1. A method of querying a remote service without revealing a private document to the remote service, comprising: at a main computer, receiving from a client a signature generated from a user's private document, without receiving the document; querying an intermediate database with the signature of the private document to generate an intermediate result set comprising intermediate database documents, based on a computation of similarity of the signatures of the intermediate database documents to the signature of the private document; computing a relevance factor for each document of the intermediate result set; computing a reconstruction error based on the relevance factors of all the documents in the intermediate result set and determining a confidence in the intermediate result set based on the reconstruction error; querying the remote service with a query which is based on the intermediate result set, whereby the user's private document and the signature of the private document are not revealed to the remote service; receiving a final result set from the remote service based on the query; and weighting the final result set based on the relevance factors.