Our Privacy Policy
We created Startpage to help you search and browse the internet privately. Not because you have something to hide, but because you have a lot to protect!
We blazed the trail in 2006, and protecting your privacy is now more important than ever.
Protecting your privacy is all about having control over your data. At Startpage, we help you control and protect what’s yours.
When it comes to privacy, it's not just our policy. It's our mission!
Contents
We don't collect any "personal data"
If information isn’t collected, it can’t be stolen, demanded, leaked or abused. Protecting your personal data is the best way to safeguard your online privacy.
How we define "personal data"
Our definition of personal data is based on the privacy laws and regulations of the EU, including the General Data Protection Regulation (GDPR). These are widely regarded as the strongest privacy protections in the world. We consider any information about you or your behavior that can be traced back to you as personal data.
Information we don’t collect
So let’s be perfectly clear:
- We don’t record your IP address
- The only exception is for automated search requests (robots) that rapidly submit more queries to our servers than any normal human would. When our software detects potential abuse, we register and block the offending IP address in order to keep our service safe and free.
- We don’t serve any cookies that track you or your behavior.
- This is about "good" and "bad" cookies. Cookies are small pieces of data that are sent to your hard drive by websites you visit. "Bad" cookies have unique elements that can track all kinds of personal information. We don’t serve any of those. Startpage uses just two kinds of "good" cookies. We serve a "preferences" cookie to help us remember search preferences you choose. This cookie expires after not visiting Startpage for 90 days. We also use cookies to verify that you’ve passed a security check, like a CAPTCHA, so you're not repeatedly challenged. This protects Startpage from automated abuse and expires within seven days. None of your personal data is stored in any of our cookies.
We don't record your search queries
When you search, your query is automatically stripped of unnecessary metadata including your IP address and other identifying information. We send the anonymized search query to our search and content providers and return the search results to you. We don’t log your searches.
To prevent abuse such as robotic high-volume querying, we anonymously determine the frequency of popular search keywords as a part of our anti-abuse measures, while protecting your privacy.
How we have implemented truly anonymous analytics
We do measure overall traffic numbers and some other – strictly anonymous – statistics. These stats may include the number of times our service is accessed by a certain operating system, a type of browser, a language, etc., but we don’t know anything about individual users.
How we keep Startpage free without using "personal data"
Most online advertising today is personalized, meaning that online advertising services track what you do online and profile you in order to serve tailored ads. We don’t do that at Startpage. No tracking. No profiling!
Our search result pages may include a small number of clearly labeled "sponsored links," which generate revenue and cover our operational costs. Those links are retrieved from platforms such as Google AdSense. In order to enable the prevention of click fraud, some non-identifying system information is shared, but because we never share personal information or information that could uniquely identify you, the ads we display are not connected to any individual user.
It’s a myth that search engines need to profile you in order to earn decent money. Startpage serves strictly non-personalized ads. Sure, our ads make only a fraction of what other search engine ads make, but they pay all our bills.
What happens to your data beyond Startpage search
Startpage returns results from various sources. Once you click on a search result, you leave our site and our privacy protection. This is true for sponsored links, search results and other external links. Unless ... you use our proprietary feature "Anonymous View" – shown next to the search results. This is a great privacy tool that allows you to continue to browse in full privacy.
For example, many video results are retrieved from YouTube API Services. Once you click on a YouTube video result, you will be sent to www.youtube.com, and be subject to the Google Privacy Policy.
How we respond to governmental requests for data
They can’t request what we don’t have. Any request will have to come from Dutch judicial authorities. We’ll only comply if we’re legally obliged to do so. But we’re not likely to receive requests by governments to hand over user data – simply because we don’t have any.
We will never comply with any voluntary surveillance program
Fortunately, we are based in the EU, where we have strong laws that protect your right to privacy. European governments can’t legally force service providers like Startpage to implement a blanket spying program.
Startpage complies with the GDPR
We are located in the EU, and we fully comply with applicable privacy laws and regulations of the EU, including the General Data Protection Regulation (GDPR). These are widely regarded as the strongest privacy protections in the world.
Looking for a quick win to improve your own GDPR compliance? Setting Startpage as the default search engine on all your organization’s IT equipment will help you minimize the amount of personal data that is processed by or for your organization. This can also help you implement important privacy principles, such as data minimization, storage limitation, privacy by design and privacy by default.
In the EU you have a "right to be forgotten"
Citizens in the EU have the right to request the deletion of search results that disclose their personal data when those results are inaccurate or no longer relevant. Find out how we have implemented this right here.
Dutch Data Protection Authority
We are always here to help. If you have any feedback or complaint about our services in general, or more specifically about how your privacy is protected when you use our services, please let us know via the contact details below. In accordance with EU privacy laws and regulations, you have the right to lodge a complaint with the national supervisory authority responsible for the protection of personal data if you think we have unlawfully processed your personal data. For the Netherlands, this supervisory authority is the Dutch Data Protection Authority, which you can contact here.
The Startpage Private Browser app
The Startpage Private Browser app for iOS and Android uses Startpage as its default search engine. Search queries are not collected, stored, or shared with third parties. While using the app, your privacy is now enhanced beyond what we have been able to offer on the www.startpage.com website, in that the third-party websites you visit within the app are not tracked, whether in a Regular or Private tab. Your browsing history is only available to you, on your own device. Your search and browsing history are not stored in our server logs. Additionally, within the app, we offer the option to utilize Anonymous View for browsing, allowing you to maintain anonymity to the third-party websites you visit, if desired.
Diagnostic reports
If the Startpage Private Browser app crashes or freezes, a report is sent to us to assist us in identifying and resolving the issue. This report may include technical details about the device and what triggered the problem, but does not include personally identifying information (like your IP address). We utilize a service called Sentry to store these reports.
Product analytics
Anonymized analytics within the Startpage Private Browser app alert us when there are major product issues or outages, and help inform what enhancements may be needed to improve the experience. The analytics do not include personally identifying information (like IP address), or information about your searches or browsing activity. Example anonymized analytics are total number of installs, volumes of usage, errors, downtime, or whether new features are being used.
Product event analytics are powered by a service called Amplitude, and when this service is being used, data is proxied through servers managed by Startpage to ensure that personally identifying data is stripped before making its way to the service. The analytics cannot be pieced together to identify an individual user, and your searches and browsing history are neither logged on our servers nor sent to Amplitude.
Our company and contact information
Still have privacy questions?
Startpage is owned and operated by Surfboard Holding BV, Wilhelmina van Pruisenweg 104
2595 AN, Den Haag, The Netherlands. You can contact us at privacypolicy@startpage.com
Startpage Account & Subscription Supplemental Privacy Policy
Last updated: August 13, 2026
At Startpage, protecting your privacy isn’t just our policy, it’s our mission. We built Startpage to let you search and browse the internet privately, and that commitment doesn’t change when you create an account or subscribe.
This Supplemental Privacy Policy, together with the main Privacy Policy (together, this “Privacy Policy”) explains how we handle personal data specifically in connection with Startpage Accounts and the Startpage subscription (together, the “Subscription Services”). Creating an account and subscribing necessarily involves a small amount of personal data, for example, an email address to sign in and billing details to process payment. This policy describes exactly what we collect for those purposes, why, who processes it on our behalf, and the choices and rights you have.
This privacy policy is written in English, and any automated translation into other languages is provided for your convenience only. In the event of any conflict or inconsistency, the English version shall prevail.
Your searches stay private, this policy is about your account, not your search
Having a Startpage account does not change how we treat your searches. We still do not log your search queries and do not record your IP address for search. The personal data described in this policy is collected only to run your account and subscription (sign-in, billing, and related emails) and is kept separate from search. For full details on how search works, please see our main Startpage Privacy Policy.
One point worth being clear about: when you pay for a subscription, our payment processor uses limited technical data such as your IP address and device information to detect and prevent payment fraud. This fraud screening applies to the billing process only. It is not connected to your searches, and we do not use it to profile you or to serve advertising.
Key Definitions
- Controller: The organization (Surfboard Holding BV) that determines how and why personal data is processed.
- Personal Data (Personal Information): Any information that can be used to identify you, directly or indirectly.
- Processing: Any operation performed on personal data, such as collection, storage, use, or deletion.
- Processor: A third-party service provider that processes data on our behalf, following our instructions.
- Subscription Services: Startpage Accounts and the Startpage subscription, including sign-in, billing, and related communications.
- We/Us/Our: Surfboard Holding BV, owner and operator of Startpage.
- You/Your: The individual using the Subscription Services.
What Information We Collect (and What We Don’t)
Our core principle is to collect only what’s necessary to provide your account and subscription, and nothing more.
Information You Provide Directly
- Account data: Your email address and, depending on the sign-in method you choose, a password or a passwordless credential such as a magic link or passkey. We use this to create and secure your account, authenticate you, and help you recover access.
- Billing data: Your billing name, billing email, billing address and country, and, where applicable, a tax ID. This is used to process your payment and to meet tax, fraud-prevention, and compliance obligations.
- Payment method: Limited details about your payment method, such as card brand, the last four digits, and expiry date, or a payment token (for example, a PayPal or Link token). We use this to charge your subscription and to let you manage it.
- Support requests: If you contact us, we receive the information you choose to provide (for example, your email address and your message).
Information Collected Automatically
- Account and subscription identifiers: Internal identifiers generated to link your identity to your subscription and entitlement (for example, an authentication user ID, a payment-processor customer ID, your subscription or entitlement status, and which payment platform you used).
- Payment fraud signals: When you pay, our payment processor automatically collects limited technical data such as IP address and device information to detect and prevent fraudulent transactions. This is used for billing-fraud prevention only.
- Transaction and invoice history: Records of your payments and invoices, used for billing, support, and legal recordkeeping.
- Email engagement: If we send you account, lifecycle, or marketing emails, we may measure whether emails were delivered, opened, or clicked, to improve deliverability and the relevance of our communications. Where required by law, we rely on your consent for marketing emails and engagement tracking, and you can opt out at any time.
What We Don’t Collect
- We do not log your search queries, and having an account does not change this.
- We do not record your IP address for search, or use it to profile you.
- We do not build advertising profiles, and we do not sell your personal data or share it for cross-context behavioral advertising.
We also never receive or store your full payment card number. When you enter your card details, they are transmitted directly to our payment processor; we only ever see limited card metadata (such as brand, last four digits, and expiry).
How We Use Your Information
We use the limited data we collect to:
- Create, secure, and manage your Startpage account and authenticate you when you sign in;
- Provide, activate, and manage your subscription and grant or revoke the entitlement;
- Process payments, manage renewals and cancellations, and prevent payment fraud;
- Send you service and transactional messages (for example, receipts, renewal notices, and account or security notifications);
- Send you lifecycle or marketing emails where you have consented or where otherwise permitted, and measure their effectiveness;
- Respond to your support requests;
- Maintain the security of our Services and prevent abuse; and
- Comply with our legal, tax, and accounting obligations.
We do not use your data for profiling, automated decision-making that produces legal or similarly significant effects (except limited payment-fraud screening described below), or to build a personal profile of you for advertising.
Legal Bases for Processing (EEA/UK Users)
Under the GDPR and UK GDPR, we must explain the legal grounds on which we process your personal data:
| Purpose | Personal data used | Legal basis |
|---|---|---|
| Create, secure, and manage your account; authenticate you | Email, password or passwordless credential, account identifiers | Performance of a contract |
| Provide and manage your subscription and entitlement | Account identifiers, subscription/entitlement status | Performance of a contract |
| Process payments and manage renewals/cancellations | Billing name and email, billing address and country, payment method details, transaction history | Performance of a contract |
| Prevent payment fraud | Payment fraud signals (IP, device), transaction data | Legitimate interests (and, where applicable, legal obligation) |
| Send service and transactional emails | Email, billing email | Performance of a contract |
| Send marketing/lifecycle emails and measure engagement | Email, email engagement (opens, clicks) | Consent (where required); otherwise legitimate interests |
| Comply with tax, accounting, and other legal obligations | Billing and transaction records, tax ID | Legal obligation |
| Maintain security and prevent abuse | Account identifiers, limited technical data | Legitimate interests |
| Respond to support requests | Contact information, support messages | Legitimate interests |
We Do Not Sell Your Personal Data
What this means: we do not sell your personal data, and we do not share it for cross-context behavioral advertising, as those terms are used under California and other US state privacy laws. We do not disclose your account, billing, or email data to advertisers, ad networks, data brokers, or ad-tech intermediaries, and we do not exchange it for money or for anything else of value. The service providers listed in this policy receive only what they need to perform their services for us, and they are not permitted to use your data for their own advertising purposes.
We also do not use the data described in this policy to select or personalize any advertising, including the sponsored links that appear on Startpage search. Because we do not sell or share personal data, there is nothing for you to opt out of, and we therefore do not provide a “Do Not Sell or Share My Personal Information” link in the app or on our website.
Payment-Fraud Screening and Automated Processing
To protect you and us from fraud, our payment processor screens transactions using automated tools that analyze signals such as IP address, device information, and payment patterns. In some cases this screening may automatically decline a transaction it considers high-risk. This processing is necessary to enter into and perform your subscription contract, to comply with legal obligations, and for our and our processor’s legitimate interest in preventing fraud. If a legitimate payment is declined, you can contact us and we will help you complete your purchase. We do not use this fraud-screening data to profile you, to make decisions unrelated to payment fraud, or for advertising.
How We Share Your Information
We share limited personal data with the service providers (processors) that help us run the Subscription Services, and only for the purposes described below. All such providers are contractually required to protect your data and use it only to provide their services to us. Some recipients, such as our payment processor, may also act as independent controllers for certain purposes such as fraud prevention and regulatory compliance.
| Recipient | Role | Purpose |
|---|---|---|
| WorkOS | Processor | Authentication and account identity (sign-in, magic links, passkeys) |
| Stripe | Processor / independent controller for fraud & compliance | Payment processing, billing, and payment-fraud prevention |
| Amazon Web Services (AWS) | Processor | Hosting and infrastructure, user management (DynamoDB), and caching of subscription/entitlement status (ElastiCache) |
| Mailjet | Processor | Sending and managing account, transactional, and (where permitted) marketing emails, including engagement measurement |
| PayPal (potential future) | Processor / payment provider | An additional payment option, if and when we introduce it |
| Legal/regulatory authorities | — | Where required to comply with law or to protect our rights |
| Successors in a business transfer | — | If our business is merged or sold, with appropriate safeguards |
If we introduce PayPal or another payment provider in the future, we will update this policy to reflect that change before it takes effect.
International Transfers
Some of our processors are located in, or may transfer personal data to, countries outside the European Economic Area (EEA) and the United Kingdom, including the United States. Where we transfer personal data internationally, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and/or the EU-US and UK Extension to the Data Privacy Framework where the recipient is certified. You can contact us for more information about these safeguards.
Data Retention
We keep personal data only as long as necessary for the purposes described in this policy, or as required by law:
- Account data: for as long as your account is active, and for a limited period after you close it.
- Billing and transaction records: for as long as required by applicable tax and accounting laws (for example, up to seven years under Dutch law).
- Email engagement data: for a short period needed to measure and improve our communications.
When data is no longer needed, we delete or anonymize it.
Data Security
We use industry-standard technical and organizational measures to protect your data, including encryption in transit and at rest, access controls, and minimizing the data we retain and who can access it. No system can be 100% secure, but our commitment is to safeguard your data and respond quickly to any incidents.
Cookies and Similar Technologies
To provide the Subscription Services on the web, we and our processors use a small number of strictly necessary cookies and similar technologies, for example, to keep you signed in, secure your session, and complete checkout. Our payment processor may also use fraud-prevention technologies during checkout. We do not use advertising or cross-site tracking cookies for the Subscription Services. Where required by law, we will ask for your consent for any non-essential cookies, and you can manage your preferences through your browser or device settings.
Your Privacy Choices and Rights
Depending on where you live, you may have some or all of the following rights regarding your personal data:
- Access: Ask for a copy of your personal data and information about how it is used.
- Correction/Rectification: Request correction of inaccurate data.
- Deletion/Erasure: Request deletion of your personal data, subject to certain legal exceptions (such as records we must keep for tax purposes).
- Restriction/Objection: Limit or object to certain uses of your data, including direct marketing.
- Portability: Receive your data in a portable format, or have it sent to another provider.
- Withdraw consent: Where we rely on your consent, you can withdraw it at any time.
- Appeal/Complaint: If you are unhappy with our response, you may appeal or lodge a complaint with your local data protection authority.
To exercise your rights, please contact us (see below). We may need to verify your identity for your protection.
Supplemental Information for EEA and UK Users
If you are located in the EEA or the UK, you have the rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent described above. You also have the right to lodge a complaint with your local supervisory authority.
Our lead supervisory authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), which you can contact here. You may also contact the supervisory authority in your own country.
Supplemental Notice for US State Privacy Rights
This section applies to residents of US states with comprehensive privacy laws, such as California, Virginia, Colorado, Connecticut, Utah, and others. Depending on where you live, you may have the rights below, subject to certain limitations.
Your Rights
- Right to Know / Access: Request the categories and specific pieces of personal information we collect, use, and disclose, and a copy of that information.
- Right to Delete: Ask us to delete your personal information, subject to exceptions (such as legal recordkeeping).
- Right to Correct: Request correction of inaccurate personal information.
- Right to Opt Out of “Sale” or “Sharing”: We do not sell your personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of, but you may still exercise this right.
- Right to Limit Use of Sensitive Personal Information: We collect sensitive information (such as account log-in credentials and payment information) only to provide the Subscription Services, and we do not use or disclose it to infer characteristics about you.
- Right to Non-Discrimination: You will not receive discriminatory treatment for exercising your privacy rights.
- Right to Appeal: If we deny your request, you may appeal our decision.
Categories of Personal Information
In the past 12 months, we have collected the following categories of personal information for the Subscription Services, from you directly, automatically, and from our service providers, strictly for the business purposes described in this policy:
| Category | Examples |
|---|---|
| Identifiers | Email address; account and subscription identifiers |
| Customer records / financial information | Billing name, billing address and country, payment method details (no full card number) |
| Commercial information | Subscription status and transaction/invoice history |
| Internet or network activity | Email engagement (opens, clicks); fraud signals (IP, device) during checkout |
| Sensitive personal information | Account log-in credentials and payment information, used only to provide the Subscription Services |
California-Specific Disclosures
- No Sale or Sharing: We do not sell your personal information or share it for cross-context behavioral advertising.
- Global Privacy Control: We honor the Global Privacy Control (GPC) signal as a request to opt out of the sale/sharing of personal information, where required by law.
- Notice of Collection: The categories of personal information we collect and our purposes are described in the sections above.
- Authorized Agents: You may use an authorized agent to submit a request on your behalf; we may require verification of the agent’s authority.
- Shine the Light: California residents may request information about disclosures of personal information for third-party direct marketing (we do not do this).
Children’s Privacy
The Subscription Services are not intended for children under 16 years old. We do not knowingly collect personal data from children under 16. If we become aware that we have done so, we will promptly delete the information.
Links to Third-Party Sites and Services
Our Services may contain links to external sites or services that we do not operate. We are not responsible for the privacy or security practices of those third parties, and we recommend reviewing the privacy policy of every external site or service you visit.
Updates to This Policy
We may update this Privacy Policy to reflect changes in our practices or the law, for example, if we add a new payment provider. When we do, we will post the new policy and update the “Last updated” date. If changes are significant, we will let you know before they take effect.
How to Contact Us
Still have privacy questions? We’re here to help.
The Subscription Services are owned and operated by:
Surfboard Holding BV (the Data Controller)
Wilhelmina van Pruisenweg 104
2595 AN, Den Haag, The Netherlands
Email: privacypolicy@startpage.com
You can also contact your local data protection authority if you have concerns.