Hubert Burda Media · Munich · 2015–2020

Cliqz & MyOffrz

Europe's answer to Google — and why it lost

Cliqz was Hubert Burda Media's bid to build a European alternative to Google: a privacy browser with its own independent search index, paid for by an advertising system that never saw a single user's data. Three products, roughly 800k monthly active users in Germany, five years. I owned the consumer-facing surface across all of them — running the research, building the personas and prototypes, shipping the front end, and A/B testing what actually changed behaviour.

Role: UX Expert / Software Engineer — product ownership of the consumer surface
Timeline: 2015 – 2020 · 5 years
Focus: Browser · Search · Ad system

Tech Stack

JavaScriptHTML/CSSFirefox forkBrowser extensionsSketchAdobe XDA/B testingUser research

~800k: monthly active users in Germany
3: products: browser, search, ad system
93%: Google's search share we were up against
5 yrs: from first prototype to shutdown

A look inside

01 — The Problem

Cliqz was not losing on technology. Its search answered from an independent index in about 160 milliseconds per keystroke, and its ad system was genuinely private in a way nothing else on the market was. It was losing on perception. The search worked, and users did not notice it happening. The advertising protected them, and users felt watched. Both were problems on the surface layer — the part I owned — and neither could be fixed by making the engine faster.

02 — The Solution

I stopped treating these as interface problems and started treating them as belief problems: what does a user think is happening, and what in the product told them that? That reframing produced the work I actually shipped — redesigning the moment of the search result so it could be perceived at all, and rebuilding the ad system's onboarding so the privacy model was legible before the first offer ever appeared. Every change went out behind an A/B test on real traffic, because with a habit this strong, opinions were worthless.

Problem 01

The search nobody noticed

Cliqz's strategic bet was to never look like a Google competitor. There was no search results page — deliberately. Burda did not want to declare war on Google and did not want to be marketed as its rival, so search lived inside the address bar: you started typing, and the top three results dropped down underneath, live, at roughly 160 ms per keystroke.

On paper this was strictly better. No page load, no round trip, about two seconds saved per answered query. In testing it did move behaviour — people who used the dropdown sent noticeably fewer queries onward to Google.

But watch a real person type a query and you see the flaw immediately: they are looking at the keyboard. There is no Enter key, no page transition, no tab change — none of the signals a browser normally uses to say "something happened." Users typed their query blind, looked up, hit Enter out of twenty years of muscle memory, and landed on Google anyway. We had not built a slow product. We had built a fast one that fired in the one second nobody was watching.

A dedicated search page — the thing that would have made the product legible in a single glance — only shipped in beta in December 2019. The shutdown was announced five months later.

The perception gap

What shipped

wetter ber

Wetter Berlin — heute 18°C, bewölktwetter.com
Wetter Berlin 14-Tage-Trendwetter.de
Berlin — Wetterbericht & Warnungendwd.de

~160 ms

per keystroke

Top 3

plus history & tabs

~2 s

saved per answered query

but

What users experienced

Eyes down on the keyboard.

No Enter key. No page load. No tab change. Nothing in the interface announced that the answer had already arrived — so people finished typing, pressed Enter, and left for Google out of habit.

The finding: we had not built a slow product. We had built a fast one that fired during the one second the user was not watching.

Problem 02

The ads that felt like surveillance

MyOffrz was how the whole thing was meant to pay for itself: contextual offers shown in the browser at the moment they were useful. Architecturally it was the inverse of adtech. Advertisers uploaded campaigns with trigger rules, every campaign was broadcast to every browser, and it slept there. The browser read your searches and clicks locally, matched them against those rules on your own machine, and woke up a single offer. No profile was built, no identifier was assigned, and no browsing data was ever sent anywhere.

Users did not believe it. An offer for car insurance appearing seconds after you searched for car insurance reads as one thing only: they are watching me. The accuracy that proved we were not tracking them was the exact thing that convinced them we were.

This is the hardest category of product problem — where the truth is invisible and the lie is intuitive. The fix was never going to be a longer privacy policy. It had to be built into the moment of first contact, before any offer appeared.

Local-first offer engine

Advertiser

Campaign + trigger rules

IF search = "Autoversicherung" → offer B

Every campaign is broadcast to every browser — the same payload for everyone.

The device boundary

Inside the browser

1
Dormant — Every campaign ships to every browser and sleeps there.
2
Signals — Searches, visits and clicks are read locally — and stay local.
3
Match — The trigger rule is evaluated on the device, not on a server.
4
Surface — One offer wakes up and appears at the relevant moment.

Nothing personal travels back

No profileNo identifierNo browsing history

Only an anonymous conversion signal when an offer is actually redeemed — enough to bill the advertiser, not enough to identify anyone.

The paradox: users called it creepy targeting. It was a rule engine running on their own laptop, and it was the least invasive ad system any of them had ever used.

The decisions

What I did about it.

Made the privacy model the onboarding, not the fine print

Rebuilt the ad-system onboarding so the local-only mechanic was demonstrated up front — what stays on your device, what an offer is, and how to turn it off — instead of being buried in settings and legal copy.

→ −14% churn on the advertising system

A/B tested the offer experience instead of arguing about it

Ran continuous in-house experiments on live traffic across the offer surface — timing, framing, placement, dismissal — and let real behaviour decide, not internal taste.

→ up to +7.3% retention and engagement

Grounded the work in journeys and personas built from research

Ran the user research myself and turned it into journeys and personas the whole team could argue with — which is how the "eyes on the keyboard" finding surfaced at all. It is not visible in analytics; you only see it by watching someone type.

→ shared language for why the search was invisible

Prototyped before writing production code

Produced low- and high-fidelity prototypes that developers and designers built against directly, so interaction questions were settled in a prototype rather than in a sprint.

→ shorter development cycles across three products

The method

How the work actually ran.

1
Research
Interviews and observation sessions with real users, in German-speaking markets.
2
Journeys & Personas
Findings turned into artefacts the team could design and argue against.
3
Prototype
Low- and high-fidelity prototypes to settle interaction questions early.
4
Ship the surface
Implemented the production front end for browser, search and offers.
5
A/B test
Every meaningful change validated on live traffic before it stayed.
6
Feed it back
Results fed the next round of research instead of the next opinion.

Scope

What I owned.

Owned the consumer surface across browser, search and the ad system

Ran the user research end-to-end — interviews, journeys, personas

Built the prototypes the dev and design teams worked from

Shipped the production front end, not just the specs

Designed and ran in-house A/B tests on live user behaviour

Worked inside a hard privacy constraint: no user data leaves the device

05 — Why It Matters

Cliqz shut down in April 2020 — Burda withdrew funding, and a search engine serving several hundred thousand daily users could never cover its own infrastructure. But the technology did not die. The search team's engine became Tailcat, Brave acquired it in 2021, and it is now Brave Search, the default in a browser with tens of millions of users. Ghostery, which Cliqz had acquired in 2017, is still shipping today. The bet was right and the timing was wrong — and I got five years of watching, at close range, what happens when a product is better than the habit it is trying to replace.

Afterlife

Where it ended up

Cliqz was shut down on 29 April 2020. Most of what it built is still running under other names.

Brave Search

The Cliqz search team rebuilt the index as Tailcat. Brave acquired it in March 2021 and it became Brave Search — now the browser default.

Ghostery

Acquired by Cliqz in 2017, spun back out and still actively maintained as a tracker and ad blocker. Its private search moved to closed beta in June 2026.

The privacy playbook

On-device intent matching with no server-side profile — the model MyOffrz shipped in 2018 — is now standard positioning across the privacy-tech market.

06 — Impact & Value

What it’s worth.

−14% churn

on the advertising system, after rebuilding onboarding around the privacy model.

+7.3%

retention and engagement on ad experiences, validated through A/B testing.

~800k MAU

in Germany across the browser and extension products I shipped the surface for.

Shipped in Brave

The search engine this team built now runs as Brave Search, that browser's default.

08 — What I Learned

Takeaways.

A product that beats a habit on the numbers still loses if the user never perceives the moment it won. Speed you cannot see is not speed.
Strategy leaks into the interface. The decision not to look like a Google competitor was a boardroom decision — and it landed on my surface as a product that could not explain itself.
When the honest thing looks like the dishonest thing, no amount of copy fixes it. Trust has to be built into the mechanic and shown before the first interaction, not after.
Analytics tell you people left. Only watching someone use the thing tells you they were looking at their keyboard.
Being right early is indistinguishable from being wrong. Cliqz's privacy thesis is now the industry consensus — it just needed a balance sheet that could wait for it.

Public record

Five years inside a product that was right about privacy and wrong about habit. Most of what I do now — research first, prototype before code, let the A/B test settle the argument — came out of that building.

View All Projects Let’s Connect