The search history question: who sees what your family asks

People confess to search boxes what they would not tell their closest friend — that is not a metaphor, it is the business model of the modern web. The query stream is the rawest personal data that exists: intentions before they are actions, worries before they are spoken. For a frum household the stakes carry extra dimensions: the family's questions map its health, its finances, its children's struggles, its halachic edge cases — a profile no one consented to sitting in a stranger's analytics. The mainstream deal is simple and rarely read aloud: free search, paid for by the diary.

The vendor question: where queries go

On engagement-funded engines, the query's journey is the product: logged, tied to an identity or its shadow, modeled into interests, and rented to advertisers as targeting. The community has already seen where that road runs in the location context — the documented record in family location privacy — and the search version is the same economics with more intimate fuel.

Private-by-design search inverts the deal at the architecture level, and the inversion is only credible when the engine has a different business reason to exist. An engine built as community infrastructure — the position of KolBo Search inside a platform whose stated posture is that family data stays in the family — does not need the diary: queries serve retrieval, not a profile; history exists for the household's use, not a bidder's. The sharpest question to ask any search vendor is the one from the family-visibility trade-offs: who else sees? The answer should be short.

“The query stream is a diary. The only respectable business model for a diary is not reading it.”

kolbo.life

The household question: the diary inside the home

The second privacy question is the one privacy articles skip: how search history lives between family members. Real cases, real tensions:

• The shared-computer blur. On the kitchen machine, whose searches are whose? Per-person identities — the same per-person architecture that runs the household's tiers — keep the eleven-year-old's dinosaur queries and the parent's medical worry from sharing one confusing ledger.
• The parent's window. For children, search visibility is a legitimate chinuch instrument — scoped like every other visibility: known to the child, narrowing with age, per the trust ladder. The nine-year-old's queries are a parenting surface; the seventeen-year-old's are mostly a dignity surface. Secret monitoring is the same corrosive shortcut in search as everywhere else.
• The adult's legitimate quiet. Spouses' searches include each other's surprise gifts, health questions not yet ready to share, and the ordinary interiority every person is owed. A household standard that respects adult privacy is not a loophole — it is the tznius of the digital home.
• The teachable delete. History that the user can clear teaches ownership; history only an admin controls teaches surveillance. The strong pattern gives each tier age-appropriate control of its own diary, with the family's rules doing the governing that spyware cannot.

The practical setup

1. Per-person identities everywhere search happens — the foundation for both privacy directions at once.
2. History retention as a family decision — kept-for-me (the "what was that site again?" utility), kept-briefly, or kept-not-at-all, chosen per tier and said out loud.
3. The sensitive-search etiquette — teach the household that health, shidduch, and financial questions deserve the same discretion digitally as verbally; some questions are best asked from the parents' identity, or of a rav rather than an index.
4. The audit that respects itself — whatever visibility parents keep, it is named to the child. The rule of the whole architecture: visibility known builds trust; visibility discovered builds workarounds.

Frequently asked questions