Privacy
What we hold, and what we cannot.
Not a policy you have to trust. A list of what is on the server, and of the requests the app declines to make on your behalf.
What reaches our servers
Delivery needs to know where a message is going and when it arrived. Everything else is sealed with it.
What you wrote
the flight lands at 6:40, terminal 2
What we store
8f2a41c7d9e0b35a6114fc820d7e93a15c4b6802ff31d95e7a08c264b19d3f7e…
There is no readable copy.
- Message body
- Ciphertext only
- Attachments
- Ciphertext, each file under its own key
- Who it is for
- Conversation and sender, so it can be delivered
- When it was sent
- Timestamp, and whether it was edited
- Voice note
- Length only. The audio, transcript and waveform are sealed
- Shared post
- That it is a post. Author, preview and target are sealed
- Location, contact card, sticker
- Sealed in full
- Poll
- Vote counts. The options themselves are sealed
Sealing is an allowlist rather than a filter: a field is sealed because it was recognised as something worth sealing. Anything a future version adds and does not recognise stays readable until it is added to that list, which is the honest way round for a rule that has to fail somewhere.
Features that switch themselves off
Encryption is only worth the features that respect it. These are the ones that step aside in an encrypted chat rather than quietly making a server request.
A link you type fetches nothing
Pasting a URL into a normal chat asks our server to fetch a preview. In an encrypted conversation that request is never made, because making it would tell the server what you were about to send before you sent it.
Nothing is translated before it is sent
Translate-before-send is not offered in an encrypted chat. It would have to upload what you typed, and it would leave a translation of it behind.
Search sends message ids, never words
Searching runs against the copy your device already decrypted. Jumping to a result asks the server for a message by id. Your query is never part of a request.
Photos lose their location on the way out
Every image is re-encoded in the browser before it is encrypted. That step discards the EXIF block, which is where the camera writes the GPS coordinates.
The same rule covers the parts of Surf that read a conversation to be useful. Catch-up summaries, task extraction and poll suggestions all check for an encrypted message first and disable themselves for the whole thread if they find one. A fully encrypted conversation produces no server-side derived data at all.
On the device, at rest
Being unreadable on the server is half of it.
The decrypted copy is sealed too
The readable history your device keeps is itself encrypted, under a key marked non-extractable, so a copy of the browser's storage files yields ciphertext and a key that cannot be exported. If a device has no usable keystore the history stays in memory rather than being written in the clear.
A message that failed to send is sealed as well
Text that could not be delivered survives a reload so you can send it again. It is written into the same sealed store, and dropped entirely when you switch accounts.
Who can see that you are there
The signals around a message, and what each one costs you.
- Typing indicator
- A live presence channel. Nothing is written to any database
- Read receipts
- Reciprocal: turning them off retracts the ones you sent and stops you seeing others'
- Turning receipts off
- A Sapphire setting. Free accounts send them
- Unread badge
- Separate from receipts, and never shared with the other side
- Blocking
- Silent. No message, no notification, nothing on their end
If someone demands your messages
What we are able to hand over.
What we hold is the sealed message and the routing that delivered it: which conversation, which sender, when. A lawful demand gets that. It does not get a readable message, because we do not have one and there is no key on our side that produces one. The same is true of a backup: the server holds a wrapped key it cannot unwrap.
Deleting your account schedules a teardown thirty days out, and it can be cancelled inside that window. The in-app data export covers your profile, posts, bookmarks and follows. It does not include your messages, for the same reason nothing else here does.
Surf's privacy policy covers the account this signs you in with.
What we have not done
There is no third-party audit of this implementation and no published source. The primitives are standard and named on the security page so you can check what they are, but that is a different claim from an audited build, and we would rather say so here than let the wording imply otherwise.