Privacy policy

metasearch.sh is operated by Paperfoot AI Pte. Ltd. (UEN 202450712K), 32 Pekin Street, #05-01, Singapore 048762 ("Paperfoot", "we"). We are the data controller for the personal data described here.

Account data. Your email address, used for sign-in links and service notices.

API usage. For each request: the query text or URL, the provider and mode, the response status, latency and cost, and the API key that made it. We keep this so you can audit your own usage and bills, and so we can meter accurately.

Organisation activity. Members of an organisation can see its usage, request log, balance and receipts, including requests made with keys other members created. Owners and admins also see its activity log, which records who did what: invitations, role changes, key changes, top-ups and changes to settings.

Network data. Limits on terminal sign-in use a one-way hash of the IP address, not the address itself. Each sign-in session records the IP address and browser it started from, for account security. A session lasts up to 30 days. Once it expires, our regular cleanup deletes it, with its IP address and browser.

Cookies. We set cookies only to keep you signed in. There are no analytics or advertising cookies.

Site visits. We count page views on this website ourselves, with no cookies and no third parties. For each view we keep the page, the site that linked to it, and a visitor id derived from your IP address and browser, which changes every day; the address and browser details themselves are discarded. If your browser sends Do Not Track or Global Privacy Control, we record nothing.

Payment data. Payments are processed by our payment provider; we never see or store card numbers. We keep the payment reference and amount needed to credit your balance, and your billing name, address and tax ID, as you enter them at checkout, for your receipts.

Each search query goes to the providers you name or, if you name none, to the ones we choose for the mode. The providers are currently Brave, Serper, SerpAPI, Exa, Jina, Linkup, Firecrawl, Tavily, Browserless, Perplexity, Parallel and xAI, and each processes the query under its own privacy terms. We send the query and its parameters, never your identity, email or key.

When you extract or scrape a page, the URL you send goes to the reader or browser service that fetches it (Jina, Firecrawl or Browserless), or our own server fetches it directly. In both cases the target site receives a request for that URL.

A ranking service helps us choose and order results. It receives:

• the query text, to choose or check the mode and to order results;
• each result's title, a snippet of up to 400 characters and its host, to order results;
• a fetched page's host and up to its first 3,000 characters, to judge whether the page is real content.

It never receives your identity, email or key, and its terms say it does not train models on what we send.

You can connect metasearch.sh to an AI assistant, such as a chat app, a coding agent or an editor, by signing in and approving it. The approval names the assistant and the organisation whose balance pays for its searches.

What the assistant sends us. Only the tool calls it decides to make: the query text, mode and filters for a search, or the address of a page to read, plus the token that identifies your connection. When it first connects, it also sends its name and the address we return you to after sign-in. We do not receive your conversation, your other messages or your files, except for whatever the assistant writes into a query.

What we keep.Each call is recorded like any API request, against a connected-app key on the organisation you chose: the query text or URL, the mode, the engines used, the status, latency and cost. Query text follows the organisation's retention setting described under Retention. Members of that organisation can see these calls in its usage and request log, as for its other keys. We also keep the approval itself (which assistant, which organisation, when) and the tokens that keep the connection working, until it is revoked or unused for 60 days.

What the assistant receives.The results, the page text and what each call cost, which the assistant's provider handles under its own privacy terms. It never receives your email address, your API keys or your payment details from us.

Ending a connection. Revoke an assistant in the dashboard under Settings, Connected apps, and it stops at once. Removing a member revokes the assistants they connected to that organisation, and closing your account revokes every connection.

Service providers process data on our behalf for hosting, the database, payments, sign-in and service email, and result ranking. Each is bound by a data-processing agreement and handles your data only to provide its service to us.

Your data is stored in the United States, and email is sent from the United Kingdom. We use providers bound to protect it to a standard comparable to the PDPA.

We don't sell personal data, run advertising, or use your queries to train models. There are no passwords: sign-in is by one-time email link. API keys are stored encrypted, and you can view a key again in your dashboard whenever you need it.

Account data is kept while your account is open; closing it anonymises the account. Expired sign-in sessions are deleted. When a request carries an idempotency key, its response is kept for 24 hours, so a retry with the same key gets the same answer, and is then deleted. The query text of each request is kept for 90 days and then deleted; the rest of the usage record stays with your billing history. An organisation's owners and admins can shorten this to 7 or 30 days, or stop storing query text, in Settings under Data & privacy. Answers may be kept for up to 7 days to serve repeat requests, and are deleted when you turn off query storage or close your account. Page views are kept for 400 days. Billing records, the ledger and receipts, are kept for five years, the period Singapore law requires.

Under the PDPA you may ask to see or correct your personal data, or withdraw consent, which may end the service for you. You may close your account yourself in Settings, which takes effect at once, or ask us to, which we do within 30 days. Either way we revoke your keys and anonymise the account, removing your email and other personal data from it. We keep only the billing records, for five years, as Singapore law requires and our terms set out. Write to support@paperfoot.com and we'll reply within 30 days.

If this policy changes materially we'll email account holders before the change takes effect. The current version always lives at metasearch.sh/privacy.