Privacy Policy

These are the invariants the whole system is shaped around. A violation would require someone to add a code path, not merely to forget a line.

• No query text is persisted anywhere — not the database, not Redis, not logs, not metric labels, not traces, not analytics
• No cookies, no local identifiers, no fingerprinting on any surface
• No third-party requests — no external fonts, scripts, analytics, pixels, CDNs or error reporters
• No advertising, no data brokerage, no sale of anything
• Every stored field has a documented purpose, a retention period and an owner

The list is short enough to print, and it is enforced by a CI job that greps for banned log and metric fields.

• Search history — there is no account and no history
• Cookies or advertising identifiers
• Canvas, font or any other fingerprinting signal
• Exact client IP in application storage
• Retained User-Agent or referrer chains
• Cross-site identifiers or behavioural analytics, heatmaps or session replay

Rate limiting is the usual place a privacy project quietly builds a profile. LYNX buckets on a rotating salted hash of a truncated IP instead.

Two people behind the same /24 share a bucket. That is an accepted availability cost, and it is preferable to a durable identifier that can be correlated across days.

• HMAC-SHA256(salt_day, first three octets of the IP address)
• The daily salt is itself an HMAC of a server secret and the date
• Counters live in Redis with persistence disabled and a 25-hour TTL

No human in production has direct access to query strings, because query strings do not exist as stored values. There is also no per-user anything to look at.

Debugging does not require reading your search. The query plan is yours — inspectable, serialisable, and shareable — which is exactly why you can debug it and we cannot.

LYNX does not claim anonymity and it is not 'zero logs'. Publishing this is deliberate: precision about what leaks is more trustworthy than a slogan.

• Operators, hosting providers and network intermediaries can observe infrastructure-level logs
• A query is shared with the destination site when you click a result
• HTTP-level metadata — TLS SNI, connection reuse, IP — leaks coarse timing and network information
• The index is small compared with commercial engines for years, so coverage will be worse

Every stored category declares a retention class. A table that cannot declare one is not created.

• Rate-limit counters — 25 hours, memory only
• Logs — 14 days, keyed by request_id only
• Metrics — 30 days raw, then 13 months downsampled
• Abuse reports — 90 days after resolution, encrypted at rest
• API keys — life of the key plus 30 days
• Admin audit log — 2 years
• Backups — 35 days encrypted, and disclosed as not selectively purgable

Run LYNX yourself and the privacy defaults become your defaults. A verification artefact ships with the release so the claims can be checked by anyone, not only by us — verification that only the author can perform is not verification.

Privacy questions can be sent to privacy@anoneurx.com. Privacy changes are published before they ship.