Consumer health data privacy policy

What we collect, and why

Surf stores your OCD data on your phone. We only receive consumer health data in these cases:

• What you send to Surf AI: your recent messages and the profile Surf keeps on your phone, such as your OCD themes, triggers, compulsions, anxiety ratings, and exposures. We use it only to generate the reply you asked for. It passes through our server to our AI provider, and we do not store it.
• App usage events: because Surf is an OCD app, events such as finishing a lesson or an exposure can show that you are working on your mental health. We use them to understand which parts of Surf help and to improve the app.
• Crash reports: technical details about app errors, used to fix problems.
• Subscription status: whether you subscribe to Surf Plus, used to provide your subscription.
• Which App Store ad you came from: on iPhone, if you installed Surf from one of our App Store search ads, Apple tells RevenueCat which ad it was, such as the search term. We use it to see which ads lead to subscriptions.
• Update checks: your IP address and a random install ID, sent to Expo when you open Surf, used to deliver app fixes.
• Server logs: which feature was used and when, under a scrambled form of your device ID, used to keep Surf running and prevent abuse.

Where it comes from

Directly from you, through the Surf app. If you installed Surf from one of our App Store search ads, Apple also tells RevenueCat which ad it was. We do not buy consumer health data.

Sharing

We do not share or sell consumer health data. It is processed only by service providers acting on our behalf, which the law does not count as sharing: our AI provider (Anthropic), analytics (PostHog), crash reporting (Sentry), subscriptions (RevenueCat), hosting (Render), and app updates (Expo).

Tracking across other sites

No third party collects consumer health data about you across other websites or apps through Surf. The app has no ad trackers, and this website sets no cookies and runs no analytics.

Changes to this policy

If we change this policy, we will post the new version here with a new effective date. For material changes, we will also tell you in the app where we can before they take effect, and ask for your consent first where the law requires it.

Your rights

You have the right to:

• confirm whether we collect or share your consumer health data, and access it, including a list of any third parties and affiliates we have shared it with;
• withdraw your consent to its collection and sharing;
• have it deleted.

Most of your data is on your phone, where you can see it, export it, and delete it yourself in Settings, then Your Data. To stop usage events, turn off "Share Usage Stats" on that same screen. To stop all collection, delete the app.

For anything else, email hello@surfocd.com with the Support ID shown in Settings, then Your Data. The "Ask us to delete them" link on that screen writes the email for you. We use the Support ID to find your data, so we never need your name. We respond within 45 days, and if we need up to 45 more, we will tell you why within the first 45. Requests are free up to twice a year.

Appeals

If we decline your request, you can appeal by replying to our decision, or by emailing hello@surfocd.com with "Appeal" in the subject. We respond to appeals within 45 days. If we deny your appeal, you can contact the Washington State Attorney General or the Nevada Attorney General.