We do use CloudFlare for our CDN, DNS name server, JavaScript caching, and DDoS protection. We're not planning to move off of CloudFlare any time soon, but we've worked with them to ensure that they do not store user queries in their logs (completely masked out), they redact the last part of user IP addresses so no individual IP address is stored while keeping the benefits of bot detection and DDoS protection, and their javascript analytics tracker is turned off so there shouldn't be anything CloudFlare client-side.
Thanks again for the time you took looking into all this! It's great to have people out there that care enough to look and report what they find. Much appreciated.
Care to explain what exactly you saw as I am curious (Kagi dev here, and no, we don't make such requests - likely to be your browser extensions).
I have advanced blocking in uBlock Origin and all 3rd party scripts are blocked by default. Not sure how DDG came there (maybe because I came to Kagi through it?), but I have checked agsin and for CF it says:
d33q65j1hc8iiu.cloudfront.net
assets.kagi.com
I assume you are using CloudFlare as CDN for your assets (can't check right now)? If so, it is a weird decision for a privacy focused search engine. Of course there are degrees to privacy, but CF is too big to be trusted imho.
EDIT: no, no extensions apart from UBO. :)
Would be nice if you double-chcecked both claims before making allegations publicly (or at least contacted us for clarification) as we do not have the resources of a big company to right all the wrongs said about us.
Everything about Kagi and privacy is available at kagi.com/privacy
If it matters, you sure made the mark for me, and I will definitely check out the engine further.
EDIT: you.com does better on the first page, but then they leak data to CloudFlare and Google via 3rd party JS on FAQ page. Come on.
EDIT2: qwant.com looks promising, thank you for the tip!