How we protect your privacy
We are in it for the trees, not your data
We only collect data that is necessary to provide you with search results. We don’t use your search data to personalize advertisements elsewhere.
You set your level of personalization
Customize your online experience by opting in (or staying opted out of) personalized search results. We will always ask for your consent before enabling personalized results and advertising.
We don’t compile data across platforms
Many tech companies collect and use personal data from your interactions across different platforms. We don’t compile your data in order to create a personal profile.
Your searches are encrypted
We protect your searches from potential eavesdroppers with a securely encrypted connection. This way we make sure that nobody between you, us and our search partners can see your searches.
the detailed version
Our Privacy Policy
What data do you collect when I search?
We are gradually rolling out our new unique search offer. This will happen over several months and won’t apply to everyone at the same time. This means that when you search through Ecosia, we work with either Microsoft Bing or Google to provide you with search results and ads. In order to do this, we automatically collect data required by search partners to prevent bot attacks and ad fraud - which includes your IP address and search terms.
For a growing number of users, we can provide search results and ads from Google. For the eligible users, we will provide Google results by default. When your search results and ads are provided by Google, Google will use essential cookies and local storage to help defend against fraudulent traffic. Beyond this, the cookies Google uses will depend on where you are searching from: If you search from the EU, UK or certain US states (for example California), Google will not set additional cookies without your consent. If you search from elsewhere, Google may place additional cookies and the functionality of these cookies will depend on whether you have a Google account and your account’s privacy settings. You can find more information through Google’s Privacy & Terms or Google’s advertising cookie descriptions.
If you do not want to receive results and ads from Google, you can choose Microsoft Bing as your default search provider instead at any time by navigating to your settings and choosing your preferred search provider.
Wherever you search from, and regardless of which of our partners you choose, the advertisements you see are not personalized, though you may see advertisements that are more relevant to your query based on factors such as your general location from your IP address.
We will ask for your consent to implement Microsoft Clarity when you receive results from Microsoft Bing. Microsoft Clarity captures how you interact with our website through behavioral metrics in individual search sessions and is not tied to a user profile. The information is used for site and advertising optimization, as well as fraud protection. For more information about how Microsoft collects and uses your data, visit Microsoft’s privacy statement and Microsoft Clarity documentation.
Microsoft Bing does also offer personalized search results and ads. This service requires a cookie to be set on your browser which creates a personal profile. We will ask for your consent before enabling this and you can change your choice at any time in your cookie preferences. More information on cookies and how to take control of your preferences can be found in the “What about cookies?” section.
How does Ecosia protect my privacy?
We only collect and process data that is necessary to provide you with the best search results (which includes your IP address, search terms and session behavioral data). Beyond this, we will give you the choice to consent to the collection and sharing of data, and you will always have the right to opt out of that at any time. We don’t collect any further data from third parties.
For instance, we are interested in the relevance of our social media advertising. This helps us run the right advertising campaigns on the right platforms. We never let those platforms know your search terms and we only share whether you are still searching with us or not. We only do so with your consent and you can remove that consent at any time.
We only allow connections to our search engine over a secured SSL/HTTPS connection. This way no one between you, Ecosia and our search partners can secretly listen in on your searches. We use Cloudflare and Amazon, two of the largest and most trusted SSL certificate authorities, to generate and manage our SSL certificates.
Ecosia’s servers are located around the world in order to provide a fast response no matter where you are. When you perform a search on Ecosia, your request will generally be routed to the server that is geographically nearest to you. That means, for example, if you are located in Germany your search traffic likely will remain within Germany. In any case, Ecosia is based in the European Union and therefore adheres to the world’s strictest privacy regulations.
Why are you collecting personal data at all?
We need to collect your IP address and search terms in order to provide search results and advertisements from our search partners.
We, and our search partners, collect your IP address in order to protect our service against spammers trying to conduct fraud or to up-rank specific search results. If too many search requests are coming from the same IP address in quick succession, this is an indicator of bots at work and we might send you a CAPTCHA, or stop serving results to that IP address for a while. Your IP address is considered “personal data”. Therefore, we and our search partners are mindful of protecting it and have set deletion periods when your IP address will be erased. On Ecosia, we anonymize your IP address after a maximum of 7 days. For more information on how our search partners handle and protect your data, please see their privacy statements linked below.
We collect personal data that is required for the provision of some of our optional features (for example our login feature, please see more information under “User Accounts”).
Additionally, we collect anonymous data to help identify and fix bugs and issues in Ecosia products and services. This non-personal data includes log data for example, collected by our servers, or data related to program crashes and exceptions.
What about cookies?
A cookie is a small text file that the website you visit sends to your computer. We use essential cookies to ensure that Ecosia functions correctly, for instance in which language you want the menu to be displayed. These cookies cannot be rejected.
We also use non-essential cookies, but only if you have consented to them. These cookies help us to offer additional services, improve our ads on social media and identify where we need to improve our answers. They fall into the following categories:
Analytics
To help us better understand how you use Ecosia, which features are most helpful for you and what we can improve.
Marketing
To allow you to give feedback about Ecosia and our features. They also let us show you occasional notifications about updates from Ecosia or climate related content we think is specific to your interests.
Google results and advertising
For a growing number of users, we can provide search results and ads from Google. For the eligible users, we will provide Google results by default. When your search results and ads are provided by Google, Google will use essential cookies and local storage to help defend against fraudulent traffic. Beyond this, the cookies Google uses will depend on where you are searching from: If you search from the EU, UK or certain US states (for example California), Google will not set additional cookies without your consent. If you search from elsewhere, Google may place additional cookies and the functionality of these cookies will depend on whether you have a Google account and your account’s privacy settings. You can find more information through Google’s Privacy & Terms or Google’s advertising cookie descriptions.
Third party personalization
With your consent, we implement code provided by our search and advertising providers (Google or Microsoft Bing) on our site, for example pixels or web beacons, that allow our partners to place or read a cookie on your browser. This enables them to collect your IP address and information about your visit when using our site and clicking through to further sites. This may be used by our partners to build a profile of your interests and show you more relevant ads. If you do not accept these cookies, you will receive non personalized ads. Google anonymizes data collected after the period outlined above. Bing anonymizes your IP address after 6 months and any cookie IDs after 18 months. For more information please review Microsoft and Google’s privacy statements linked below.
Microsoft Clarity
With your consent, we implement Microsoft Clarity when you receive results from Microsoft Bing. Microsoft Clarity captures how you interact with our website through behavioral metrics in individual search sessions and is not tied to a user profile. The information is used for site and advertising optimization, as well as fraud protection. Aggregated click data is retained for 13 months and sessions recordings are stored for up to 30 days. For more information about how Microsoft collects and uses your data, visit Microsoft’s privacy statement and Microsoft Clarity documentation.
We will always ask for your permission through our cookie management tool before setting any cookies beyond those that are essential to provide and maintain our service. You have the option to revoke or amend that consent at any time.
Can anyone see my searches?
We partner with Microsoft Bing and Google to deliver search results. To avoid eavesdropping from anybody else, we only allow connections to our search engine over a secure SSL/HTTPS connection.
We will never share your searches with anyone except services that are directly involved in answering your search request, like Google and Microsoft Bing. Please find more information in their privacy statements below:
Ecosia provides options for performing searches on various third-party websites via the “More” dropdown, the “Maps” tab, and the Ecosia Search Tag feature. Please be aware that we can’t influence how third-party websites track you once you have followed a link.
Also, be aware that your browser may store your browsing history and therefore record the pages you visited as a result of a search or your chat conversations (if using our chat vertical). There is a function in your browser to erase that history.
Will any personal data ever be shared with 3rd parties?
Your IP address and search terms are automatically shared with our search partners, Microsoft Bing or Google, when you search.
To enhance your search results, we may display images from Tripadvisor or Wikimedia. In such cases, we share your IP address with these partners. For details on how they handle and protect your data, please refer to Tripadvisor’s privacy policy or Wikimedia’s privacy policy.
Over the coming months, users will gradually get options to personalize their search feed. We will always ask for your consent if your choices would require additional personal data to be shared. With your consent, our search partners will collect more information from you as you search via cookies and other technologies.
For more information on how our search partners will use your data and how to take control of your data, please use these links:
If you are based in the EEA, Switzerland, and UK, we partner with “Didomi” to collect, store and manage your consent and preference choices. In order to do this Didomi creates a user ID which is used to store your consent choices. The following information is collected by Didomi: your IP address (to determine the country in which you are located for the purpose of configuring the consent banner), your consent choices and browser information. Your IP address is not stored or kept by Didomi. We use aggregated consent data to understand how you interact with our consent banner. Please see more information under the “Third Parties” section.
Ecosia advertises on social media and we do feedback anonymous metadata to those companies. More concretely, we tell them whether someone who clicked on our ad actually downloaded our app and searched with us. This helps us to fine-tune our marketing campaigns. This only applies to users who have chosen to be active on these platforms and who have given prior consent. If you want to revoke your consent there or find out more, please use the following links:
We also serve communications on our website through a service called “Braze.” The use of Braze is necessary for the operation of our website (Art. 6 para. 1 lit. b GDPR). In order to do this, Braze collects limited information, such as the country or type of device you are searching from. Braze may use this information to show you more relevant messages. If you consent to marketing cookies, you may receive more personalized messages, such as updates on your personal climate impact. You can revoke your consent at any time through our cookie manager. Additionally, we partner with Braze to send you marketing emails, including climate impact updates and promotions from like-minded brands. We will ask for your consent before we use your email for this purpose (Art. 6 para. 1 lit. a GDPR), and you can unsubscribe at any time through the link in the bottom of the emails. You can find more information on Braze’s privacy policy here.
You can read more about how we work with third parties in the fine print further down this page.
How do you protect my privacy in the context of advertisement?
Like other search engines, we display advertisements next to our search results. When you click on these ads we earn revenue, which we reinvest into climate action. These ads are provided by either Microsoft Bing or Google.
We will also give you the choice to receive personalized ads through either Microsoft Bing or Google. If you consent to receive personalized ads, then additional usage data will be shared with these search partners through cookies. Please find more information on how our website uses cookies in the “What about cookies?” section of this privacy policy.
How does your privacy policy compare to other search engines?
We only collect what is required to be able to provide search results and ads from our search partners (Microsoft Bing and Google).
There are only a few search engines with their own web index - for example Google, Bing, Yandex, and Baidu. Most other general web search engines cooperate and share data with these companies in some form. We currently work with Microsoft Bing and Google and are very transparent about what we share with them.
Currently, alternative search engines cannot provide perfect protection of your search data, because other parties – like your network provider or browser for example – might still be able to access some of your data. For an added layer of privacy, we would recommend checking out security tools like VPNs and services like TOR.
Want to dive into the fine print?
See the in-depth legal version of our privacy policy below, with detailed information on how we handle your data. Protecting your privacy is extremely important to us. This in-depth data protection declaration provides information on how and for what purpose we process personal data and explains the rights to which you are entitled. We are aware of how important personal data is to our users and we uphold all German and European data protection provisions - the highest standard in the world.
Analytics
We use a self-hosted, safe, and fully encrypted web analysis tool that, by default, tracks anonymous data collected through essential cookies (including the type of device you’re using to search or whether you have our extension installed). With your consent, we acquire additional usage data through cookies. You can choose to consent through the cookie management tool and you can revoke this consent at any time.
Since we do not store any personal data, we also do not (and cannot) sell your data nor do we purchase data from other parties.
Data transfer to third countries
Where possible, we choose to use services within the EU and ensure that partners outside the EU comply with EU regulation. More specific information on the data recipients can be found in this privacy policy.
Third parties
We work with third parties for specific reasons outlined below. Where appropriate, we place a proxy server between us and third parties to ensure that no personal information is shared with them.
We partner with Microsoft Bing (Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, USA) and Google (Google LLC, 1600 Amphitheatre Pkwy Mountain View, California 94043-1351, USA). We maintain our feed with Microsoft Bing through a commercial relationship with System1 (System1 OpCo, LLC, 4235 Redwood Avenue, Los Angeles, California 90066 USA). We do not share any personal data with System1, we only share aggregated data to maintain and improve performance. We partner with Microsoft Bing and Google for the performance of a contract within the scope of the services offered by us (Art. 6 para. 1 lit. b GDPR). If data is transferred to the USA as part of the use of our services, this is done on the basis of the standard contractual clauses of the EU Commission. Both providers are certified under the EU-US Data Privacy Framework (see links below).
We partner with “Wikimedia” (Wikimedia Foundation, 1 Montgomery St., Suite 1600, San Francisco, CA 94104 USA) and “Tripadvisor” (Tripadvisor LLC, 400 1st Avenue, Needham, MA 02494 USA) to serve image results. We partner with Wikimedia and Tripadvisor for the performance of a contract within the scope of the services offered by us (Art. 6 para. 1 lit. b GDPR). If data is transferred to the USA as part of the use of our services, this is done on the basis of the standard contractual clauses of the EU Commission.
We work with “Singular” to help us evaluate and measure the performance of our marketing campaigns by taking account of specific touch points along your journey with our mobile apps (like installing the app, first app open). The provider is Singular Labs, Inc., 2345 Yale Street, Palo Alto, California 94306, USA. The use of Singular is based on your consent (Art. 6 para. 1 lit. a GDPR), which is collected when you download the app through the App Store and Play Store nutrition labels. You can revoke this consent at any time through the app’s privacy settings. The data transfer to the US is based on the standard contractual clauses of the EU Commission. You can find more information in Singular’s privacy policy here.
We work with “Braze” to deliver general communications through our website. The use of Braze is necessary for the operation of our website (Art. 6 para. 1 lit. b GDPR). In order to do this, Braze collects limited information and may use this to show you more relevant messages. If you consent to marketing cookies, you may receive personalized messages (Art. 6 para. 1 lit. a GDPR). You can revoke this consent at any time through our cookie manager. Additionally, we partner with Braze to send you marketing emails with your consent, such as climate impact updates and promotions from like-minded brands. The provider is Braze, Inc., 330 West 34th Street, 18th floor, New York 10001, USA. The data transfer to the US is based on the standard contractual clauses of the EU Commission. In addition, Braze has a certification under the EU-US Data Privacy Framework. You can find more information on Braze’s privacy policy here.
We use “Airtable” to keep in touch with people that have expressed a legitimate interest in receiving follow up communications (for example about subscriptions) from us. Data stored is GDPR compliant and is not shared with third parties. If you have completed an Airtable form and wish for your details to be deleted, please send a message to community@ecosia.org stating: “Request to be removed from Airtable”. The provider is Formagrid Inc., 99 Market St FL 8 San Francisco, CA, 94103-2044, USA. The use of Airtable is based on your consent (Art. 6 para. 1 lit. a GDPR). The Data transfer to the US is based on the standard contractual clauses of the EU Commission. You can find more information on Airtable’s privacy policy here.
We use “Didomi” to collect and store consent data in the EEA, Switzerland, and UK. Information collected includes your IP address, your consent choices and browser information. Your IP address is not stored or kept by Didomi. We use aggregated consent data to understand how you interact with our consent banner. The provider is Didomi, 137 boulevard de Sébastopol 75002 Paris, France. The use of Didomi is based on our legal obligation to collect and store user consent (Art. 6 para. 1 lit. c GDPR). The use of aggregated data for analytics to understand interactions with the banner is based on our legitimate interest in providing an optimized consent banner (Art. 6 para. 1 lit. f GDPR). You can find more information on Didomi’s privacy policy here.
We use “Typeform” to carry out our surveys. Surveys help us to improve Ecosia’s products and activities by gathering direct user input and feedback. The collected information consists of your responses and your IP address (for spam protection purposes). It will be aggregated and anonymized within 3 months. The provider is TYPEFORM S.L., Carrer Bac de Roda, 163, 08018 Barcelona, Spain. The use of Typeform is based on our legitimate interest in functioning online forms (Art. 6 para. 1 lit. f GDPR). You can find more information on Typeform's privacy policy here.
We use “Help Scout” to maintain our user support activities, which include the Ecosia help center, product feedback and enquiries which are submitted to us via email and our contact form. Help Scout is a fellow B-Corp and committed social business. For each enquiry, Help Scout receives the question itself, our answer, the email address we sent it to and the IP address for spam protection purposes. Collected email and IP addresses are deleted after 6 Months. The provider is Help Scout PBC, 177 Huntington Ave, Ste 1703, PMB 78505 Boston, MA 02115-3153, USA. The use of Help Scout is based on our legitimate interest in the fastest and most efficient processing of user requests possible (Art. 6 para. 1 lit. f GDPR). The Data transfer to the US is based on the standard contractual clauses of the EU Commission. You can find more information on Help Scout's privacy policy.
We use “HubSpot” to manage B2B relationships with companies that have expressed a legitimate interest in receiving support and communications regarding using Ecosia at their workplace. Data stored is GDPR compliant and is not shared with third parties. If you have completed a HubSpot form and wish for your details to be deleted, please send a message to community@ecosia.org stating: “Request to be removed from HubSpot”. The provider is HubSpot, 2 Canal Park, Cambridge, MA 02141, United States. The use of HubSpot is based on your consent (Art. 6 para. 1 lit. a GDPR). The Data transfer to the US is based on the standard contractual clauses of the EU Commission. You can find more information on HubSpot’s privacy policy here.
We use “Ashby” to administer our job application process. All data which you have provided for your job application (name, email address, phone number, photo, CV, cover letter, etc.) as well as the associated communication between you and Ecosia are saved during the job application process. Your data will be deleted maximum 6 months after the end of the application process. The provider is Ashby, Inc., 49 Geary St Ste 411, San Francisco, California, 94108, USA. The use of Ashby is based on the fulfillment of contractual or pre-contractual (application process) measures (Art. 6 para. 1 lit. b GDPR). The Data transfer to the US is based on the standard contractual clauses of the EU Commission. You can find more information on Ashby’s privacy policy.
To achieve a user experience that is as fast and free of errors as possible, we use “Sentry”. Sentry allows us to receive automated reports of errors as they occur in the web frontend on user devices (e.g. Javascript errors) and to measure website performance on a randomized sample of user devices. No personal data is collected and data is automatically deleted after 90 days. The provider is Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105. You can find out more information on Sentry’s privacy policy.
LLM provider
We offer an AI-based chat service that allows you to have back and forth conversations on topics of your choice. If you use our chat service, queries will be sent to our model provider Mistral AI. Accordingly, your input including metadata is transferred to Mistral AI's servers and processed there to generate a suitable response. We do not share any personal data with Mistral AI, however if you include personal information in your conversation then this will be sent to Mistral AI. Your data is not retained by Mistral AI, following the Zero Data Retention policy. The provider is Mistral AI, Paris, under number 952 418 325, having its registered offices at 15 rue des Halles, 75001 Paris. The use of Mistral AI is based on our legitimate interest in the most efficient customer communication possible using modern technical solutions (Art. 6 para. 1 lit. f GDPR). You can find more information in Mistral AI’s privacy policy.
We use ‘'Langfuse’' to support quality assurance and service improvement for AI Chat, such as monitoring performance and diagnosing issues using a limited sample of anonymised conversation data. Not all conversations are stored for this purpose. Data is hosted in the European Union (Ireland, AWS eu-west-1) and retained for up to 30 days before deletion.
Access to this data is restricted to authorized personnel. You may request deletion or export of your data at any time or opt out of this processing. The use of Langfuse is based on our legitimate interest in maintaining and improving our services (Art. 6 para. 1 lit. f GDPR). Information about Langfuse subprocessors is available in their documentation.
Spam Protection
Spam attacks are expensive and can divert significant funds from our tree-planting efforts. Therefore, we run our own spam protection intelligence but also seek help from the spam protection specialist Cloudflare. Internally, we keep IP addresses for a maximum of 7 days before they are either anonymized or deleted. Cloudflare receives anonymized and obfuscated IP addresses, most of which are deleted within days. Only a small sample of anonymized metadata remains with Cloudflare for up to 12 months. This sample is retained in order to diagnose malicious activity and improve the effectiveness of security measures. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA. The use of Cloudflare is based on our legitimate interest in providing our services as error-free and secure as possible (Art. 6 para. 1 lit. f GDPR). The Data transfer to the US is based on the standard contractual clauses of the EU Commission. In addition, Cloudflare has a certification under the EU-US Data Privacy Framework. For further information please refer to Cloudflare’s privacy policy.
User Accounts
We partner with “Okta” to offer an accounts feature which will allow you to sync information between our desktop browser and mobile apps amongst other features. In order to create an account, our partner “Auth0” (a subsidiary of Okta) will store your email address and will create a unique user ID for you. “Auth0” stores your credentials and the processing is based on performance of the contract to provide our login feature (Art. 6 para. 1 lit. b GDPR). If you consent, Auth0 will also store your profile picture (Art. 6 para. 1 lit. a GDPR).
We collect and process personal data that is required for the provision of optional account based features, based on performance of the contract to provide these features (Art. 6 para. 1 lit. b GDPR). This data is stored in EU based data centres. This information will be linked to your personal profile and will be deleted if you request deletion of your account. Furthermore, we only use this data for the stated purposes or for the use of the respective offer or service for which you have registered. The mandatory information requested during registration must be provided in full, otherwise we will refuse your registration. In the event of important changes, for example to the scope of the offer or technically necessary changes, we will use the e-mail address provided during registration to inform you in this way.
In addition, we will collect your IP address. This is based on our legitimate interest to identify suspicious activity and protect us from fraud (Art. 6 para. 1 lit. f GDPR). We collect event based analytics data which is stored in a self-hosted, safe, and fully encrypted web analysis tool (see “Analytics” section).
User Accounts Sync Feature
If you choose to enable the accounts sync feature then you can configure which browsing-related data you would like to sync across the desktop browser and mobile app (for example bookmarks, history, passwords, reading lists, open tabs, theme, extensions, apps and settings.) This data is all encrypted (using a user-supplied sync password) in your browser and stored in a self-hosted, EU based data centre (see “Analytics” section). The collection of this data is based on performance of contract to provide a sync feature (Art. 6 para. 1 lit. b GDPR). You can choose to remove this feature and delete your account at any time.
When you login for the first time, we will ask for your consent to receive follow up communications via email from us (which includes an onboarding email and newsletters). We partner with “Braze” to provide this feature (please see more information under “Third Parties”). You can adjust your preferences or revoke consent at any time in your account settings.
You can request the deletion of your data or delete your account at any time. For more details on how Okta/Auth0 handles data privacy, please refer to their policy.
When using our account feature, data may be transferred to the USA. The legal basis for the data transfer is the standard contractual clauses of the EU Commission, which were signed with the service provider. The provider is Okta, Inc. (including its subsidiary, Auth0, Inc.), 100 First Street, Floor 6, San Francisco, CA 94105, USA. Auth0 (subsidiary of Okta) has a certification under the EU-US Data Privacy Framework. For further information please refer to Okta’s privacy policy.
AI Chat
AI Chat is a feature that allows you to ask questions and receive AI-assisted responses. Depending on the configuration, AI Chat may allow follow-up questions and longer conversations.
When you use AI Chat, we process the content you submit (for example, your prompts and any information you include) in order to generate a response. Please avoid sharing sensitive personal information. If you choose to include personal information, it will be processed as part of your request.
Model Providers
To provide AI Chat, queries will be sent to one of our model providers. Accordingly, your input, including associated metadata, is transferred to servers and processed there to generate a suitable response. We do not intentionally send personal data to providers; however, if you include personal information in your conversation, this will be sent to the model providers.
The provider we primarily use is Mistral AI, a French company incorporated in Paris, under number 952 418 325, having its registered offices at 15 rue des Halles, 75001 Paris. The use of Mistral AI is based on our legitimate interest in providing AI Chat using modern technical solutions (Art. 6 para. 1 lit. f GDPR). You can find more information in Mistral AI’s privacy policy. Mistral won’t store your input and output as Ecosia used their Zero Data Retention policy.
Ecosia may engage OpenAI as a backup service provider where Mistral is unavailable or a fallback is necessary to ensure continuity. OpenAI is used only for these fallback scenarios and, if applicable, for limited internal services. OpenAI L.L.C., 3180 18th Street, San Francisco, CA 94110. The use of OpenAI is based on our legitimate interest in providing AI Chat using modern technical solutions (Art. 6 para. 1 lit. f GDPR). Data transfers to the United States are safeguarded through the EU Commission’s standard contractual clauses. You can find more information in OpenAI’s privacy policy. OpenAI will store your input and output data for 30 days for quality assurance purposes.
Chats History on AI Chat
When using Chat history with AI Chat, your conversations are stored securely and encrypted in transit and at rest. If you choose to include personal information, this will also be stored.
We use Cloudflare (Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany.) as a subprocessor to help provide secure chat storage. Cloudflare is certified under the EU–US Data Privacy Framework, and your data may be transferred to the United States, even if stored in the EU. Such transfers are safeguarded through the EU Commission’s standard contractual clauses.
You are in control of your chat history:
Opt-in / Opt-out: You can turn off Chat history in your settings.Your rights: You may request access to your conversations or ask us to delete them at any time by contacting our Support. Conversations are also deleted when you delete your Ecosia account.
Chat history is a part of our service. Once you activate the feature, we process Chat history data on the basis of the performance of a contract (Art. 6 para. 1 lit. b GDPR). We will not analyze or personalize your chats without your explicit consent.
Uploading files on AI Chat
When you upload a file, its content and associated metadata (e.g., file name, file type, and file size) are transmitted to our AI model providers for processing. Only the data necessary to deliver the requested functionality is shared. To enhance your experience, uploaded files are retained for 7 days and remain accessible within your conversations during that period.
You are in control of your files history and you may request access to your conversations or ask us to delete them at any time by contacting our Support or by deleting your Ecosia account.
File upload is part of our service. Once you activate the feature, we process uploaded files data on the basis of the performance of a contract (Art. 6 para. 1 lit. b GDPR). We will not analyze or personalize your chats without your explicit consent.
Service improvement and quality assurance
For the purpose of maintaining, securing, and improving AI Chat, we may request your consent to collect and review a limited selection of conversations exchanged between users and the AI Chat.
When conversations are collected for service improvement:
Data is anonymised to the extent that is feasible to automate, and not linked to a user account or directly identifiable individual.Collection follows data minimisation principles.Processing is carried out in compliance with GDPR requirements.
We use Langfuse (Langfuse GmbH, Gethsemanestr. 4, 10437 Berlin, Germany) as a tool to support this processing, for example to monitor system performance, diagnose issues, and improve response quality. Sampled data may include the user prompt, the assistant response, conversation structure, and technical or contextual metadata (such as approximate location, language, device type, and timestamps), but is not used to identify individual users.
Sampled conversation data is retained for up to 30 days, after which it is deleted.
We also regularly create dedicated fully-anonymized data sets from parts of the sampled conversations to further improve the response quality. A manual review process is used to ensure these data sets are fully anonymous and do not contain any user-identifiable information.
Access to sampled conversations and to fully-anonymized data sets is limited to authorized personnel and solely for the purposes described above.
You may opt out of having your conversations used for service improvement via email to support@ecosia.org.
You also have the right to object to processing based on legitimate interests (Art. 21 GDPR).
The legal basis for this processing is our legitimate interest in operating, securing, and improving AI Chat (Art. 6 para. 1 lit. f GDPR), balanced against user rights through sampling, anonymisation, limited access, and retention controls.
Desktop browser
We have launched our desktop browser in two stages. If you signed up to our first stage beta test, we collect your email address which is required for the provision of contract to facilitate the download of the browser (Art. 6 para. 1 lit. b GDPR). There are optional data fields and provision of this data is based on your consent (Art. 6 para. 1 lit. a GDPR). This data is stored with Airtable (please see more information under “Third Parties”).
When you download the desktop browser, we ask for your consent to receive follow up communications from us about the browser and to get involved with surveys. The use of your email for this purpose is based on your consent to receiving marketing communications (Art. 6 para. 1 lit. a GDPR). You can unsubscribe at any time using the link at the bottom of our emails.
We collect event based data to learn about usage of the desktop browser and to improve our product features. This analytics data is stored in a self-hosted, safe, and fully encrypted web analysis tool (see “Analytics” section).
Mobile apps
To improve our browser apps, we collect usage statistics such as the name of the device, its manufacturer, model, operating system number and app number or SDK version. We use device identifiers, either defined by us internally or specific to Ecosia as the app’s vendor. To measure the success of ad campaigns, we link these identifiers to Google Play’s Install Referrer on Android or use Apple’s privacy focused SKAdNetwork on iOS.
We use a 3rd party service called “App Center” to collect and analyse crash reports of our Android app. This includes data that helps us fix bugs, such as app number, device model, and operating system.
For more information on how “App Center” handles your data, see Microsoft’s Privacy Statement.
To enable you to search with your voice in our Android App, we use Google Speech Recognition services which are offered by the Android OS. This can be deactivated by the system settings.
Spreading the word
To plant more trees, we use external ad platforms to reach new users. When a new desktop user installs the Ecosia extension, they see a page that pings a notification of the installment back to our advertising platform. To protect the privacy of your queries this page is not connected to our search service. This page allows us to know which ads helped us plant trees, and we can stop spending money on those that don’t. We regularly test new platforms and remove those whose services are not effective. Currently, we are using, or planning to test,Google Ads, Apple’s App Store, Facebook, Microsoft Bing, Twitch, TikTok and Taboola.
We never share your search data with ad services. You can see how much we spend on spreading the word in our monthly financial reports.
Privacy policy updates
We may amend this privacy policy from time to time to keep it up to date. We will place any updates on this webpage and if we make any significant changes to this privacy notice, we will seek to notify you. This privacy policy was last updated on May 21, 2026.
Your rights
You have the following rights with respect to your personal data:
Right to informationRight to correction or deletionRight to restriction of processingRight to refuse processingRight to data transferabilityIn addition, you have the right to complain to a data protection supervisory authority regarding our processing of your personal data.
Contact
In relation to the General Data Protection Regulation (GDPR), the organisation responsible is:
Ecosia GmbH, Gerichtstraße 23, 13347 Berlin, Germany
Our Data Protection Officer (DPO) is an external service provider. Requests to privacy@ecosia.org or our postal address with the addition of "data protection" will be forwarded to our external DPO. The personal data you provide (e.g. name, email address, content of the request) will be processed for the purpose of processing your request. The legal basis is Art. 6 para. 1 lit. c GDPR. The external DPO is the recipient of this data.
Last modified: May 21, 2026