I don't think private.sh can provide the kind of protection that they seem to imply is their goal; sure, they can encrypt your traffic in the browser, but unless the search engine(s) they use as a backend are the ones are decrypting it then private.sh controls the exit nodes and can MitM anything they want.

Yes, the search engine they use (Gigablast) is the one decrypting. From the private.sh main page:

> Every single search request from our website and extension is encrypted locally on the client and proxied through our service, stripping away your public IP address ensuring that only the search provider is able to decrypt and see your query without any knowledge of who you are.

> The results are returned to you through our proxy and are rendered locally on your machine only using javascript running on your machine.

I haven't used it, so I don't know what their results are like, but you seem to be mistaken about the privacy.

It's just marketing bullshit.

The query is encrypted with the publickey of gigablast, clientside. Private.sh cannot see the query/search. And vice versa, the results are encrypted with the client's public key and thus can only be decrypted by the client!

What sounds like a complete scam at first looks like a viable Startpage successor on second glance.