Privacy Policy

Last updated: November 13, 2026

This Privacy Policy explains what information DeepSearch collects, why, who we share it with, how long we keep it and the choices you have. It covers the website at deepxsearch.com and the DeepSearch mobile app (the “Service”).

1. Who we are

The Service is run by Arils AI (“we”, “us”), under the DeepXSearch name. We are the controller of the personal data described here. Contact us at support@deepxsearch.com for any privacy question or request.

2. Information we collect

Account information

A random account id. In the app it is derived from your device id with a one-way keyed hash, so the raw device id is never used as your account id. On the website it is an anonymous guest id created in your browser.
If you sign in: your email address and the sign-in method (Google or email link). We do not receive your Google password.
If you sign in with Google, Google shares your Google profile name and email address with Firebase Authentication, which holds them with your sign-in record. We use the email address as described here and do not show or use your Google profile name in the Service.
Whether your account is a guest, when it was created and when it was last used.

Searches and results

The text you search for, the follow-up questions you ask and the answers we generate.
The results we store with each search: possible matches, report text, cited public sources and their links, and images and snippets from those sources.
History and Saved: your past searches stay in History and the profiles you save stay in Saved until you delete them.
Private mode (website): a search made in private mode never appears in History and is deleted automatically 24 hours after its last update, unless you save it.
Your answers to “Is this the right person?”, answers you report and the reason you give.

Photos

When you run a photo search, your photo is processed in memory only to find matching public images. We never store the photo you upload: it is not saved in our database, our file storage, our logs or our notifications. History shows a similar public photo from the results, never your photo. We do not use face recognition and we do not create face templates.

Consent and settings

When you agreed to the use of third-party AI providers for your searches, and when you accepted these policies.
Your notification preference (for example, whether you want offers and news).

Purchases

Your subscription status, products bought, store (Google Play or Stripe), purchase and expiry dates, store transaction ids and your credit balance and its history. We do not receive or store your full card number; card payments on the website are handled by Stripe.

Device and app information

App version and build, platform (Android, iOS or web), language, region and time zone that your device or browser sends with each request.
Your IP address, used for security, abuse prevention and rate limits. We do not store it with your account.
A push notification token if you allow notifications, with its language, country, time zone and app version.

Analytics, crash and attribution data

In the app: Google Firebase Analytics (usage events such as screens viewed and actions taken), Firebase Crashlytics (crash and error reports with device model, OS version and app state; we do not include your searches, email or tokens in crash reports) and Firebase Remote Config. If attribution is enabled, Airbridge measures which campaign led to an install and may use your device’s advertising id where your device settings allow it. When you are signed in, the app also sends Airbridge a hashed (one-way encoded) version of your email address so that installs and purchases can be matched to campaigns without sending the email address itself. You can reset or turn off the advertising id in your device settings.
On the website: Google Analytics 4 measures visits and how the site is used: pages viewed, events such as starting a search, referrer, device and browser type, and approximate location derived from the IP address. Outside the EU, the EEA, the UK and Switzerland it uses first-party cookies (_ga and _ga_<id>) to recognize a returning browser. In the EU, the EEA, the UK and Switzerland, Google Consent Mode sets analytics and advertising storage to denied by default: Google Analytics does not set or read cookies or similar identifiers in your browser, and Google receives only cookieless signals (such as the page and the event, without a cookie id) that it uses for aggregated measurement. To opt out anywhere, block or delete cookies for deepxsearch.com in your browser, use a content blocker, or install the Google Analytics opt-out browser add-on. We do not use Google Analytics data to show you ads or to build advertising profiles.
Mixpanel on the website: when it is turned on, Mixpanel receives the same events as Google Analytics (pages viewed by path, without the address’s query string, and events such as starting a search, with no search text, names or email addresses) together with your account id (a random id, never your email or name), device and browser type and, outside the EU, the EEA, the UK and Switzerland, approximate location derived from the IP address. Outside those regions it keeps a random browser id in your browser’s local storage (no cookies). In the EU, the EEA, the UK and Switzerland, Mixpanel stores nothing in your browser, does not use the IP address for location, and the id it uses is lost when you close the page. When you sign out or delete your account, the Mixpanel id in your browser is reset. To opt out, block mixpanel.com with a content blocker. We do not use Mixpanel data to show you ads or to build advertising profiles.
Browser storage on the website: your sign-in session (stored by Firebase Authentication in your browser), your private mode setting and short-lived technical keys that stop a payment or search from being repeated. These are needed for the website to work.

Messages to us

If you send feedback or email us, we keep your message, its category and any screenshot you attach. Feedback screenshots are deleted after 90 days.

3. How we use information

To run the Service: create your account, run your searches, keep your History and Saved, apply your credits and subscription, and sync them between the app and the website.
To keep the Service safe: verify that requests come from our genuine app or website (Firebase App Check with Play Integrity, App Attest or reCAPTCHA Enterprise), limit requests, prevent abuse, fraud and duplicate free credits, and enforce our Terms, including refusals for minors, explicit content and private data.
To send notifications you allowed: that a search is ready and, if you have not turned them off, offers and news. You can turn off offers in Settings or in your device settings.
To understand and improve the Service: measure usage and errors, compare search providers by cost, speed and failures (without your account id or search text), and handle feedback and reports.
To meet legal obligations, such as tax and accounting rules for purchases, and to answer lawful requests.

Legal bases (EU, EEA, UK and Swiss users). We process data to perform our contract with you (running the Service, purchases); on our legitimate interests in securing, measuring and improving the Service and preventing abuse; on your consent where the law requires it (third-party AI processing of your searches, marketing notifications, the advertising id; in the EU, EEA, UK and Switzerland analytics cookies stay off because no consent is collected for them); and to comply with legal obligations. You can withdraw consent at any time; this does not affect processing before the withdrawal.

We do not sell your personal information and we do not share it for cross-context behavioral advertising.

We share information only with service providers that process it for us under contract, and only as needed for the purposes above:

Cloudflare (hosting, database, file storage, network security, request logs and AI Gateway). AI Gateway does not store the content of requests.
Google Firebase (Authentication, which holds your sign-in record and, for Google sign-in, your Google profile name and email address; App Check, Cloud Messaging for notifications, Analytics, Crashlytics, Remote Config) and Google Analytics on the website. reCAPTCHA Enterprise checks website requests.
Mixpanel (product analytics on the website, when enabled): the events and ids described in section 2.
RevenueCat (subscription and purchase management), Google Play (in-app payments) and Stripe (card payments on the website). They receive your account id as the customer id and your purchase details; Stripe also receives your payment details and email.
Airbridge (app install attribution, when enabled). It receives the advertising id where allowed and, when you are signed in, a hashed version of your email address.
Search and AI providers. To answer a search, we send the search text, follow-up questions, the addresses of public pages and the text we read from them to one or more of these providers, depending on how the Service is configured at the time: OpenAI, Google (Gemini and Cloud Vision), Anthropic, xAI, DeepSeek, Perplexity, Exa, Tavily, Brave Search, Serper, SerpApi, HikerAPI (public Instagram profiles) and People Data Labs (public work and education history). For photo search, the photo is sent only to the visual search providers (Google Cloud Vision, and SerpApi for Google Lens) for that search. We do not send your email address or account id to search and AI providers.

We may also disclose information if the law requires it, to protect the rights, safety or property of our users, the public or us, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information.

5. Information about people who are searched

Search results contain publicly available information about the person searched, collected from public web pages and public profiles through the providers above. We do not collect private data on purpose: we refuse searches about minors, explicit content and private data, drop private profiles, dating-app and people-finder pages, and remove email addresses, phone numbers and street addresses from results. Stored results stay in the History of the user who ran the search until that user deletes them or their account. Results we show to everyone (Trending) cover public figures only.

If you believe a result about you is inaccurate or should not be shown, you can object or ask us to correct or remove it at support@deepxsearch.com.

6. How long we keep information

Account, History and Saved: until you delete them or your account.
Private-mode searches: deleted automatically 24 hours after their last update, unless saved.
Your photo: never stored; it exists only in memory during the search. If a provider needs a link to the photo, a copy is kept for at most a few minutes behind a link that expires after 2 minutes and is then deleted.
Feedback screenshots: 90 days.
Sign-in and handoff codes: 5 minutes. Rate limit counters: up to 24 hours.
Push tokens: until you turn off notifications, sign out, delete your account or the token stops being used.
Provider usage records: we keep cost, speed and error records for each provider call without your account id or search text.
Server logs: kept by Cloudflare for a few days for security and debugging.
Account deletion: when you delete your account, we delete your account data right away and finish within 30 days, including retries if a step fails. Copies in database backups expire within 30 days. We keep only what is needed to prevent fraud and meet legal duties: store transaction ids for credit packs without your account id (so a credit pack cannot be granted twice), a one-way hash of the device id so free credits are not granted twice, and purchase records that tax and accounting laws require. Your customer record at RevenueCat, Google Play or Stripe is kept under their policies; ask us at support@deepxsearch.com and we will request its deletion.

7. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict processing, to withdraw consent, and to complain to a data protection authority. California residents have the right to know, delete and correct personal information and not to be discriminated against for using these rights; we do not sell or share personal information as those terms are defined in California law.

Delete your account: in the app under Settings › Delete my account, on the website under Settings › Delete my account, or by emailing support@deepxsearch.com from the address on your account. See Delete your account.
Delete searches: delete one search or all History and Saved at any time in History.
Notifications: turn off offers in Settings, or all notifications in your device settings.
Analytics and advertising id: see section 2.
Other requests: email support@deepxsearch.com. We may need to confirm your identity. We answer within the time the law requires (for example, one month in the EU and UK).

8. Children

The Service is not for anyone under 18 and we do not knowingly collect data from children. We refuse searches and remove results about people who appear to be under 18. If you believe a child has used the Service, contact support@deepxsearch.com and we will delete the account.

9. International transfers

We and our providers process data in the United States and other countries that may have different data protection laws from where you live, including providers based in China (DeepSeek) when they are used for search processing. When we transfer personal data out of the EU, the EEA, the UK or Switzerland, we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses (with the UK addendum where needed) and additional safeguards.

10. Security

We protect data with encryption in transit (HTTPS), access controls, app and website verification, rate limits and keyed hashing of device ids and codes. No system is perfectly secure; tell us at support@deepxsearch.com if you find a security issue.

11. Changes to this policy

We may update this policy. We will post the new version here with a new effective date and, for material changes, tell you in the app or on the website before they apply.

12. Contact

Arils AI. Email: support@deepxsearch.com.