Privacy Policy

1. Information We Collect

Account information: your email address, username, display name, date of birth, and the profile details you choose to add. If you complete the optional identity verification, the name, date of birth, country and region you type in, and a one-way value derived from them that stops one person verifying two accounts. We never ask for or store an identity document.

Content you create: posts, shorts, stories, threads, polls, comments, messages, and the media you upload.

How you use Surf: likes, follows, views, searches, watch time, which posts were shown to you and where they ranked, plus device, log and approximate location derived from your IP address at our host's edge. Precise location is collected only if you turn on a feature that asks for it and grant the permission.

Subscription and payout information: plan, amount, renewal dates and transaction identifiers. Card details go straight to Stripe and never reach our servers. If you take payouts, Stripe collects your identity and tax details directly.

2. How We Use It

To run Surf: deliver your content, sync your devices, process subscriptions and payouts, and keep your account secure.

To rank your feed and suggest things to you, using your own activity and the controls you set. Every one of those controls is yours to change, and you can switch to a plain reverse-chronological feed at any time.

To keep Surf safe, to answer you, and to meet our legal obligations. We make money from subscriptions and from a fee on creator earnings. We do not run ads, we do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We do not train AI models on your content, and our agreements with the model providers we use forbid them from doing so.

3. End-to-End Encrypted Messages

One-to-one conversations, and group conversations up to 256 people, are end-to-end encrypted on your device. There is no switch to turn it off and no plaintext fallback. We hold ciphertext, so the contents are not readable by us and are excluded from anything that runs on our servers. Groups larger than 256 are not encrypted, and the app shows no lock on them.

Some things inside an encrypted conversation are not encrypted, and we would rather list them. Your messages, a poll's question and options, a voice note and its transcript, an attachment and its filename, a shared location card and a shared contact are sealed. Our servers do see that the conversation exists and who is in it, when each message was sent, delivered and read, reactions and who added them, a poll's running tally and who voted for what, the moves in a game and their order, and, if you start a live location share, the exact coordinates it reports while it runs.

Translating a message and transcribing a voice note run on your device, so the readable text is never sent to us. Summaries, task extraction and poll suggestions switch themselves off for the whole conversation when they find encrypted content.

4. On-Device AI, and What Runs on Servers

On your device: finding a face to frame a shot or apply a lens, separating a subject from its background, screening an image before you upload it, sorting text into topics, translating a decrypted message, transcribing a voice note before it is encrypted, and the liveness measurement in identity verification. The content does not leave your device for those steps, although the model file is downloaded from Hugging Face, jsDelivr or Google, which see your IP address the way any site you visit does.

On servers: summarizing, translating a public post, answering questions, generating or improving text, describing an image, transcribing uploaded audio, reading text aloud, building the embeddings behind search, and the moderation scan that decides whether uploaded media may be shown. Those send the relevant content to a provider named in the full Privacy Policy.

Face detection is not face recognition. It finds that a face is present; it does not work out whose. Identity verification does measure face geometry, on your device, and no image or video of you is ever transmitted or stored. The full policy sets out the biometric notice, the retention schedule and the destruction schedule that govern it.

5. Who Else Sees It

Other people, according to the settings you choose. Anything you post publicly is public, and anyone you share with can keep their own copy.

Service providers under contract, who may use it only to work for us: Vercel, Supabase, Cloudflare, Stripe, Cerebras and Resend.

Parts of the product load from a company we do not act through, which sees your IP address in order to deliver them: map tiles, the GIF picker, music previews, model files, the sign-in captcha, an embedded video player, and web push. The full policy lists each one and what it receives.

We do not sell your personal information. We disclose it when valid legal process requires it, or to protect people from harm, and we scrutinize every request we get.

6. Supervised Accounts

An account under 18 can be supervised by up to two guardians, and only if both sides agree. It is never a condition of having an account.

While supervision is active, a guardian can see screen time, published posts and stories, searches, who is followed, and safety alerts, and can set limits. A guardian never sees the contents of an encrypted message. Messages are checked on the device against safety patterns as they are read and as they are sent; where a match is serious, a guardian sees a category and a severity, never the words.

Supervision and every under-18 protection end automatically at 18.

7. How Long We Keep It

Your content stays until you delete it or your account. Deleting your account is scheduled 30 days out, and during that window you can withdraw the request from settings. Signing back in does not withdraw it, on purpose. After the window it cannot be undone.

Some things are shorter: engagement signals and search history, 90 days; which posts you were shown and where they ranked, 30 days. Some are longer because they have to be: billing records the law makes us keep, a value derived from an email address that has used a free trial, and the history of usernames an account has held.

A media file is removed from our storage when you delete it, and a copy already held in a delivery cache ages out after that.

8. Your Rights

Wherever you live, you can see and change most of your information in settings, download a copy of your profile, posts, bookmarks and follow lists, and delete your account.

Depending on where you live, you may also have the right to a complete copy of what we hold, to correct it, to have it deleted, to a portable copy, and to opt out of any sale, sharing or targeted advertising. We do none of those three, so there is nothing for an opt-out preference signal such as Global Privacy Control to stop. If we ever introduce processing one would apply to, we will honor the signal and say so here first.

To make a request, use the data and privacy category of the form at surfplatforms.org/report, which gives you a tracked reference, or write to legal@surfplatforms.com. We verify requests, answer within the time the law allows, and never treat you differently for asking.

9. Security

Encryption in transit on everything, encryption at rest by our infrastructure providers, access control enforced in the database rather than only in the app, least-privilege staff access, and an append-only record of every moderation action. We have not completed a SOC 2, an ISO 27001, or a third-party penetration test, and we claim no certification.

No system is perfectly secure, and security also depends on your device, your network and your password. This describes our practices; it is not a warranty.

If a breach affects your personal information we will investigate, act to contain it, and notify you and the regulators the law requires within the time the law requires. Tell us at once at contact@surfplatforms.com if you think your account is no longer secure. We welcome good-faith security research at the same address.

10. Children

Surf is not for anyone under 13, we do not knowingly collect their information, and an account we learn belongs to someone under 13 is removed along with its data. Accounts we know belong to someone under 18 start closed rather than open, with stricter privacy, contact and content defaults enforced on our servers, some of which cannot be switched off. We show no targeted advertising to anyone.

11. The Full Policy

This is a summary. The Privacy Policy that governs is at surfplatforms.org/privacy-policy, it is incorporated into our Terms of Service by reference, and it carries the detail this page leaves out, including the complete list of third parties, the biometric notice, every retention period, and the region-specific rights that apply to you. Where this summary and the full policy differ, the full policy controls. Our Terms of Service, End User License Agreement and Community Guidelines are at surfplatforms.org/terms, surfplatforms.org/eula and surfplatforms.org/guidelines.

12. Changes

We update this policy as Surf changes. Where a change is material we will tell you in the app or by email before it takes effect, and we will update the date above.