DuckDuckGo

No search history, no browsing history, no IP address logged to disk — the core product is genuinely anonymous by design, not just by promise; IP addresses are used only transiently to deliver results and never stored alongside queries.

Never sold personal information — ever — and content is proxied through DuckDuckGo's own servers to prevent providers from profiling users; the one notable caveat is that ad clicks are managed by Microsoft's network, which has its own data practices.

Control is largely moot for core features because so little data is collected — there is no profile to access, download, or delete for search usage; for the limited personal data from optional features, deletion is explicit and newsletter unsubscription deletes the email address immediately.

The policy is short and specific because the underlying data model is genuinely minimal — that is itself a promise kept; the main structural limitations are US jurisdiction (Five Eyes), reliance on Microsoft's ad network commitments, and the absence of named independent security audits.