Most web trackers work similarly. When a user clicks on something important, a signal is sent via another request to a monitoring server, usually Google Analytics/Ads/A-B testing or something like it. In this case DDG just made their own tracker.

But yes, it's entirely an exercise in trust. There is nothing stopping them from being nefarious with this collected information, except their brand. Someday they may sell out, or maybe they already have, who knows?

Thing is, nobody has your best interests at heart. These are all profit-driven enterprises and everyone has their price. DDG just markets itself as less evil.

You don't want to trust anyone? Then don't. Block the trackers, rotate through VPNs, always use incognito, etc. Or just accept it as a cost of searching and move on with your life... your profile is just going to be one of millions anyway, even if they do track you. At least they don't have the cross-product integration and remarketing that Google's billions can buy.

At the end of the day search is an expensive endeavor requiring constant spidering and curating and anti-spam efforts. If you get it for free, you're the product. DDG isn't magically above the economics.