Privacy Policy — API Accounts & Dashboard

Section 1What this policy covers

This Privacy Policy explains how Onion Search Engine LLC (“we”, “us”, “our”) handles personal data in connection with:

• registration and maintenance of a user account on onionsearchengine.com;
• use of the API services (Search API, History API, Metadata API, Link Graph API, Vulnerability API);
• use of the monitoring dashboard, including watches and alerts;
• billing and payment for paid plans;
• support correspondence with us.

We refer to all of the above together as the “Service”.

Section 2What this policy does not cover

This policy does not apply to the public onionsearchengine.com search engine. We operate two separate systems on independent infrastructure.

Records described in this document exist only within the threat intelligence platform. Nothing here applies to, or creates records within, the public search engine.

Section 3Our approach in short

• We ask for the minimum information needed to open an account: a username, an email address and a password.
• We use no third-party analytics, no advertising networks, no tracking pixels, no external JavaScript and no third-party scripts of any kind. Every component of the Service, including our mail servers, is built and operated by us.
• We do not sell, rent, license or otherwise share personal data with third parties for their own purposes.
• On this platform we do retain API query terms and monitoring watch terms, for the limited purposes set out in sections 5.2 and 5.3. We state this plainly so you know what applies where: the free public search engine is a separate, genuinely no-log system (section 2).

Section 4Data controller

Onion Search Engine LLC is the controller of the personal data described in this policy.

Postal address: 244 Madison Avenue #1031, New York, NY 10016, United States
Email: info@onionsearchengine.com

The Service is directed at the United States market. We do not target, market to, or price for the European Economic Area or the United Kingdom, and we do not offer the Service in EEA languages or currencies. We do not, however, block users who choose to access it from outside the United States. Section 13 sets out the rights we extend to such users as a matter of policy.

Section 5Information we collect

5.1  Account registration

To create an account you provide:

Passwords are stored only as salted cryptographic hashes. We cannot read, recover or tell you your password; we can only allow you to reset it.

We do not ask for your real name, postal address, telephone number, employer, date of birth or any government identifier at registration.

5.2  API keys, usage records and query content

When you sign up we issue one or more API keys linked to your account.

Usage records. To enforce plan quotas (for example the 1,000 requests per month on the free Developer plan), apply rate limits and bill correctly, we record for each key the number of requests made, the originating IP address, the date and time of each request, the endpoint called, and the response status.

Query content. We also retain the search terms and parameters you submit to the API. We use them for two purposes:

1. Abuse prevention. Detecting spam, scraping, automated misuse, quota circumvention and use of the Service in breach of our Terms.
2. Threat intelligence and service improvement. Analysing what is being searched across the Service in order to improve index coverage and quality, identify emerging indicators, and support our own security research.

The second purpose goes beyond simply delivering the Service to you, and we want you to be aware of it before you rely on the API for sensitive work.

Retention. Query records are retained for 90 days, after which they are either deleted or irreversibly aggregated so that they can no longer be linked to an account or an API key. We do not publish, sell, or disclose individual customers’ query content to third parties, and we do not attribute it to a named customer in any product or research output.

5.3  Monitoring watches and alerts

If you use the monitoring features, we store the watch terms you configure — a brand name, a domain, an email address or a keyword — because the Service cannot alert you to a match without retaining what to look for. We also store the notification method you choose (email address and/or webhook URL) and the matches generated for your watches, so they can be shown in your dashboard.

As with API queries, watch terms also inform our threat intelligence work: knowing which indicators are being monitored helps us prioritise crawling and detect emerging activity. They are not shared with other customers, published, or attributed to you.

You can delete any watch at any time from the dashboard. Deleting a watch removes it and its stored matches.

5.4  Payment and billing

We accept two payment routes.

Card and traditional payments — Stripe. Card payments are processed by Stripe, Inc. Card numbers, CVC codes and full payment credentials are entered directly with Stripe and never reach our servers. Stripe acts as an independent controller of the payment data it collects, under its own privacy policy. From Stripe we receive only limited billing metadata — a transaction identifier, the amount, currency, payment status, the last four digits and brand of the card, and the country associated with the payment — which we retain for accounting, tax and dispute-handling purposes.

Cryptocurrency payments — BTCPayNow. Cryptocurrency payments are handled through btcpaynow.com, an instance of the open-source BTCPay Server software that is installed, hosted and operated by us. It is not a third-party payment processor: no payment intermediary sits between you and us, and no customer data is passed to an external crypto payment provider. We generate an invoice and a receiving address, and record the invoice status and the amount received.

Transactions on public blockchains are, by design, permanently and publicly recorded outside our control. We do not analyse, cluster or attempt to deanonymise the wallet addresses that pay our invoices, but we cannot alter the public nature of a blockchain.

Invoices. Where tax or accounting law requires an invoice containing billing details (for example a business name, address or tax number), we collect and retain only what the applicable law requires.

5.5  Support and correspondence

If you write to us at info@onionsearchengine.com or through a support channel, we hold the message, your email address and our reply for as long as needed to deal with the matter and to keep a record of it.

Our mail servers are operated by us on our own infrastructure. Account verification messages, password resets, service notices and alert emails are sent from our systems; no third-party email delivery service handles your address or the content of those messages. Email in transit between our servers and your provider is subject to the ordinary limits of internet email, and we use TLS where the receiving server supports it.

5.6  Security and operational records

Our servers keep operational records for the platform. These records contain:

• the IP address from which a request or login originates;
• the search terms and monitoring keywords submitted (see sections 5.2 and 5.3);
• the date and time of each request;
• the endpoint called, the response status, and the API key or account involved.

We keep them for two reasons: to count requests accurately for quota enforcement and billing, and to detect and respond to abuse — spam, scraping, quota circumvention, credential stuffing, denial-of-service attempts and use of the platform in breach of our Terms.

IP addresses are personal data in many jurisdictions, and we treat them as such. We use them for the two purposes above and to secure accounts; we do not use them to build location profiles, and we do not combine them with third-party data sources. An IP address can indicate an approximate geographic region, and you should assume ours are capable of that.

Operational records are retained for 90 days. After that period they are deleted, or stripped of IP addresses and account identifiers and kept only as aggregate counters for capacity planning and billing history. Failed authentication attempts are recorded so we can block brute-force and credential-stuffing attacks.

5.7  What we do not collect

We do not collect, and have no mechanism to collect:

• your browsing history or behaviour outside the Service;
• advertising or cross-site identifiers;
• device fingerprints;
• precise or device-level location data (GPS, Wi-Fi or cell positioning). We do record IP addresses, which indicate only an approximate region — see section 5.6;
• special categories of data (health, political opinions, religion, biometrics and similar), which we ask you never to submit to us.

Section 6Cookies and client-side technologies

The dashboard sets a first-party session cookie that is strictly necessary to keep you logged in, and may set a cookie carrying a security token (for example, CSRF protection). That is all.

We use no analytics cookies, no advertising cookies, no third-party cookies, no tracking pixels, no web beacons and no fingerprinting. No third-party JavaScript, font, CDN or tag manager is loaded by the Service.

The public search engine operates without JavaScript entirely.

Section 7Why we process your data

We do not carry out automated decision-making producing legal or similarly significant effects.

Section 8Who we share data with

We do not sell, rent or trade personal data. We do not disclose it for anyone else’s marketing.

The only routine external recipient is Stripe, and only for card and traditional payments, as described in section 5.4. Cryptocurrency payments involve no external processor. Email is sent from our own mail servers with no third-party delivery provider.

We use third-party hosting and network providers in the United States, Europe and Asia, which store data on our behalf under contract and may not access it for their own purposes.

We may disclose data where we are legally compelled to do so — see section 9.

Section 9Legal requests and law enforcement

We disclose data only where we are required to by valid, binding legal process enforceable against Onion Search Engine LLC, or where disclosure is necessary to protect our rights or the safety of others.

We can only produce what we hold, and the two systems described in section 2 hold different things.

As to the public search engine, no query or visitor records exist, so none can be produced — by us or by anyone else, whatever the process.

As to the threat intelligence platform, the records described in sections 5.1, 5.2, 5.3 and 5.6 do exist for their stated retention periods and may be subject to compelled disclosure. Because the two systems are independent, process directed at platform accounts does not and cannot reach public search engine activity: no such records exist to be linked.

Where we are permitted by law to notify you of a request concerning your account, we will endeavour to do so before responding, so that you have an opportunity to contest it.

Section 10How long we keep data

Section 11Security

We operate the Service on infrastructure we control, including our own mail servers. Access to production systems is limited to personnel who need it. Passwords are stored only as salted hashes; API keys can be rotated or revoked by you at any time; traffic to the Service is encrypted in transit with TLS. We run no third-party code in the Service, which materially reduces the attack surface exposed to you.

No system is perfectly secure. If a security breach affecting your personal data occurs, we will notify you and any competent authority as required by applicable law, without undue delay.

Section 12Where your data is processed

Our infrastructure is geographically distributed across the United States, Europe and Asia for reliability, resilience and response time. Your data may therefore be stored on or transit through servers in any of those regions, and the node handling a given request depends on network routing at the time.

We are established in the United States, and Onion Search Engine LLC remains the controller of your data wherever it is processed. Operating a server in a region does not place your data under that region’s protections by default, and the legal protections available in each location differ from one another and from those of your country of residence.

By using the platform you understand that your data will be processed across these regions.

Section 13Your rights

We extend the following to all account holders, regardless of where they are located:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data, including by closing your account at any time from the dashboard;
• object to the use of your query and watch data for threat intelligence and service-improvement purposes (section 5.2, purpose 2, and section 5.3). Write to us and we will exclude your account from that use; this does not affect abuse prevention or metering, which we cannot switch off without ceasing to provide the Service;
• receive a portable copy of the data you gave us, in a structured, machine-readable format;
• withdraw consent where processing rests on consent, without affecting prior processing.

California residents. We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA/CPRA. We do not use or disclose sensitive personal information beyond the purposes permitted by law. You have rights to know, delete, correct and opt out, and we will not discriminate against you for exercising them.

Users in the EEA and the UK. Although the Service is not directed at those markets, if you hold an account we will honour the rights above and you may complain to your national data protection authority.

To exercise any right, write to info@onionsearchengine.com from the email address registered to your account, or contact us from within the dashboard. We respond within 30 days. We do not charge a fee except where a request is manifestly unfounded or excessive. If we cannot verify that a request comes from the account holder, we may have to decline it — this protects you as much as us.

Section 14Account deletion

You may close your account at any time from the dashboard, or by writing to info@onionsearchengine.com. Closure revokes your API keys, deletes your watches and their stored matches, and removes your account record within 30 days, except for billing and tax records we are legally required to keep and security records within their retention window.

Section 15Age requirement

The Service is intended for professional and research use by adults. Accounts may only be held by persons aged 18 or over, as required by our Terms of Service, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has registered, write to us and we will close the account and delete the data associated with it.

Section 16Changes to this policy

We may update this policy as the Service or the law changes. The “last updated” date at the top always reflects the current version. For material changes affecting your rights, we will notify registered account holders by email before the change takes effect.

Section 17Contact