Privacy policy

Exactly what data we collect when you search, when you build with our API, and when you pay for the service — and what we never touch.

arlong (Arlong.org) is a hosted, closed-source web-retrieval and AI-search service operated by the co-founders Ahilan VP and S Sushant. This policy describes our data practices across the consumer search experience, the API / MCP service, the Playground, and billing. The short philosophy: collect enough to run and secure the service, and nothing more.

Short version: Anonymous searches are not logged. Account data — your email, username, hashed credentials, API keys, and usage — is collected only to operate your account and the service. Payment cards never touch our servers — Dodo Payments handles all billing. Product Analytics is limited, timelimited, and can be disabled in Settings. We do not sell data, show third-party ads, or run tracking pixels.

Anonymous (logged-out) search

You can search on the public interface without an account. In that mode no search history is stored, and there is no per-request association between your device and the queries you make.

No query logging. Query text is forwarded to upstream search providers in memory and is not written to a persistent store on our side.
No IP logging. Your IP address exists transiently in server memory for the duration of a request and is not persisted. Optional country detection is performed on your machine via ip-api.com; the returned country code is cached in your browser session and never sent to us.
No user-agent or fingerprint logging. We do not parse, record, or analyze browser fingerprints or user-agent strings.
No tracking cookies. The public site sets no advertising or analytics cookies.
Aggregate statistics. We retain aggregate counters (for example, total searches per hour) used for capacity planning and public status pages. These are bare integers with no link to any user, IP, or query.

Accounts & sign-in

Accounts are optional for consumer search but required for API-key access and paid plans. You can sign up with a username and password, or via Google OAuth.

Username and email. Your username is stored. Email is stored if provided at signup or obtained from Google (needed for billing, receipts, and account recovery).
Passwords. Passwords are salted and hashed with Werkzeug (PBKDF2-SHA256). We never store passwords in plain text, and your plaintext password is never visible to us.
Security question. Account recovery uses a security question; your answer is stored only in hashed form.
Google OAuth. If you sign in with Google, we receive the name, verified email, and OAuth identifier from Google in accordance with Google's policies. You can remove Google sign-in access at any time from your Google account settings.
IP hashes. To deter spam and duplicate-account abuse, community actions store a SHA-256 hash of the originating IP (partial hash only; the full IP is never stored or logged).
Session cookie. Once signed in, a small encrypted session cookie (Flask session) is set to keep you logged in. It contains no personal data beyond a signed reference to your session.

API keys, usage & credits

When you create an API key, we store the key (a random al_... token), its label, creation date, last-use date, aggregate request counts, and current status so we can authenticate you and apply limits.

One credit balance is shared across the Playground, REST API, and MCP.
Usage records. Each API and Playground call deducts from your credit balance and is recorded in an internal ledger (account, feature, timestamp, credits consumed). Ledger data is used for enforcement, anti-abuse, and troubleshooting. Search query content and extracted page content submitted or returned through the API are not used to profile you.
Rate limiting. Per-key and per-IP request windows (e.g., the 30-minute request window and tokenless hourly limits) are tracked transiently in memory for rate limiting. Request totals are retained as integers; individual request payloads are not retained as a history.
Regeneration. You can regenerate or revoke a key at any time from the API dashboard.

Product Analytics

Product Analytics is a minimal, opt-out-respecting, time-limited event log used to improve the product. Each event records only: user reference, a generic feature category (e.g., search, mcp_request, billing_opened), a status, and a timestamp.

Not recorded: prompts, queries, URLs, page content, IP addresses, user-agent strings, or API key values.
Retention: events are discarded after 90 days, and the log is capped at the 50,000 most recent records.
Opt-out: you can disable non-essential Product Analytics at any time in Settings. The toggle only affects this feature log — necessary security, billing, fraud-prevention, and service-operation records continue to be processed as described in this policy.

Data point	Collected?	Details
Card or bank details	No	Payments are processed by Dodo Payments, our merchant of record. We never see or store your full card or bank details.
Search query text (anonymous)	No	Forwarded to upstream providers in memory; never persisted or linked to you.
IP address (full)	No	Only partial SHA-256 hashes are stored for community/anti-spam use; the full IP is never logged.
Username / email / hashed password	Yes	Required to operate your account, authenticate API calls, and issue receipts.
API keys + usage ledger	Yes	Key tokens, labels, request counts, credit deductions, timestamps. Needed for auth, limits, and billing.
Billing identifiers & subscription status	Yes	Plan, subscription status, renewal dates, and usage allowances from Dodo Payments — to deliver what you paid for.
Product Analytics events	Opt-out	Feature + status + timestamp, 90-day retention, 50k cap. Disable in Settings.
Playground chats & support messages	Yes	Chat content you author and support-ticket content you submit are stored to provide the service and respond to you.
User-agent / fingerprints / tracking cookies	No	Never logged, parsed, or fingerprinted. No third-party ad or tracking tags.

Billing & Dodo Payments

Recurring subscriptions and credit packs are billed by Dodo Payments, which acts as payment processor and merchant of record. Dodo displays the final local currency and applicable taxes at checkout, collects your payment method, and processes recurring charges.

We retain only the billing identifiers Dodo returns — subscription status, plan, current/next billing-period dates, and usage allowances — so we can grant access and reset allowances on the correct cadence.
Your full payment details live with Dodo under Dodo's policies, not with us.
Included-usage allowances reset each billing period and do not roll over; prepaid credit packs do not expire and are consumed after included credits.

Playground, AI chats & support

If you use the Playground or file a support ticket, content you submit is stored so the feature can function:

Playground / AI chats: your prompts, the model's grounded responses, and retrieved source sets are stored per account so sessions can be resumed and audited. You can delete individual chats from the workspace. We do not use your chats to serve ads or train external models by default.
Support tickets: when you contact support, we store your name, email, message, and category so we can respond. Ticket content is visible only to you and our operator unless you include it publicly.

Search-result caching

To keep results fast, some retrieval responses are cached with a short TTL in memory (for example, quality verdicts cached for 15 minutes, places/geo data for up to 90 days). These caches store public search data keyed by request, contain no personal data, and expire automatically. Result caches are never used to build a profile of you.

Data sharing & third parties

We do not sell, rent, or trade personal data. We share data only as needed to operate the service:

Upstream search providers (DuckDuckGo, Bing, Google, and similar) receive queries we forward on your behalf for anonymous or account searches.
Dodo Payments receives payment and tax information for completed purchases and recurring billing.
Google receives your OAuth handshake when you choose Google sign-in.
Hosting provider (Vercel and object storage) stores encrypted runtime data; access logs, where generated at the infrastructure layer, are ephemeral and subject to the provider's policies. We do not read, store, or export them for analytics.
Required disclosures only: we may disclose data if we believe in good faith that it is required by law, regulation, or a valid legal process, or to protect the rights, property, or safety of the service, our users, or the public. Because we retain limited data, our response to such requests is correspondingly limited.

Data security

Passwords and security-answer hashes are salted and hashed with PBKDF2-SHA256.
API keys are random, revocable, and stored only where needed to authenticate requests.
All traffic to Arlong.org is served over HTTPS/TLS.
Runtime identity and audit signatures are derived from a server-held secret; Dodo and infrastructure credentials never appear in user-facing responses.

Retention

Product Analytics: 90 days, capped at 50,000 events.
In-memory caches: minutes to 90 days, automatic expiry.
Account records (profile, keys, ledger, subscriptions, chats, tickets): retained while your account is active, and for a reasonable period afterward that is required for billing, tax, or fraud-prevention obligations.
You can delete chats at any time; request full account deletion by emailing us and we will remove what we can, subject to legal retention obligations.

Your rights

Depending on your jurisdiction (including GDPR in the EU/EEA/UK and CCPA in California), you may have the right to:

Access the personal data we hold about you.
Correct inaccurate data (you can update your profile and settings directly).
Delete your data or account (email us or use account deletion in Settings where available).
Object to / restrict processing, including disabling Product Analytics in Settings.
Portability: request an export of the account data we hold.
Complain to your local supervisory authority (EU/EEA/UK residents).

To exercise any right, contact us at ahilan290@gmail.com and we will respond within the period required by law.

Children

The Service is not directed to children under 16 (or the applicable age of digital consent in your region). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy to reflect changes in the product or the law. We will update the date below and, for material changes, note them in the changelog. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Last updated: September 27, 2026

Contact

Questions about this policy, your data, or a privacy concern? Email ahilan290@gmail.com or reach out on Reddit at u/PeaceThrough.