The interface shows you the last four characters so you can tell one key from another, and nothing more. Keys are never written to logs. You can replace or delete a key at any time from Settings.

Running an analysis sends data to three services, through your own accounts:

• SearchApi receives your search query, country and language, and returns the search results.
• Firecrawl receives the addresses of the ranking pages and returns their content.
• Your AI provider receives the query and the text of those public pages, and returns the analysis.

Each of these is your account, under your agreement with them, and their handling of that data is governed by their own terms. We add nothing on top and take no copy for ourselves.

You, by default, and no one else. Every table enforces row-level security, so a request carrying your identity can only ever read your own rows — that is a database rule, not an application check that could be forgotten.

A report becomes visible to someone else only when you create a share link for it. Anyone with that link can read that one report, without signing in, until you revoke it. Revoking is immediate.

Any report exports to PDF, Markdown, DOCX, CSV, or JSON, with its evidence intact. Deleting a report deletes the report, its sections, and the page content stored with it.

To close your account and remove everything attached to it, Settings → Profile is the place to start.

One cookie, to keep you signed in. There is no advertising, no analytics that follows you between sites, and no third-party tracking script on any page — including this one.

If this page changes in a way that affects what we store or who we send it to, the date at the top changes with it.