As you mentioned they don't track (for now).

I mean anyone can write anything into a privacy policy and who will enforce they are sticking to them really? Usually we only see what actually happens in the background when there is a breach.

For financial systems we have regular audits so rules like PCI DSS are enforced, but do we have these for search systems?

Not so plain. We do not (log AND associate), or we do not log AND we don’t associate? Am I supposed to believe that if their backend crashes after a user query, that can’t tell what has been queried?

So if the feds stop by you have nothing to hand over. That sounds great, but legally dubious. Aren't you required to keep a log?

Thanks for the info nonetheless. I think I'll give it a shot and maybe don't look up how to get rid of bodies - for a friend. Oh, damn, did it again.