Of course it can be done, check your web server logs.
If you are using GET requests to send search queries to searxng, what you searched for will show up in the logs as
2024-10-31 123.321.0.100 /?query=kinky+furry+pictures
If you use POST requests the server admin can also easily enable logging those.
People hosting searxng can absolutely see what you searched for, along with your IP address, user agent string etc.
You are correct, I don’t care about cookies was acquired by avast. It is still GPL3 licensed and, according to the privacy policy, does not capture user data. But for those who don’t trust avast (which includes me), there is an independent fork called I still don’t care about cookies. The builtin Firefox cookie deletion settings are not granular enough for my usecase (with container tabs) and a hassle to configure for imo, which is why I still recommend the forked extension if it suits your usecase.
In Firefox, you can use the cookie autodelete extension (it’s open source) which deletes all cookies for sites you haven’t explicitly whitelisted. Same thing, integrates well with other privacy features on Firefox (like container tabs and I still don’t care about cookies, and is probably better maintained than the feature in DDG.
IMO starting with a more minimalistic base, and adding whatever features you need is a better approach that suits more use cases. Just reduce your extensions to what you really need, and deactivate or uninstall those you don’t need. Make sure what you are installing is open source, well-maintained and trustworthy (look at the github page: when was the most recent commit or release? how many contributors and stars are there? It’s not foolproof, but a good start and definitely beats closed source extensions). Having access to more extensions is not a bad thing.
EDIT: don’t use I don’t care about cookies as it was acquired by some shady companies. Use the independent fork called I still don’t care about cookies instead.
A VPN will not save you, they are easily worse for privacy in terms of user tracking. It centralises your entire web traffic in a single place for the VPN provider to track (and potentially sell).