We protect your privacy

We only collect and process data that is necessary to provide you with the best search results (which includes your IP address, search terms and session behavioral data). Beyond this, we will give you the choice to consent to the collection and sharing of data, and you will always have the right to opt out of that at any time. We don’t collect any further data from third parties.

For instance, we are interested in the relevance of our social media advertising. This helps us run the right advertising campaigns on the right platforms. We never let those platforms know your search terms and we only share whether you are still searching with us or not. We only do so with your consent and you can remove that consent at any time.

We only allow connections to our search engine over a secured SSL/HTTPS connection. This way no one between you, Ecosia and our search partners can secretly listen in on your searches. We use Cloudflare and Amazon, two the largest and most trusted SSL certificate authorities, to generate and manage our SSL certificates.

Ecosia’s servers are located around the world in order to provide a fast response no matter where you are. When you perform a search on Ecosia, your request will generally be routed to the server that is geographically nearest to you. That means, for example, if you are located in Germany your search traffic likely will remain within Germany. In any case, Ecosia is based in the European Union and therefore adheres to the world’s strictest privacy regulations.

We need to collect your IP address and search terms in order to provide search results and advertisements from our search partners.

We, and our search partners, collect your IP address in order to protect our service against spammers trying to conduct fraud or to up-rank specific search results. If too many search requests are coming from the same IP address in quick succession, this is an indicator of bots at work and we might send you a CAPTCHA, or stop serving results to that IP address for a while. Your IP address is considered “personal data”. Therefore, we and our search partners are mindful of protecting it and have set deletion periods when your IP address will be erased. On Ecosia, we anonymize your IP address after a maximum of 7 days. For more information on how our search partners handle and protect your data, please see their privacy statements linked below.

• Microsoft privacy statement
• Google privacy policy

We collect personal data that is required for the provision of some of our optional features (for example our login feature, please see more information under “User Accounts”).

Additionally, we collect anonymous data to help identify and fix bugs and issues in Ecosia products and services. This non-personal data includes log data for example, collected by our servers, or data related to program crashes and exceptions.

A cookie is a small text file that the website you visit sends to your computer. We use essential cookies to ensure that Ecosia functions correctly, for instance in which language you want the menu to be displayed. These cookies cannot be rejected.

We also use non-essential cookies, but only if you have consented to them. These cookies help us to offer additional services, improve our ads on social media and identify where we need to improve our answers. They fall into the following categories:

Analytics

To help us better understand how you use Ecosia, which features are most helpful for you and what we can improve.

Marketing

To allow you to give feedback about Ecosia and our features. They also let us show you occasional notifications about updates from Ecosia or climate related content we think is specific to your interests.

Google results and advertising

For a growing number of users, we can provide search results and ads from Google. For the eligible users, we will provide Google results by default. When your search results and ads are provided by Google, Google will use essential cookies and local storage to help defend against fraudulent traffic. Beyond this, the cookies Google uses will depend on where you are searching from: If you search from the EU, UK or certain US states (for example California), Google will not set additional cookies without your consent. If you search from elsewhere, Google may place additional cookies and the functionality of these cookies will depend on whether you have a Google account and your account’s privacy settings. You can find more information through Google’s Privacy & Terms or Google’s advertising cookie descriptions.

Third party personalization

With your consent, we implement code provided by our search and advertising providers (Google or Microsoft Bing) on our site, for example pixels or web beacons, that allow our partners to place or read a cookie on your browser. This enables them to collect your IP address and information about your visit when using our site and clicking through to further sites. This may be used by our partners to build a profile of your interests and show you more relevant ads. If you do not accept these cookies, you will receive non personalized ads. Google anonymizes data collected after the period outlined above. Bing anonymizes your IP address after 6 months and any cookie IDs after 18 months. For more information please review Microsoft and Google’s privacy statements linked below.

• Microsoft privacy statement
• Google privacy policy

Microsoft Clarity

With your consent, we implement Microsoft Clarity when you receive results from Microsoft Bing. Microsoft Clarity captures how you interact with our website through behavioral metrics in individual search sessions and is not tied to a user profile. The information is used for site and advertising optimization, as well as fraud protection. Aggregated click data is retained for 13 months and sessions recordings are stored for up to 30 days. For more information about how Microsoft collects and uses your data, visit Microsoft’s privacy statement and Microsoft Clarity documentation.

We will always ask for your permission through our cookie management tool before setting any cookies beyond those that are essential to provide and maintain our service. You have the option to revoke or amend that consent at any time.

We partner with Microsoft Bing and Google to deliver search results. To avoid eavesdropping from anybody else, we only allow connections to our search engine over a secure SSL/HTTPS connection.

We will never share your searches with anyone except services that are directly involved in answering your search request, like Google and Microsoft Bing. Please find more information in their privacy statements below:

• Microsoft privacy statement
• Google privacy policy

Ecosia provides options for performing searches on various third-party websites via the “More” dropdown, the “Maps” tab, and the Ecosia Search Tag feature. Please be aware that we can’t influence how third-party websites track you once you have followed a link.

Also, be aware that your browser may store your browsing history and therefore record the pages you visited as a result of a search or your chat conversations (if using our chat vertical). There is a function in your browser to erase that history.

Your IP address and search terms are automatically shared with our search partners, Microsoft Bing or Google, when you search.

Over the coming months, users will gradually get options to personalize their search feed. We will always ask for your consent if your choices would require additional personal data to be shared. With your consent, our search partners will collect more information from you as you search via cookies and other technologies.

For more information on how our search partners will use your data and how to take control of your data, please use these links:

• Microsoft privacy statement
• Google privacy policy
• How Google uses information from partner sites

If you are based in the EEA, Switzerland, and UK, we partner with “Didomi” to collect, store and manage your consent and preference choices. In order to do this Didomi creates a user ID which is used to store your consent choices. The following information is collected by Didomi: your IP address (to determine the country in which you are located for the purpose of configuring the consent banner), your consent choices and browser information. Your IP address is not stored or kept by Didomi. We use aggregated consent data to understand how you interact with our consent banner. Please see more information under the “Third Parties” section.

Ecosia advertises on social media and we do feedback anonymous metadata to those companies. More concretely, we tell them whether someone who clicked on our ad actually downloaded our app and searched with us. This helps us to fine-tune our marketing campaigns. This only applies to users who have chosen to be active on these platforms and who have given prior consent. If you want to revoke your consent there or find out more, please use the following links:

• Facebook
• Adwords
• TikTok
• Apple’s App Store
• Twitter

We also serve communications on our website through a service called “Braze”. The use of Braze is necessary for the operation of our website (Art. 6 para. 1 lit. b GDPR). In order to do this, Braze collects limited information (for example the country or the type of device you are searching from.) Braze may use this to show you more relevant messages. If you consent to marketing cookies, you may receive more personalised messages (for example on your personal climate impact.) You can revoke your consent at any time through our cookie manager. You can find more information on Braze’s privacy policy here.

You can read more about how we work with third parties in the fine print further down this page.

Like other search engines, we display advertisements next to our search results. When you click on these ads we earn revenue, which we reinvest into climate action. These ads are provided by either Microsoft Bing or Google.

We will also give you the choice to receive personalized ads through either Microsoft Bing or Google. If you consent to receive personalized ads, then additional usage data will be shared with these search partners through cookies. Please find more information on how our website uses cookies in the “What about cookies?” section of this privacy policy.

We only collect what is required to be able to provide search results and ads from our search partners (Microsoft Bing and Google).

There are only a few search engines with their own web index - for example Google, Bing, Yandex, and Baidu. Most other general web search engines cooperate and share data with these companies in some form. We currently work with Microsoft Bing and Google and are very transparent about what we share with them.

Currently, alternative search engines cannot provide perfect protection of your search data, because other parties – like your network provider or browser for example – might still be able to access some of your data. For an added layer of privacy, we would recommend checking out security tools like VPNs and services like TOR.

See the in-depth legal version of our privacy policy below, with detailed information on how we handle your data. Protecting your privacy is extremely important to us. This in-depth data protection declaration provides information on how and for what purpose we process personal data and explains the rights to which you are entitled. We are aware of how important personal data is to our users and we uphold all German and European data protection provisions - the highest standard in the world.

We use a self-hosted, safe, and fully encrypted web analysis tool that, by default, tracks anonymous data collected through essential cookies (including the type of device you’re using to search or whether you have our extension installed). With your consent, we acquire additional usage data through cookies. You can choose to consent through the cookie management tool and you can revoke this consent at any time.

Since we do not store any personal data, we also do not (and cannot) sell your data nor do we purchase data from other parties.

Where possible, we choose to use services within the EU and ensure that partners outside the EU comply with EU regulation. More specific information on the data recipients can be found in this privacy policy.

We work with third parties for specific reasons outlined below. Where appropriate, we place a proxy server between us and third parties to ensure that no personal information is shared with them.

We partner with Microsoft Bing (Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, USA) and Google (Google LLC, 1600 Amphitheatre Pkwy Mountain View, California 94043-1351, USA). We maintain our feed with Microsoft Bing through a commercial relationship with System1 (System1 OpCo, LLC, 4235 Redwood Avenue, Los Angeles, California 90066 USA). We do not share any personal data with System1, we only share aggregated data to maintain and improve performance. We partner with Microsoft Bing and Google for the performance of a contract within the scope of the services offered by us (Art. 6 para. 1 lit. b GDPR). If data is transferred to the USA as part of the use of our services, this is done on the basis of the standard contractual clauses of the EU Commission. Both providers are certified under the EU-US Data Privacy Framework (see links below).

• Google
• Microsoft

We work with “Singular” to help us evaluate and measure the performance of our marketing campaigns by taking account of specific touch points along your journey with our mobile apps (like installing the app, first app open). The provider is Singular Labs, Inc., 2345 Yale Street, Palo Alto, California 94306, USA. The use of Singular is based on your consent (Art. 6 para. 1 lit. a GDPR), which is collected when you download the app through the App Store and Play Store nutrition labels. You can revoke this consent at any time through the app’s privacy settings. The data transfer to the US is based on the standard contractual clauses of the EU Commission. You can find more information in Singular’s privacy policy here.

We work with “Braze” to deliver general communications through our website. The use of Braze is necessary for the operation of our website (Art. 6 para. 1 lit. b GDPR). In order to do this, Braze collects limited information and may use this to show you more relevant messages. If you consent to marketing cookies, you may receive personalized messages (Art. 6 para. 1 lit. a GDPR). You can revoke this consent at any time through our cookie manager. The provider is Braze, Inc., 330 West 34th Street, 18th floor, New York 10001, USA. The data transfer to the US is based on the standard contractual clauses of the EU Commission. In addition, Braze has a certification under the EU-US Data Privacy Framework. You can find more information on Braze’s privacy policy here.

We use “Airtable” to keep in touch with people that have expressed a legitimate interest in receiving follow up communications (for example about subscriptions) from us. Data stored is GDPR compliant and is not shared with third parties. If you have completed an Airtable form and wish for your details to be deleted, please send a message to community@ecosia.org stating: “Request to be removed from Airtable”. The provider is Formagrid Inc., 99 Market St FL 8 San Francisco, CA, 94103-2044, USA. The use of Airtable is based on your consent (Art. 6 para. 1 lit. a GDPR). The Data transfer to the US is based on the standard contractual clauses of the EU Commission. You can find more information on Airtable’s privacy policy here.

We use “Didomi” to collect and store consent data in the EEA, Switzerland, and UK. Information collected includes your IP address, your consent choices and browser information. Your IP address is not stored or kept by Didomi. We use aggregated consent data to understand how you interact with our consent banner. The provider is Didomi, 137 boulevard de Sébastopol 75002 Paris, France. The use of Didomi is based on our legal obligation to collect and store user consent (Art. 6 para. 1 lit. c GDPR). The use of aggregated data for analytics to understand interactions with the banner is based on our legitimate interest in providing an optimized consent banner (Art. 6 para. 1 lit. f GDPR). You can find more information on Didomi’s privacy policy here.

We use “Typeform” to carry out our surveys. Surveys help us to improve Ecosia’s products and activities by gathering direct user input and feedback. The collected information consists of your responses and your IP address (for spam protection purposes). It will be aggregated and anonymized within 3 months. The provider is TYPEFORM S.L., Carrer Bac de Roda, 163, 08018 Barcelona, Spain. The use of Typeform is based on our legitimate interest in functioning online forms (Art. 6 para. 1 lit. f GDPR). You can find more information on Typeform's privacy policy here.

We offer an AI-based chat service that allows you to have back and forth conversations on topics of your choice. If you use our chat service, queries will be sent to our model provider OpenAI. Accordingly, your input including metadata is transferred to OpenAI's servers and processed there to generate a suitable response. We do not share any personal data with OpenAI, however if you include personal information in your conversation then this will be sent to OpenAI. Your data is deleted by OpenAI after 30 days. The provider is OpenAI, 3180 18th St, San Francisco, CA 94110, USA. The use of OpenAI is based on our legitimate interest in the most efficient customer communication possible using modern technical solutions (Art. 6 para. 1 lit. f GDPR). The Data transfer to the US is based on the standard contractual clauses of the EU Commission. You can find more information on OpenAI's privacy policy here.

We use “Help Scout” to maintain our user support activities, which include the Ecosia help center, product feedback and enquiries which are submitted to us via email and our contact form. Help Scout is a fellow B-Corp and committed social business. For each enquiry, Help Scout receives the question itself, our answer, the email address we sent it to and the IP address for spam protection purposes. Collected email and IP addresses are deleted after 6 Months. The provider is Help Scout PBC, 177 Huntington Ave, Ste 1703, PMB 78505 Boston, MA 02115-3153, USA. The use of Help Scout is based on our legitimate interest in the fastest and most efficient processing of user requests possible (Art. 6 para. 1 lit. f GDPR). The Data transfer to the US is based on the standard contractual clauses of the EU Commission. You can find more information on Help Scout's privacy policy.

We use “HubSpot” to manage B2B relationships with companies that have expressed a legitimate interest in receiving support and communications regarding using Ecosia at their workplace. Data stored is GDPR compliant and is not shared with third parties. If you have completed a HubSpot form and wish for your details to be deleted, please send a message to community@ecosia.org stating: “Request to be removed from HubSpot”. The provider is HubSpot, 2 Canal Park, Cambridge, MA 02141, United States. The use of HubSpot is based on your consent (Art. 6 para. 1 lit. a GDPR). The Data transfer to the US is based on the standard contractual clauses of the EU Commission. You can find more information on HubSpot’s privacy policy here.

We use “Ashby” to administer our job application process. All data which you have provided for your job application (name, email address, phone number, photo, CV, cover letter, etc.) as well as the associated communication between you and Ecosia are saved during the job application process. Your data will be deleted maximum 6 months after the end of the application process. The provider is Ashby, Inc., 49 Geary St Ste 411, San Francisco, California, 94108, USA. The use of Ashby is based on the fulfillment of contractual or pre-contractual (application process) measures (Art. 6 para. 1 lit. b GDPR). The Data transfer to the US is based on the standard contractual clauses of the EU Commission. You can find more information on Ashby’s privacy policy.

To achieve a user experience that is as fast and free of errors as possible, we use “Sentry”. Sentry allows us to receive automated reports of errors as they occur in the web frontend on user devices (e.g. Javascript errors) and to measure website performance on a randomized sample of user devices. No personal data is collected and data is automatically deleted after 90 days. The provider is Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105. You can find out more information on Sentry’s privacy policy.

Spam attacks are expensive and can divert significant funds from our tree-planting efforts. Therefore, we run our own spam protection intelligence but also seek help from the spam protection specialist Cloudflare. Internally, we keep IP addresses for a maximum of 7 days before they are either anonymized or deleted. Cloudflare receives anonymized and obfuscated IP addresses, most of which are deleted within days. Only a small sample of anonymized metadata remains with Cloudflare for up to 12 months. This sample is retained in order to diagnose malicious activity and improve the effectiveness of security measures. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA. The use of Cloudflare is based on our legitimate interest in providing our services as error-free and secure as possible (Art. 6 para. 1 lit. f GDPR). The Data transfer to the US is based on the standard contractual clauses of the EU Commission. In addition, Cloudflare has a certification under the EU-US Data Privacy Framework. For further information please refer to Cloudflare’s privacy policy.

We partner with “Okta” to offer an accounts feature which will allow you to sync information between our desktop browser and mobile apps amongst other features. In order to create an account, our partner “Auth0” (a subsidiary of Okta) will store your email address and will create a unique user ID for you. “Auth0” stores your credentials and the processing is based on performance of the contract to provide our login feature (Art. 6 para. 1 lit. b GDPR). If you consent, Auth0 will also store your profile picture (Art. 6 para. 1 lit. a GDPR).

We collect and process personal data that is required for the provision of optional account based features, based on performance of the contract to provide these features (Art. 6 para. 1 lit. b GDPR). This data is stored in EU based data centres. This information will be linked to your personal profile and will be deleted if you request deletion of your account. Furthermore, we only use this data for the stated purposes or for the use of the respective offer or service for which you have registered. The mandatory information requested during registration must be provided in full, otherwise we will refuse your registration. In the event of important changes, for example to the scope of the offer or technically necessary changes, we will use the e-mail address provided during registration to inform you in this way.

In addition, we will collect your IP address. This is based on our legitimate interest to identify suspicious activity and protect us from fraud (Art. 6 para. 1 lit. f GDPR). We collect event based analytics data which is stored in a self-hosted, safe, and fully encrypted web analysis tool (see “Analytics” section).

If you choose to enable the accounts sync feature then you can configure which browsing-related data you would like to sync across the desktop browser and mobile app (for example bookmarks, history, passwords, reading lists, open tabs, theme, extensions, apps and settings.) This data is all encrypted (using a user-supplied sync password) in your browser and stored in a self-hosted, EU based data centre (see “Analytics” section). The collection of this data is based on performance of contract to provide a sync feature (Art. 6 para. 1 lit. b GDPR). You can choose to remove this feature and delete your account at any time.

When you login for the first time, we will ask for your consent to receive follow up communications via email from us (which includes an onboarding email and newsletters). We partner with “Braze” to provide this feature (please see more information under “Third Parties”). You can adjust your preferences or revoke consent at any time in your account settings.

You can request the deletion of your data or delete your account at any time. For more details on how Okta/Auth0 handles data privacy, please refer to their policy.

When using our account feature, data may be transferred to the USA. The legal basis for the data transfer is the standard contractual clauses of the EU Commission, which were signed with the service provider. The provider is Okta, Inc. (including its subsidiary, Auth0, Inc.), 100 First Street, Floor 6, San Francisco, CA 94105, USA. Auth0 (subsidiary of Okta) has a certification under the EU-US Data Privacy Framework. For further information please refer to Okta’s privacy policy.

We have launched our desktop browser in two stages. If you signed up to our first stage beta test, we collect your email address which is required for the provision of contract to facilitate the download of the browser (Art. 6 para. 1 lit. b GDPR). There are optional data fields and provision of this data is based on your consent (Art. 6 para. 1 lit. a GDPR). This data is stored with Airtable (please see more information under “Third Parties”).

When you download the desktop browser, we ask for your consent to receive follow up communications from us about the browser and to get involved with surveys. The use of your email for this purpose is based on your consent to receiving marketing communications (Art. 6 para. 1 lit. a GDPR). You can unsubscribe at any time using the link at the bottom of our emails.

We collect event based data to learn about usage of the desktop browser and to improve our product features. This analytics data is stored in a self-hosted, safe, and fully encrypted web analysis tool (see “Analytics” section).

To improve our browser apps, we collect usage statistics such as the name of the device, its manufacturer, model, operating system number and app number or SDK version. We use device identifiers, either defined by us internally or specific to Ecosia as the app’s vendor. To measure the success of ad campaigns, we link these identifiers to Google Play’s Install Referrer on Android or use Apple’s privacy focused SKAdNetwork on iOS.

We use a 3rd party service called “App Center” to collect and analyse crash reports of our Android app. This includes data that helps us fix bugs, such as app number, device model, and operating system.

For more information on how “App Center” handles your data, see Microsoft’s Privacy Statement.

To enable you to search with your voice in our Android App, we use Google Speech Recognition services which are offered by the Android OS. This can be deactivated by the system settings.

To plant more trees, we use external ad platforms to reach new users. When a new desktop user installs the Ecosia extension, they see a page that pings a notification of the installment back to our advertising platform. To protect the privacy of your queries this page is not connected to our search service. This page allows us to know which ads helped us plant trees, and we can stop spending money on those that don’t. We regularly test new platforms and remove those whose services are not effective. Currently, we are using, or planning to test,Google Ads, Apple’s App Store, Facebook, Microsoft Bing, Twitch, TikTok and Taboola.

We never share your search data with ad services. You can see how much we spend on spreading the word in our monthly financial reports.

We may amend this privacy policy from time to time to keep it up to date. We will place any updates on this webpage and if we make any significant changes to this privacy notice, we will seek to notify you. This privacy policy was last updated on September 13, 2024.

You have the following rights with respect to your personal data:

• Right to information
• Right to correction or deletion
• Right to restriction of processing
• Right to refuse processing
• Right to data transferability
• In addition, you have the right to complain to a data protection supervisory authority regarding our processing of your personal data.

In relation to the General Data Protection Regulation (GDPR), the organisation responsible is:

Ecosia GmbH, Gerichtstraße 23, 13347 Berlin, Germany

Our Data Protection Officer can be contacted at privacy@ecosia.org or our postal address with the addition of "data protection".

Last modified: September 13, 2024