Since the userbase consists largely of people who pay them to not act like google, at least for now, it likely would be an existential threat to the firm. They couldn't get much worse in that regard than big free services, so I'll cross that bridge when I come to it. In the interim, I'm putting my money where my mouth is and paying out of pocket for a really good service. The results are consistently more useful than Google's and the tooling is much much better. So if they are invasively tracking me and selling my data, you can definitely say "i told you so" but maybe we should call off the firing squad until the verdict has been reached. We currently don't have a trial, charges, a crime, evidence, or even empirically-driven suspicion.
One of the best historic examples is MySpace. MySpace started out fine and slowly as it declined and eventually dwindled to nothing, it started selling off massive amounts of previous user data. With no future or user base to speak of, there was a lot more potential benefit selling the data than the cost of protecting/holding it.
Unfortunately these days I won't be surprised to hear of fuckery from them. It's happened too many times.
All things said, I think Kagi really as the incentives aligned. I'm not a fan of Kagi but I believe the "business is sound" :) Sure, I also believe there's no need for such a business (an extension or whatever would suffice), but that doesn't really matter here nor there.
Who would they sell the data to? Google? Ohhhh noooooo...
More seriously, as long as it's paired with a "But their search results are still better than Google's trashfire", I'm not sure it would matter. Their tagline is "Fast, accurate, and ad-free", not "Fast, accurate, ad-free, and private."
"We care about data protection: We will be good stewards of any personal information you share with us. We do not log or associate searches with an account. More at our privacy policy."
literally on the main page. Smh.
If Kagi became a bad actor with my data, that would just make them like the majority of other search engines, so big picture, I'd not be any worse off. And I'd still have access to a search engine that lets me find what I'm looking for without a lot of struggle.
That said, if we did lie or change that, we'd be in immediate breach of our privacy policy (https://kagi.com/privacy), and as a result be a very easy target for a lawsuit. Given that we're not intentionally not VC backed, between the horrible press this would be and the actual costs of fighting such a lawsuit, I expect not much would be left of Kagi afterwards. We are liable to users, in a pretty existential way.
Your privacy policy has lots of feel-good language that actually doesn't mean anything - along the lines of the classic "We value your privacy" statement that firms often make. When you analyze it, you find it means nothing. There are no actionable clauses. For example, if you are in breach of "Anonymous logs are aggregated with GCP's logging tools, retained for 30 days." what are the enumerated damages? A counter-party would have to prove show BOTH that you are in breach AND then real damages , which is difficult in this case, and entirely misses the point. E.g. if you sell 1M user data records for $.001 each, and a user has on average 10 records on them, the real damages are $.01, but your firm made $100k on the transaction. I don't see a limit to class action (or forced arbitration) so that's good; but good luck building out that class - especially since you'll resist sharing user data with the class action plaintiff, using the same privacy policy as a shield!
(This is the other trick of privacy agreements, apart from not actually saying anything: the stuff that is measurable is unenforceable).
It's time that the public stop seeing moonbeams and rainbows in these matters. Do you think that a lender will be satisfied with a debtor statement "I value paying back my debts, and will never be late!"? If not, then why are we mollified by similar statements by software firms made to us? What is measurable has no teeth; what has teeth is not measurable.
It's a very dirty trick.
To do so requires a kagi user account, which I don't have and don't want. It also requires knowing your issue organizational schema to find privacy policy related "bugs" and "features". If you are serious about taking feedback, consider taking the content of this thread to BE that feedback, and do the work of adding it into your bug tracker yourself, with links back to this thread.
And also, I am not a lawyer, and neither are you, so I'd consider hiring one to revise the policy with an eye toward increasing your liability for the right reasons.
As it is, we only believe that "users paying for services" will protect against data exfiltration because of very naive reasoning, or, perhaps more accurately, praying.