If API keys are required how is this truly private? Either you get your own keys and loose privacy or you use someone else's service which brings you right back to what you get with any other search engine.

Fair point. This occurred to me as well after doing my initial post (follow up below).

It appears the linked searx.me is just a deployment of the open source searx project, and probably will reach the limit.

It's interesting, if their claim of " while not storing information about its users" is totally true, I guess request limits would be impossible without at least tracking the originating IP?

They could limit requests by IP without storing them explicitly.

They could use something like a count-min sketch to store how many requests a certain IP has executed, and clean the sketch every minute, for example.

The limit would not be exact, though.

It does not seem to be limiting incoming requests by IPs. So IPs does not need to be stored anywhere.