Search in private.Built in the open.

Some things people type into search boxes:

• chest pain left arm only at night
• can my landlord evict me for one late payment
• early signs of dementia in a parent
• how to leave a controlling relationship
• bankruptcy lawyer near me

Each of those is sent to a company's server along with the IP address it came from, and usually kept. Once it's kept, it can be used for ads, leaked in a breach, or handed over to anyone who asks with the right paperwork.

Privacy-focused search engines promise not to keep your searches, and a lot of them keep that promise. The search still leaves your computer, though, and what happens to it after that is out of your sight.

We wanted a search engine we wouldn't have to trust. So we're building one.

For some people a search log isn't embarrassing, it's evidence:

• "acme holdings" cayman subsidiary director
• "q3 remediation plan for the riverside plant"
• legal observer rights at a protest

The first shows what a reporter is investigating, months before it is published. The second is an exact phrase from an internal memo, and searching for it shows that you have the memo. The third shows what someone is planning. A search company holds logs like these next to your IP address, where they can be requested with a court order, demanded quietly, leaked or sold, and you won't necessarily be told.

We can't hand over your searches. We never receive them.

Burrow protects the search itself. Your own device and the websites you open are still up to you, so read what it doesn't protect before relying on it.

What it doesn't protect, and a safer setup →

A search engine that has no way of seeing what you search for.

That means changing where the search happens, not writing a better privacy policy. We do the parts that need the internet: crawling, ranking and building the index. Then we give you the whole index, and you search it on your own computer. There is no search server to send a query to.

It's an experiment, and it has costs. Your index is smaller than Google's, and it's only as fresh as your last update. We want to find out how good search can get within those limits.

We crawl the web, build an index from it and sign it with our key. You download that file from us, a mirror or anywhere else, since the signature proves it's ours whichever route it took. After that, searching is a lookup in a file on your own disk.

The whole process, step by step →

How the code makes sure of this →

Whoever builds a pack decides what you can find. A signature proves who made a pack, not that their choices are good or neutral, and one publisher is a weak spot even if it's us. The crawler and indexer are open too, so we want other people to publish packs:

• a language or country our crawl barely reaches
• a field done properly: medicine, law, a programming ecosystem
• fewer, better sites, with more of each
• a different rule for which pages get in, like small sites before big ones
• a pack updated daily instead of now and then
• a newsroom's or a library's own selection

Run our crawler or write your own, sign the result with your own key, and publish it.

How to build and publish a pack →

On Linux, unshare -rn runs a program in a sandbox with no network interfaces at all. Search works in it, because it never needed the network:

$ unshare -rn local-search -n 1 "rust ownership"
1. Rust (programming language) - Wikipedia
   https://en.wikipedia.org/wiki/Rust_(programming_language)
   … The ownership system was in place by 2010. …

The code is open, so you can read it and build it yourself instead: source on GitHub.