Privacy

Last updated 24 September 2026

1. What we collect

An anonymous device token. Your browser or app generates a random identifier the first time you search and sends it with each request. We store a hash of it alongside a counter, so we can enforce the daily free allowance. It is not derived from anything about you or your device, it is never linked to an email address, and clearing your data replaces it with a new one.

Query hashes, under a threshold. To make repeated searches instant and cheap, we cache the resulting list of sites against a hash of the normalised query. A query is only written to that shared cache once at least three separate devices have asked for it. A search only one person ever makes is not retained.

An email address, if you pay us. Paid plans need a way to identify your subscription. Any working address is fine, including an alias from a forwarding service.

2. What we do not collect

• Search text tied to you. The server never writes query text to a log. The logger used in production redacts query-shaped fields before anything reaches standard output, so this is enforced in code rather than in policy.
• IP addresses. They are not written to any log or database.
• Browsing history. Pages you open are known only to your own device. The desktop app records page measurements in a local SQLite file; the extension reads your Chrome bookmarks and history locally and sends neither anywhere.
• Analytics or telemetry. There is no tracking script on this site and no usage reporting in any client.
• Crash reports. Not collected, not even optionally.

3. Where your searches actually go

This is the part most privacy policies leave vague, so here it is plainly. Which of these applies depends on how you have Jasb configured.

• Default (our server). Your query goes to our proxy, which forwards it — without your device token and without any identifier — to a search provider and a decision model. Those providers see an anonymous query. We see a query we cannot attribute to anyone.
• Bring your own keys. Your query is forwarded straight to the providers whose keys you supplied. Those providers see your requests and your IP address, under their own terms, not ours. We do not store the keys.
• Fully local. With a self-hosted SearxNG instance and a self-hosted decision model, queries never leave your network at all.

4. Where your keys are kept

The three clients differ, and the difference matters:

• Desktop app — encrypted by the operating system keychain, and never readable by the interface once saved.
• Chrome extension — ordinary extension storage, which is not encrypted. Anyone with access to your browser profile directory can read it. The settings screen says so where you enter the key.
• Web app — browser storage, also not encrypted, with the same warning shown in place.

If key safety matters to you, use the desktop app or our server-side default, where there is no key of yours to protect.

5. Payments

Paid plans are processed by Paddle.com Market Ltd, acting as merchant of record. Paddle collects and processes your payment details and billing information directly; we never see or store a card number. Paddle's own privacy notice governs that data, and they are the entity that appears on your statement and issues your invoice.

There is no Jasb account. When a payment clears, our server creates a licence key and shows it to you once, on the page you return to after checkout. We keep a one-way hash of that key, the plan, whether it is active, and Paddle's subscription id so a cancellation can switch it off. We do not store your name, email address or country; Paddle holds those for invoicing.

A licence key is sent with your searches so the server can apply your plan's allowance. It is not stored alongside the query and is never written to a log. Until you pick it up, the key waits on our server for at most seven days, and is then deleted.

6. Subprocessors

We keep this list short on purpose, and it is complete:

• Paddle — payments, invoicing and sales tax, for paid plans only.
• Search providers (Brave Search, Wikipedia, Marginalia) — receive the query text, with no identifier attached.
• Decision and language model providers — receive the query and short excerpts of candidate page titles and snippets, with no identifier attached. Where a provider offers a no-retention agreement, we take it.
• Our hosting provider — runs the proxy. It necessarily handles the network connection; it is configured not to retain request logs.

7. Retention

• Quota counters reset daily and hold nothing but a hash and a number.
• Shared cache entries expire on a schedule set by the kind of query: one hour for news, up to thirty days for a definition.
• Local data lives until you delete it. Every client has a single button that erases history, favourites, ranking rules, cached results, page measurements and stored keys, including the device token.
• Licence records (a key hash, a plan and a status) are kept while the licence exists. Email [email protected] to have yours deleted.
• Billing records are kept as long as tax law requires, by Paddle.

8. Cookies

This site sets no cookies and loads no third-party scripts, fonts or trackers. The demo stores one random identifier in your browser's local storage so it can count your five daily searches; clearing site data removes it.

9. Your rights

Because we hold so little, most requests resolve instantly: deleting your local data is a button in the app and needs no involvement from us. For anything tied to a paid account — access, correction, export or deletion — write to [email protected] and we will action it within 30 days.

10. Children

Jasb is not directed at children under 13 and we do not knowingly collect their data. Since we do not collect personal data by default, there is in practice nothing to collect.

11. Changes

If this policy changes in a way that affects what we collect, we will update the date at the top and note the change in the release notes. The source of every claim on this page is in the public repository, so you can check it rather than trust it.

12. Contact

Privacy questions and data requests: [email protected]
Technical and security reports: [email protected]