[TisButMe]

I work at Kagi. This is a very reasonable fear to have. We do actually not store the data, but of course you'd need to take me at my word for this.

That said, if we did lie or change that, we'd be in immediate breach of our privacy policy (https://kagi.com/privacy), and as a result be a very easy target for a lawsuit. Given that we're intentionally not VC backed, between the horrible press this would be and the actual costs of fighting such a lawsuit, I expect not much would be left of Kagi afterwards. We are liable to users, in a pretty existential way.

[simpaticoder]

Having read your privacy agreement, I don't see where the threat is existential if you are in breach. I think that the knowledge of engineers of the judicial system, both criminal and civil, is very naive. You can sue anyone over anything at any time - you don't need valid grounds. It also doesn't mean that if you win it matters.

Your privacy policy has lots of feel-good language that actually doesn't mean anything - along the lines of the classic "We value your privacy" statement that firms often make. When you analyze it, you find it means nothing. There are no actionable clauses. For example, if you are in breach of "Anonymous logs are aggregated with GCP's logging tools, retained for 30 days." what are the enumerated damages? A counter-party would have to prove show BOTH that you are in breach AND then real damages , which is difficult in this case, and entirely misses the point. E.g. if you sell 1M user data records for $.001 each, and a user has on average 10 records on them, the real damages are $.01, but your firm made $100k on the transaction. I don't see a limit to class action (or forced arbitration) so that's good; but good luck building out that class - especially since you'll resist sharing user data with the class action plaintiff, using the same privacy policy as a shield!

(This is the other trick of privacy agreements, apart from not actually saying anything: the stuff that is measurable is unenforceable).

It's time that the public stop seeing moonbeams and rainbows in these matters. Do you think that a lender will be satisfied with a debtor statement "I value paying back my debts, and will never be late!"? If not, then why are we mollified by similar statements by software firms made to us? What is measurable has no teeth; what has teeth is not measurable.

It's a very dirty trick.

[TisButMe]

If you think we should word the privacy policy differently, please do submit some feedback on kagifeedback.org with the specifics - we have changed it in the past through exactly this process. It has been written by engineers, mostly for engineers at the beginning. I'm sure we can improve the wording to make it more binding, we're not trying to squirrel away from it. If you have enough legal knowledge to harden it, we'd welcome the contribution :)