Privacy Policy

1. Overview

AI Search Gateway ("the Service") is a self-hosted web search and page content extraction API provided at search.iamnaime.info.bd. This privacy policy explains how the hosted instance of the Service handles data when you use the REST API (/v1/*), MCP server (/mcp), or the public registration and dashboard interfaces.

The Service is built as open-source software. If you self-host your own instance, you are the data controller and this policy does not apply to your instance - you set your own data practices. This policy applies exclusively to the hosted instance operated by Fattain Naime at search.iamnaime.info.bd.

2. Data We Collect

2.1 Account Data

When you register for an API key, we collect:

• Email address - used for account identification, verification codes, and API key delivery
• IP address at registration - used for rate limiting and abuse prevention

2.2 API Usage Data

When you use the API, we record:

• Request metadata - timestamp, endpoint, response status code, response time, cache hit/miss status
• API key identifier - which key made the request (not the key itself - keys are SHA-256 hashed)
• IP address per request - used for rate limiting when no API key is provided

2.3 Data We Do NOT Collect

2.4 CAPTCHA Data

Registration uses Cloudflare Turnstile for bot protection. Turnstile processes your browser environment data to generate a verification token. This is handled by Cloudflare's infrastructure subject to Cloudflare's Privacy Policy. We receive only the pass/fail token, not the underlying browser data.

3. How We Use Your Data

We use the collected data for the following purposes only:

• Service delivery - processing your search and page-read requests
• Rate limiting - enforcing per-key and per-IP request limits to ensure fair usage
• Quota management - tracking monthly request counts against your allocation
• Abuse prevention - detecting and blocking automated abuse patterns
• Service improvement - aggregate, anonymized usage statistics (e.g., total requests per day, cache hit rates)
• Account management - sending verification codes and API keys via email

We never use your data for advertising, profiling, or sell it to third parties.

4. Data Storage and Security

4.1 Storage

All data is stored on a single self-hosted server. There is no cloud database, no third-party analytics service, and no external data pipeline. Data is stored in simple JSON files on disk:

• users.json - account records (email, hashed verification codes)
• api-keys.json - API keys (SHA-256 hashed, never stored in plaintext) with usage counters
• sessions.json - refresh tokens for dashboard sessions
• request-logs.json - per-user request metadata (no query content)

4.2 Security Measures

• API keys are SHA-256 hashed - plaintext keys are never stored or logged
• Constant-time comparison - token verification uses crypto.timingSafeEqual to prevent timing attacks
• SSRF protection - all outgoing requests are validated against internal IP ranges (127.x, 10.x, 192.168.x, etc.)
• Input validation - all API inputs are validated and sanitized at the boundary
• Rate limiting - per-key and per-IP rate limits prevent abuse
• HTTPS - all traffic is encrypted via TLS 1.3 in production
• Admin authentication - admin panel uses JWT with bcrypt password hashing
• No query logging - search queries and page content are never persisted

4.3 Infrastructure

The service runs on a single server via Docker Compose with three containers:

• Gateway (Node.js/Express) - API processing and authentication
• SearXNG - search engine aggregation (all queries processed locally)
• Page Reader (Python/FastAPI) - content extraction via trafilatura

No data leaves the server except: search queries forwarded to upstream search engines (Google, Bing, DuckDuckGo, etc.) via SearXNG, and HTTP requests to target URLs during page extraction.

5. Upstream Data Sharing

When you use the search API, your query is forwarded to upstream search engines (Google, Bing, DuckDuckGo, Brave, Wikipedia, etc.) via SearXNG. SearXNG acts as a privacy-respecting proxy - it does not forward cookies, does not use JavaScript tracking, and strips identifying headers. However, the upstream search engines may process your query according to their own privacy policies.

When you use the page-read API, the target URL is fetched directly. The target website's server will see a request from the gateway server's IP address, not your personal IP.

6. Data Retention

• Account data - retained while your account is active. Deleted upon account removal request.
• API keys - retained until revoked. Can be deleted via the dashboard at any time.
• Request logs - retained in-memory (buffer of 2,000 entries) and on disk. No query content. Rotated as buffer fills.
• Search results cache - LRU cache, max 1,000 entries. Search results expire after 5 minutes. Page content expires after 1 hour. Cache is in-memory only and resets on server restart.
• Email verification codes - expire after 10 minutes and are automatically deleted.
• Session tokens - refresh tokens expire after 30 days.

7. Cookies and Local Storage

The API itself does not use cookies. The dashboard and landing page use:

• sessionStorage - stores your JWT access token for dashboard session persistence. Cleared when you close the browser tab.
• localStorage - not used by default. The landing page may store a theme preference.

No third-party cookies are set. No tracking pixels or analytics scripts are loaded.

8. Your Rights

You have the right to:

• Access - request a copy of all data we hold about your account
• Deletion - request complete deletion of your account and all associated data
• Export - request your API key and usage data in a portable format
• Revoke - delete your API key at any time via the dashboard, instantly revoking access

To exercise these rights, contact us at iamnaime@builderhall.com.

9. Children's Privacy

The Service is not directed to individuals under 13 years of age. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

10. Changes to This Policy

We may update this privacy policy from time to material changes. The "Last updated" date at the top reflects the most recent revision. Continued use of the Service after changes constitutes acceptance of the updated policy. For significant changes, we will attempt to notify registered users via email.

11. Self-Hosting

AI Search Gateway is open-source software. When you self-host your own instance:

• You are the data controller - this privacy policy does not apply to your instance
• All data stays on your server under your control
• You configure your own authentication, rate limits, and data retention
• You are responsible for compliance with applicable privacy laws for your users

12. Contact

For privacy-related questions, data requests, or concerns:

• Email: iamnaime@builderhall.com
• Website: iamnaime.info.bd
• GitHub: github.com/fattain-naime/ai-search-gateway