Questions and answers.
The ones people run into most.
Getting in
- Do I need a phone number?
- No. An email address and a password, a passkey, or a Google account. We do not ask for a phone number and do not store one.
- Do I need a Surf account?
- Yes, and it is the same account. Surf Messenger is a second door into conversations you may already have. If you are signed in on Surf, opening the messenger signs you in here too.
- Is there an app to install?
- There is no App Store or Play Store app. It runs in a browser and adds to your home screen on iPhone and Android, where it opens in its own window and starts without a network. On a computer you can add it the same way or download the Mac or Windows build.
- Does it cost anything?
- No. Encryption, groups, calls, search and backups are all on a free account. Creating a community, turning read receipts off, transcribing voice notes and hosting a live game are Sapphire features.
What we can see
- Can you read my messages?
- No. A message is encrypted on your device before it is sent, and the encrypted version is the only one we hold. A direct message that cannot be encrypted is not sent, rather than sent in the clear.
- What does a notification say, if you cannot read the message?
- The push we send carries who it is from and the id of the message, and no text, because the server that sends it has no text to give. Your device then looks the message up in its own sealed history and fills in the words itself. If it cannot, the notification says only New message. Your conversation list works the same way: the preview there was decrypted by your own device.
- Does search upload my chats?
- No. An encrypted message is only ever searched in the copy this device decrypted, and a result is opened by asking our server for that message by id. The words you search for are sent to the server as well, because it looks through what it stores readable at the same time. Anything this device has no key for is counted and named in the results.
- What happens if someone demands my messages?
- We can hand over what we hold, which is the encrypted version and what was needed to deliver it. We cannot decrypt it, and we hold no key that produces a readable copy.
- Is there anything that is not encrypted?
- Four things. A group that was already above 256 people when the cap arrived is stored readable and shows no lock, because the group scheme stops there. Messages from before encryption shipped were stored readable and never re-sealed. The moves of a live game are readable so the server can referee it. And the notice the app posts when it detects a screenshot is a plain system message.
Your history
- Why is my history empty on a new device?
- Because only your devices can unlock your chats, a new one cannot read what it was not there for. Approve it from a device you already use, or restore your backup, and your history comes with you. The app counts what it cannot open and offers the route that applies.
- What happens if I lose my recovery key?
- The backup stays sealed and nobody can reissue the key, including us. Your messages survive on any device that already holds them, and a device that does not will never be able to read what came before it. Write the key down and keep it somewhere safe.
- Does signing out erase my messages from this device?
- No. Signing out ends the session; the decrypted history stays sealed in this browser's storage under a key that cannot be exported from it. Removing the account from the device is what erases the keys, the decrypted history and anything derived from it.
- Can I export my messages?
- No. The export covers your profile, posts, bookmarks and follows, which are the things our servers can read. Your messages are not among them, because our servers cannot read them.
- Can I delete my account?
- Yes. Deletion is scheduled thirty days out and can be cancelled inside that window.
Moderation, audits and money
- How do you handle abuse if you cannot read anything?
- With controls you hold yourself. Someone you do not follow goes to a separate tray, and blocking sends nothing to the person blocked. Reports go through Surf, where account-level action happens.
- Has this been audited?
- No. Nobody independent has audited it and the source is closed. The primitives are standard and listed on the security page.
- How is this paid for?
- Donations. There is no advertising. Page views and load times are measured to keep the app fast, and nothing about a message is in that data.
Something else
If your question is not here, Surf's help centre covers the account this signs you in with, and contact reaches a person. Anything you have found in the encryption itself goes to contact@surfplatforms.com. No Surf account yet? Create one.