Privacy Policy
Last updated: October 2026
search_suggestions goes to Anthropic, whose Claude model writes the
suggestions. These disclosures are
part of providing the service and are described below. During early access,
request diagnostics may be retained for quality checks for up to 24 hours.
We do not promise zero logging or zero third-party retention.
Who we are
SearchMesh is operated by Sheet Vue Technologies Company Limited (CÔNG TY TNHH SHEET VUE TECHNOLOGIES, tax code 0317572380), Ho Chi Minh City, Vietnam. Contact: support@searchmesh.io.
What we collect
- Account data: the email address you sign up with, a bcrypt hash of your password (never the password itself), or — if you use Google sign-in — your Google account ID and the email address Google shares with us. Nothing else from your Google account.
- Developer credentials: new per-agent keys are stored as hashes, with a short display prefix, selected agent label, creation/last-use times and revocation status. Existing legacy account keys retain their original storage model.
- Connected-app metadata: client names, registered callback URLs, granted access, connection and last-use times, and revocation status. OAuth codes, access tokens, refresh tokens, and client secrets are stored as cryptographic hashes.
- Essential session cookies keep you signed in and protect forms. Hashed request-origin identifiers and attempt times help rate-limit sign-in and signup.
- Bot check on email sign-up: the sign-up form runs Cloudflare Turnstile to tell people from automated sign-ups. Cloudflare receives signals from your browser and connection, such as your IP address and browser type, and we send it the check's one-time result and your IP address to confirm it. It does not receive your email address or password. See Cloudflare's Turnstile privacy addendum.
- Usage metadata for allowance tracking and abuse prevention: request ID, timestamp, tool, account identifier, client-reported or selected agent name, outcome, HTTP status, duration, and a content-free response summary (such as source count). The dashboard history covers up to 24 hours; monthly aggregate counts are retained separately. We no longer write the earlier duplicate per-request usage logs. Search text, full URLs, page contents, credentials and raw responses are not stored in dashboard history. Queries and page content are processed by search infrastructure, which may use temporary caches and operational logs to serve requests.
- Early-access quality diagnostics: only for accounts on our early-access plan, and while early-access quality logging is enabled, the service operator can inspect search text, selected tool arguments, account/agent identifiers, worker destinations, per-attempt outcomes, engine failures and timing. These records are kept for up to 24 hours, capped at the most recent 50,000 requests, and require owner access. They are automatically deleted by a scheduled job even when no new requests arrive; cleanup starts before the 24-hour limit. Other plans and unidentified integrations are excluded from this diagnostic logging. Request-level diagnostics are excluded from our application backup procedure. Account, authorization and aggregate quota records are separate and are not deleted after 24 hours. Recognizable credentials are redacted; raw page bodies, authorization headers and passwords are not intentionally logged. Avoid putting secrets in search queries.
Website analytics
To learn which pages and channels bring people who successfully connect an agent, the
public website can load Google Analytics 4 through Google Tag Manager when configured
and only after you allow analytics. Tags are excluded from private dashboard, OAuth
and verification routes, the API and the MCP endpoint. It records page views, the referring site and campaign
parameters (utm_*), device and browser type, an approximate location that
Google derives from your IP address, and the sign_up event on public signup
confirmation pages. Verification timestamps stay in account data; we do not send
analytics from your private dashboard. It never receives your email address, your search queries or the
content of your requests. We do not use it for advertising, ads personalisation or Google
Signals. Google processes this data under its own terms; see
how Google uses information from sites that use its services.
Analytics is off by default everywhere. No Google Tag Manager request is made until
you opt in. When analytics is configured, use Analytics settings in
the footer to allow or withdraw consent at any time. Turning it off removes known
analytics cookies and reloads the page without analytics tags. We also set a separate
first-party sm_src campaign-attribution cookie for
up to 30 days that holds only the campaign parameters and referring site you arrived
with, so we can record which channel a signup came from; it contains no identifier and is
stored with your account only when you sign up. Google Search Console shows us aggregated
search statistics for this site and no visitor data.
What we don't do
- We don't sell personal data, to anyone, ever.
- We don't share account data with advertisers or data brokers.
- We don't run ad pixels or advertising trackers. The website uses Google Analytics for visit statistics only (see Website analytics); the API and MCP endpoint carry no analytics tags.
- We don't use your queries to build ad profiles or train anything.
Where your query actually goes
When you call web_search, our browser-driven worker (described below) opens
the results pages of Google, Bing, DuckDuckGo, Brave and Yahoo for your query and merges
what they show. If it cannot answer, because it is busy or unreachable or no engine
returned results, your query is sent to Google through 2Captcha's Scraper API (described
below). This is the mechanism the product runs on, and we don't attach your account
identity to it. read_url similarly has to contact whatever URL you give it
to fetch its content.
For web search, 2Captcha's Scraper API receives your search query and applicable language, date and safe-search filters in a Google search URL. We do not attach your account identity, SearchMesh key, OAuth token or cookies. This external provider may retain task history under its own terms; we do not claim zero retention. Search queries can contain personal information, so do not submit secrets or confidential text. Its use is identified in result provenance and our private operations report. That report also stores provider task IDs, timing and costs, but not the provider credential.
Searches and page reads are carried out first by a browser-driven worker that runs on infrastructure we operate and opens real web pages. To search, it opens each search engine's results page for your query directly; no AI model types or sees the query on the way. We do not attach your account identity, SearchMesh key, OAuth token or cookies. The search engines may retain data under their own terms; we do not claim zero retention. The browser worker's own browsing history, caches and site data are deleted whenever it restarts, at least every six hours; only cookies belonging to the search engines themselves are kept, so that a search engine does not treat every request as new. It does not log your queries or the pages you read.
If our worker cannot read a page, we may send the page's public address (never your account identity, key or cookies) to 2Captcha's scrape service, which fetches the page and returns its content. The same provider terms and the same absence of a zero-retention claim apply, and such a read is identified in its provenance as a fallback.
When you call search_suggestions, the text of your query (and the language
code, if you give one) is sent to Anthropic's API, where a Claude model writes ten
suggested searches. We do not attach your account identity, SearchMesh key, OAuth token
or cookies. Anthropic handles this data under its own commercial terms; we do not claim
zero retention. Queries can contain personal information, so do not submit secrets or
confidential text. The same request is answered from memory for up to ten minutes.
For search quality assessment, TypeSafe's Jev API receives your query, limited source titles/snippets, sanitized source URLs, and selected public page excerpts. We do not attach your account email, account ID, SearchMesh API key, session cookie or OAuth token. Queries can themselves contain personal information, so do not submit secrets or confidential text. TypeSafe's own data-processing terms govern its handling; we do not claim enterprise zero-retention terms for this account.
Private mesh diagnostics also retain relevance scores, quality flags, model/rubric versions, source summaries and quality-call token counts for the same 24-hour / 50,000 request limit. Raw page excerpts are not stored in that diagnostic ledger; they may be held in short-lived response caches. Relevance judgments are not proof of truth.
Provider call records, including task IDs, are removed from our local ledger within 24 hours and folded into daily cost/count totals. Aggregate spending and unknown-cost reservations remain for budget enforcement (up to 62 days); aggregate Jev token counters remain for 35 days. These aggregates contain no queries, source text or account identifiers. Our 24-hour diagnostic policy does not control independent provider records, security records or the account and consent information needed to operate your account.
Payments
Paid billing isn't live yet. When it is, payment details (card numbers etc.) will be handled directly by a licensed payment processor — we will never store your card details on our own servers.
Where data lives
Account data and API keys are stored on infrastructure we operate ourselves. Operational logs are automatically rotated and size-capped, not kept indefinitely, and not accessible to anyone outside the team running this service.
Security
Passwords are hashed with bcrypt (never stored in plain text). All traffic to the API and dashboard is encrypted with TLS. You can regenerate your API key at any time from the dashboard if you think it's been exposed.
When you authorize an AI app, it receives access to SearchMesh tools and their results, not your account password or developer API key. The AI provider's own terms and privacy policy govern its handling of queries and results. Revoke individual app connections from your dashboard to stop future authenticated requests.
Your choices
You can delete your account and its data at any time by emailing support@searchmesh.io. Regenerating your API key immediately invalidates the old one.
Children
SearchMesh isn't directed at, or knowingly used to collect data from, children under 13.
Changes to this policy
If this policy changes in a material way, we'll post the update here and, where practical, email registered users.
Governing law
This policy is governed by the laws of Vietnam.
Contact
Questions about this policy: support@searchmesh.io.