Privacy
What this site keeps, and what it doesn't.
Search
Search requests use POST, omit browser credentials, and reject attached account authorization or cookies. The application does not create a visitor ID, IP hash, click log, analytics event, or browser fingerprint. Current search state stays in page memory. Result links do not use tracking redirects.
Saved customization
Appearance and animation settings are saved on this device only when you select Remember. Installing a Store package creates a local installation record. Those settings contain no account ID. The logo uses pointer coordinates only for rendering, not for analytics or authentication.
Accounts
Accounts are optional and use a separate origin. A random recovery key derives separate authentication and encryption keys. Vault writes use authenticated AES-256-GCM encryption, a fresh random derivation salt, a fresh nonce, and a fixed-size padded plaintext. The server stores a stable public-key account identity and encrypted vault data. Account actions are therefore linkable to that account; they are not anonymous.
Sessions and rotation
Strict accounts require a user-verified passkey. Browser sessions use host-only HttpOnly cookies (Secure over HTTPS) and a separate in-memory device proof key; the server stores only token hashes. Copied URLs or session cookies alone do not authenticate. Native clients use an explicit token transport with the same device-proof requirement. They expire after 15 minutes and rotate on account-page activity after five minutes. A signed root-key change re-encrypts the active vault and revokes previous sessions. It does not erase old downloads, prevent traffic analysis, or make old ciphertext forward-secret.
Network and browser limits
On a direct connection, the network host can see your connecting address and request metadata. Disabling application and Worker logs does not establish that every infrastructure system keeps no logs. Stronger network privacy needs a correctly deployed independent relay or Tor path. A compromised device, malicious browser extension, or hostile application update can compromise data while it is unlocked.
Store
Packages are signed and reviewed version by version. This version accepts only bounded declarative themes, spacing, local source labels, and query shortcuts. Arbitrary JavaScript, HTML, CSS text, external networking, filesystem access, and account-vault access are rejected. Catalog expiration, version floors, quarantine and revocation are enforced locally. A cached client cannot learn a new revocation until it receives updated metadata.
Deletion
Account deletion removes the active account, ciphertext and sessions. Local preferences, installed packages, downloaded backups, SQLite recovery remnants and infrastructure backups have separate retention boundaries. A minimal retired-account hash and deletion sequence are retained to keep deleted accounts from being revived by an old backup. They contain no queries, network addresses, or vault contents. Restored accounts stay locked until an operator checks a current authenticated deletion record. No physical-erasure guarantee is claimed.
Verification
This is a source build, not an independently audited anonymity product or a guarantee against every attack. The shipped evidence records exactly which tests ran. The project reference subset executes .sig, but upstream Signum compilation, SBN compatibility, production browser coverage, relay gateway interoperability, and live deployment require their own gates.
Optional search-quality reports
Quality reporting is off by default. When the operator enables it and you turn on Help improve search in Settings, Signum can receive a coarse latency, result-count or intent band. You can also explicitly rate a result. Query text, page URLs, account details, fingerprints and written comments are not included in these reports.
Reports use short-lived encrypted receipts to resist replay. An operator can inspect noise-adjusted daily aggregates. Counts represent reports, not distinct people. The system does not claim user-level differential privacy, an independently audited noise sampler, or complete resistance to bots.
You can switch reporting off at any time; pending browser reports are cancelled. Global Privacy Control and Do Not Track override collection. Already released anonymous aggregates cannot be attributed back to a person for individual deletion. Host/provider access logs, network timing, compromised devices and malicious operators remain separate risks.
The query-match bars describe matching signals—not factual accuracy, source trust, or the chance that you personally will like a result. Grouped links preserve the ordering of neighboring results from the same site section.