Privacy Policy for cl0q
Last updated: 6 November 20261. Introduction
cl0q (“we,” “us,” or “our”) operates cl0q.com (the “Service”), a free, independent search engine (going open source soon · GitHub) with its own crawler and index. This policy describes exactly what we collect and what we do not. We have tried to write it so that every sentence is something you could verify, rather than something you have to take on trust.
- Search never needs an account. No login, no key, no identity. Accounts exist for optional community features and use a passkey or, if you prefer, a password — never an email address.
- No search history. We have no database of what anyone searches for. The only exceptions are ones you switch on yourself: a signed-in user can opt in to saving their own history, and a saved-search alert stores the query you ask us to watch.
- No per-request logs. Nothing about an individual request — no IP address, no URL, no search query — is written to disk. We keep only aggregate traffic counts, such as “12 visitors came from a search engine today”.
- No cookies unless you sign in. Signed out, cl0q sets no cookies at all. Signing in sets one strictly-necessary session cookie, removed when you sign out.
- No third parties. The site loads zero external resources: no analytics, no tag managers, no ad pixels, no external fonts. View source and check. Paying for something is the one step that leaves cl0q: payments go through Stripe (see §6).
- No profiling, no ads. We do not build user profiles and do not serve personalised advertising.
- Your query isn't leaked to sites you click. We send
Referrer-Policy: no-referrer, so a site you click through to is told nothing about what you searched for, or that you came from cl0q.
2. What We Collect
Search queries
We process your search terms to generate results. Your query is held in memory for the life of that request and is never written to any database — unless you are signed in and have switched on “save my search history” for your own account (it is off by default, and you can clear it or switch it off at any time).
Server logs
cl0q keeps no per-request access log. For a normal request — including every search — we write no IP address, no requested URL, no query string, and no user agent to disk. There is no per-request record kept.
We log application errors and operational events: a failed database query, a slow query, the server starting or stopping. These entries carry no IP address and no search terms — a rejected query, for example, records only its length, never its content — and they rotate out within a few days.
Aggregate traffic statistics
To understand how people find cl0q and to spot abusive automated traffic, a small program on our own
server counts requests in memory and saves only daily totals: how many
pages were viewed (and which cl0q pages), where visitors arrived from — the referring
website's domain only (e.g. google.com), never the full referring address — any
campaign tag in the link you followed (e.g. ?ref=newsletter), the country your connection
comes from, browser family, operating system, device type and browser language, and whether a client
looks automated. It never sees your
search terms: the query string is not passed to it.
To count unique visitors and recognise bots, your IP address is turned — in memory — into a keyed hash using a secret that changes every day and is never stored. Neither the IP nor that hash is written to disk, and the in-memory state is discarded at the end of each day. There is no way to link a visitor across days, and no per-visitor record exists.
The country is looked up on our own server, from a local copy of the free DB-IP “IP to Country Lite” table (CC BY 4.0) that we download once a month. Your IP address is never sent to DB-IP or anyone else; only the two-letter country code is counted, and only as a daily total.
Bot detection and blocking
Automated clients (search crawlers, scrapers, vulnerability scanners) are classified from their user agent, request headers and request rate; a client claiming to be a major search engine is checked with a DNS lookup of its IP. Today this is observe-only — nothing is blocked. If we switch blocking on, the IP addresses of clients being actively blocked for abuse are kept only for the duration of the block (at most 24 hours) and then deleted, and we will update this policy.
Sign-in, registration and a few account actions are rate-limited per client. Those limits use a keyed, daily-rotating hash of the IP (not the IP itself), and the records are deleted within 24 hours.
Cookies
Signed out, cl0q sets no cookies. When you begin signing in (or creating an account), we
set one strictly-necessary session cookie — cl0q_sess: HttpOnly, Secure, SameSite=Lax,
expiring when you close your browser — and remove it when you sign out. It is never used for tracking,
advertising, or anything outside your own signed-in session.
3. Personal Information
To use cl0q, we never ask for your real name, email address or a password. If you buy something, Stripe collects your name and email address at checkout (see §6). The personal information we can hold is what you choose to give us:
| What | When | How it's stored |
|---|---|---|
| A cl0q account | Only if you create one. Search never requires it. | Your handle and display name, an optional “about me” and avatar, and how you sign in: your passkey's public key (your device keeps the private key; we never see it or any biometric) and/or, if you choose one, a password stored only as a salted argon2id hash — never the password itself — plus your one-time recovery codes, stored only as keyed hashes. Your profile is private unless you make it public. |
| What you do with an account | Only the things you do. | Votes, comments, favorites, collections, sites you submit, notifications about them, an optional push subscription, API keys you create, and — only if you switch it on — your search history. |
| Email address (paid-plan waitlist) | Only if you ask to be notified about Pro or Enterprise on the API page. Entirely optional — it is not needed to use cl0q or to hold a free key. | Stored in plain text with the plan you asked about and, if you wrote one, your note about what you would build. Used only to email you when that plan launches, or to reply to you directly. No IP address is stored with it, and it is never used for any other mailing. A copy of the request is posted to our team's private Discord channel (see §6). |
| Support messages | Only if you send one from the Support page. | The topic, your message and your email address, so we can reply. These are stored in our database and read by us. Your IP address is not stored with them. |
| Feedback and content reports | Only if you send one with the Feedback or Report forms. | What you wrote (the page you are reporting and your note, or your feedback) and, only if you add one, an email address so we can reply. It is not stored in our database: it is delivered to our team's private Discord channel (see §6). Your IP address is never included. To stop spam, each form is rate-limited per IP address in memory only; nothing is written to disk. |
| Purchases | Only if you buy a dataset, API plan or credit pack. Searching never requires it. | Stripe takes the payment (see §6). Our own database stores Stripe's reference numbers, what you bought, its status and amount, and a download token or hashed API key. Your name, email address and card details are not stored in it. |
When you're signed in, your browser also receives a short-lived “browse pass” that lets you page through the full site lists on our explore pages. It contains only an expiry time and a signature — no account ID — so the search backend learns nothing about who is browsing.
We do not collect precise geolocation. We do not buy, sell, rent, or share personal information with anyone, apart from the services named in §6.
4. Features That Necessarily Store Data
These optional features store data because they cannot function otherwise. None is required to search, and none is enabled unless you ask for it:
- Saved-search alerts. If you subscribe to alerts for a search, we store that query and the browser push endpoint needed to notify you — that is the entire point of the feature. Removing the subscription removes the record.
- Accounts and community features. Votes, comments, favorites, collections and site submissions are stored against your account so you (and, where you make them public, others) can see them. Comments you post are public.
- Opt-in search history. Off by default. When on, your own searches are saved to your account so you can revisit them; you can clear them or switch the feature off at any time.
- API keys. Keys are stored only as a SHA-256 hash. We cannot recover or show you your key after it is issued, and a key is never linked to the searches made with it.
5. How We Use Information
- To deliver the Service — process your query and return results, and run the account features you use.
- Reliability and security — uptime monitoring, debugging, and protecting a small shared service from abusive automated traffic.
- Understanding growth, in aggregate — daily totals of how many people visit and where they arrive from.
- Purchases — deliver what you bought, help you with it, keep accounting records, and count which sources lead to sales.
- Nothing else. No profiling, no personalised advertising, no behavioural tracking of individuals, no sale of data, and no sharing beyond what §6 describes.
6. Third-Party Services
Searching and browsing cl0q involve no third parties. Your query is handled entirely by our own software on our own infrastructure, and traffic statistics are computed on the same server — no analytics provider sees them. (We download DB-IP's public country table monthly; that download sends them nothing about our visitors.) The site loads no external scripts, stylesheets, fonts, images, or analytics of any kind — you can confirm this by viewing the page source or watching your browser's network panel.
There are two exceptions. The first is a message you choose to send us. Feedback, content reports and paid-plan waitlist requests are delivered to a private channel on Discord, which our team reads. Our server sends only what you typed into the form (plus the plan you picked, for the waitlist). Discord never receives your IP address, your searches, or anything about your browsing. If you would rather not use Discord, email cl0qsearch@gmail.com instead.
The second is a purchase. Datasets, API plans and credit packs are paid for through Stripe, on Stripe's own pages and under Stripe's privacy policy. Stripe collects your payment details and email address; we never see your full card number. Stripe shows us details of each payment, such as your name, email address, country and the amount, so we can help you and keep accounting records.
If you reached the purchase from a campaign link or another website, we pass Stripe a short label saying so:
the campaign tag (e.g. bluesky) or that website's domain, never the full address and never your
search terms. The label stays with your purchase at Stripe, where we can see it. For API plans, Stripe may also
receive a hash of your API key, so a payment can be matched to its key. Our own counts of purchases are daily
totals by source and product, with no per-person record.
7. Data Retention
| Data | Retained for |
|---|---|
| Error / diagnostic logs (no IP address, no query — see §2) | Up to 7 days. Logs rotate daily and we keep 7 generations; older generations are deleted automatically. No per-request access log is kept. |
| Aggregate traffic statistics (daily totals only) | 90 days. The in-memory per-client state behind them (keyed hashes, bot signals) is discarded at the end of each day and never written to disk. |
| Rate-limit records for sign-in, account actions and support messages (keyed hash, not an IP) | Under 24 hours. |
| IP addresses of clients blocked for abuse | Only if blocking is switched on (it is currently off), and only for the length of the block — at most 24 hours. |
| Search queries | Never stored — except your own opt-in search history (until you clear it or delete your account) and saved-search alerts (until you remove them). |
| Your account and everything attached to it | Until you delete your account. Deleting it removes your passkeys, password hash, recovery codes, votes, comments, favorites, collections, site submissions, search history, notifications, push subscriptions and avatar, and revokes your API keys. |
| Session cookie | Until you sign out or close your browser. |
| API keys (hashed) | Until the key is revoked or you ask us to delete it. |
| Purchase records (Stripe's reference numbers, product, status) | 7 years after the purchase, or after a subscription ends, for tax and accounting. Stripe keeps its own records under its own policy. |
| Daily purchase totals (by source and product, no per-person data) | No fixed limit, because they contain nothing about any individual. |
| Support messages (topic, message, email) | Up to 12 months, or sooner if you ask us to delete them. |
| Paid-plan waitlist entries (email, plan, optional note) | Until that plan launches and you have been notified, or you ask us to delete it — whichever comes first. |
8. Security
- HTTPS everywhere, with HSTS enforcing encrypted connections.
- Passkeys (WebAuthn) are the recommended way to sign in: there is no secret on our side to steal — we store only public keys. If you choose a password instead, we store only a salted argon2id hash, rate-limit sign-in attempts per network and per account, and keep recovery codes only as keyed hashes.
- API keys are stored hashed (SHA-256), never in plain text.
Referrer-Policy: no-referrerandX-Content-Type-Options: nosniffare set on every response.- We apply security updates to both the operating system and the application.
9. Your Rights
If you just search, we hold nothing about you to export or erase. If you have an account, you can delete it yourself at any time from your profile settings; that removes your profile, sign-in methods (passkeys, password hash, recovery codes) and everything you created with it (see §7), and revokes any API keys you created. For anything else we hold — a waitlist email, a saved-search subscription — ask us using the contact details below and we will delete it.
10. Children's Privacy
The Service is not directed to children under 13, and we do not knowingly collect information from children. Since we do not collect personal information from searchers at all, this is largely moot in practice.
11. Changes to This Policy
We may update this policy from time to time. Material changes will be reflected in the “last updated” date above and highlighted on our homepage.
12. Contact Us
For any question or request about your data, contact @chrisknowshtml on X or email cl0qsearch@gmail.com.