He was a dragon-man…

That sounds reasonable and likely the method. Would you indulge a few more relevant questions? Could that API also know your search term without sharing it? How can we know that the API is not being abused? And, can access to an API like that be shared, or hacked? Are we still at “we don’t look even though we could”?

Maybe someone can ELI5 how Kagi works then. Yes, I read all their documentation, but I’m still not convinced on the “100% privacy-respecting”. In our world of proprietary back ends with peepers, cloud backdoors along with home assistants and cars that say “we don’t listen”, but suddenly have evidence when they need it - How can we trust Kagi? They say;

no telemetry, ads, or collection of private information

and

we do not log searches or in any way tie them to an account

But there’s “plans” that count your searches per month, so that is attributed to your account. They can tell if you use a bang, so they do have the ability to see what you search for. They also see if you reload the same search, so it knows exactly what you searched for. They can tell the difference between images and news and whether you’re loading more content, and attribute that to your account.

What I’m hearing is that we’re supposed to trust them when they say “hey guys, we don’t look even though we can/could see everything”? Is that it?