Privacy policy

Who operates this service

Belweave, based in Virginia, USA, operates searchsdk.dev and is responsible for the personal information processed through this website. Contact info@belweave.com for privacy questions or requests.

This policy covers the website, live playground, and public documentation MCP endpoint. When you install the open-source SDK and run it in your own application, your application controls its data handling. The SDK does not send telemetry to Belweave. Search providers, GitHub, npm, and other linked services have their own policies.

Live searches and provider keys

When you run a live search, your browser sends your query, selected provider, result limit, and that provider’s API key to our server over HTTPS. If you choose a backup, its identity and key are included too. We use this information to perform the search you requested and return results and an attempt trace. A backup receives the query and its own key only if a qualifying failure triggers fallback.

The application processes keys and queries in memory for the request. It does not write them to a database, application logs, cookies, or browser storage. Search responses are not cached by the application and are sent with no-store headers. Key fields clear on submission and when the page is left; queries and results remain visible in the current page until replaced or the page is closed. Memory is released through normal runtime cleanup; this is not a guarantee of immediate secure erasure.

The selected provider receives your query and authentication key and processes them under its own privacy, retention, and account terms. Search results may contain personal information or third-party content. Submit only information and credentials you are authorized to use. Do not include sensitive personal information in test queries. Cancelling or closing the page cannot retract information already received by a provider.

Connection data and abuse prevention

Vercel hosts the site and server endpoints. Hosting infrastructure processes connection and request metadata, such as IP addresses, requested paths, timestamps, user-agent information, response status, and timing, to deliver and protect the service. Infrastructure logs are separate from application logs and follow the hosting provider’s configuration and retention practices. Our application does not deliberately include query text, keys, or result bodies in logs.

The playground keeps temporary, salted hashes derived from provider keys, with request counts and active-request counts, to limit abuse. The public MCP endpoint similarly uses salted hashes of connection addresses. These bounded records are held in a running server instance, become eligible for removal after their rate-limit window, and are cleared when that instance ends. They are not a saved search history or a cross-service tracking identifier.

The public MCP endpoint accepts documentation requests and returns bundled public documentation, provider descriptions, and examples. It does not perform provider searches, require an account, or accept API credentials. Do not include private information in documentation searches.

Browser storage and analytics

We store your appearance choice in local storage under searchsdk-theme so the site can remember System, Light, or Dark. This preference remains until you change it or clear site data. It is not sent to our server. The site works when local storage is unavailable.

The current application does not set advertising cookies or embed third-party advertising or analytics scripts. Fonts and site assets are served with the site. We do not sell personal information, share it for cross-context behavioral advertising, or use playground searches to build advertising profiles.

Why we process information

We process requested searches to provide the service you choose to use. We process limited technical information to operate the website, prevent abuse, diagnose faults, and protect users. We use messages you send us to respond to your questions and handle requests. We may also process information to comply with applicable law and establish, exercise, or defend legal claims.

Where European or UK data-protection law applies, our bases are performance of a requested service or contract, our legitimate interests in operating and securing the service and responding to communications, and compliance with legal obligations, as applicable. Where consent is legally required for a particular use, we will request it before that use. You may object to processing based on legitimate interests.

Recipients, retention, and transfers

Information is processed by Belweave, Vercel as hosting infrastructure, the providers you select for a live search, and communication providers when you email us. We may disclose information when required by law or where reasonably necessary to protect rights, security, or the service. If the service changes ownership, information may be transferred subject to applicable law and appropriate notice.

Application search data is transient as described above. Theme preferences remain in your browser until cleared. We retain correspondence only as needed to resolve the request, maintain necessary business records, and meet legal obligations; relevant records may be retained longer for a dispute or legal requirement. Provider-side and hosting-infrastructure records follow their respective retention practices. Deleting a browser page does not delete a provider’s records.

Belweave operates in the United States, and hosting and search providers may process information in other countries. Data-protection laws may differ from those in your location. Where applicable law requires safeguards for an international transfer, we use the required safeguards, including appropriate contractual protections. Contact us for information about a transfer relevant to your request.

Your choices and rights

You can use the documentation and fixture demo without supplying provider credentials. You can clear keys from the playground, clear your browser’s site data, stop using the service, and manage or revoke keys in your provider account.

Depending on your location and applicable law, you may request access, correction, deletion, portability, or restriction of personal information, object to processing, withdraw consent where processing relies on it, and appeal a privacy-request decision. Email info@belweave.com with your request and enough context for us to locate relevant information. Do not email API keys or sensitive identification documents. We may request proportionate verification and will respond within the applicable legal period. We will not discriminate against you for exercising applicable rights.

You may complain to your local data-protection authority. If we decline a request and an appeal right applies, reply to our decision asking for an appeal. We cannot delete information held independently by a search provider; contact that provider about its records.

Security, children, and policy updates

We use HTTPS, request limits, restricted provider destinations, response bounds, and credential-redaction measures. No online service can promise absolute security. Report a suspected exposure to info@belweave.com without including the exposed credential, and revoke that credential with its provider.

The service is intended for adults developing software, not children. We do not knowingly collect personal information from children under 13. Contact us if you believe a child has submitted personal information so we can address it.

We may update this policy as the service or applicable requirements change. The date above identifies the current version. We will provide additional notice of material changes where required by law.