Privacy, in plain language

The short version

• Surf has no accounts. We don't know your name or email, and there is nothing to sign up for.
• Your OCD data - themes, exposure logs, chat history, memories, and reflections - is stored only on your device.
• When you use Surf AI, what it needs to reply passes through our server to our AI provider, Anthropic. Surf asks first, and you can turn Surf AI off any time. Our server keeps none of it, and Anthropic does not use it to train its models.
• We do not sell data, show ads, or use ad trackers. This website sets no cookies and runs no analytics.

What stays on your phone

Everything you would worry about: your OCD themes and hierarchies, exposure plans and completion history, conversations with Surf AI, urge-surfing sessions, memories, reflections, streaks, and settings. If you tell Surf what to call you, during setup or in Settings, that stays here too, and so does any name you put on a report. Neither is ever sent to Surf AI or our server: when Surf AI greets you by name, it writes a blank and your phone fills in your name. If you delete the app, this data is gone with it - which is also why Surf offers a manual backup (below).

What leaves your phone, and why

• Surf AI requests. When you chat with Surf AI or use an AI-guided feature, such as personalized lessons or exposure suggestions, your phone sends what that reply needs over an encrypted connection: your recent messages, and the short profile Surf keeps on your phone so replies fit you, such as your themes, triggers, and the exposures you are working on. Our server passes this to Anthropic, our AI provider, and returns the reply. Our server does not store or log what you send. Anthropic keeps requests for up to 30 days to check for misuse (longer only if its safety systems flag a request) and does not use them to train its models. Surf never adds your name to these requests, and the profile is set never to save names. The only way a name reaches the AI is if you type one into a message yourself. Surf asks before it sends anything to Surf AI. If you say "Not now", nothing is sent and Surf works without its chats and personalized lessons. You can turn Surf AI on or off any time in Settings, then Your Data.
• A safety check. Before a message reaches the AI, our server checks it for signs of immediate danger, as described on our Safety page. Nothing about you or your message is recorded. We keep only an anonymous monthly count of how often crisis help is shown, which California law asks for.
• Where you heard about Surf. Setup asks how you found Surf, such as TikTok or a therapist. Your answer only adds one to an anonymous monthly count. It is not filed under your device ID or linked to anything else about you.
• A random device ID. Requests carry a random ID created when you install Surf. It is not your name, email, or advertising ID. We use it to keep daily limits fair and to prevent abuse, and it is also your Support ID. It stays the same after Delete All My Data, and on iPhone it can survive reinstalling the app.
• Usage events. The app sends a small set of events, such as "lesson completed" or "paywall viewed", with basic device details like phone model, system version, language, and time zone. They show us which parts of Surf help and where people get stuck. They go to PostHog, stored in the EU, filed under your device ID. They are not linked to your name or email, we do not keep your IP address or location with them, and they never include what you write or the names of your themes, triggers, or exposures. You can turn them off any time in Settings, then Your Data, with "Share Usage Stats".
• Crash reports. If the app crashes, a technical report goes to Sentry, stored in the EU, so we can fix it. Reports are set up to leave out personal information and anything you write, and they are not linked to your Support ID.
• Update checks. When you open Surf, it asks Expo, our update provider, whether a newer version with fixes is ready. Expo sees your IP address, phone system, Surf version, and a random install ID, plus the error message if an update fails to start. It never sees what you write.
• Purchases. If you subscribe to Surf Plus, Apple or Google processes the payment, and our subscription partner, RevenueCat, records your subscription under your device ID. We see whether you are subscribed, never your payment details.
• App Store ads. On iPhone, if you installed Surf after tapping one of our ads in App Store search, Apple tells RevenueCat which ad it was, such as the search term. It's filed under your device ID so we can see which ads lead to subscriptions. Apple does this without your advertising ID and without asking to track you.

Backups are yours, literally

Because there is no cloud copy, Surf lets you export a manual backup file of your data. That file is created on your device and goes wherever you choose to put it, so keep it somewhere private. You can also add a password when you create it. Restoring or deleting it is entirely in your hands.

Your controls

• Export: create a backup file of everything, any time, from Settings.
• Delete: erase all Surf data from your device, any time, from Settings. We keep no copy of your themes, exposures, chats, or reflections, so this is final.

Delete your data

Almost everything Surf knows about you lives on your phone. To erase it, open Settings, then Your Data, then Delete All My Data.

A few small things are kept off your phone, filed under your random device ID, which the app shows as your Support ID: the usage events, your subscription record if you bought Surf Plus, and short-lived server logs that note which feature was used and when, under a scrambled form of the ID. None of them contain what you wrote. To have them deleted, open Settings, then Your Data, and tap "Ask us to delete them" at the bottom, which emails us your Support ID. You can also write to hello@surfocd.com with the Support ID from that screen. We delete the usage events and subscription record and confirm by reply; server logs expire on their own. Crash reports are not linked to the Support ID, contain no personal information, and are deleted automatically.

How long we keep things

• On your phone: until you delete it, or the app.
• Surf AI requests: our server keeps none. Anthropic keeps them for up to 30 days, longer only if its safety systems flag a request.
• Server logs: up to 30 days.
• Usage events: up to 12 months.
• Crash reports: up to 90 days.
• Update checks: Expo keeps them only as long as reasonably necessary.
• Subscription record: until you ask us to delete it, except where tax and accounting rules require us to keep it.

Designed not to become a compulsion

People with OCD know that an app itself can get pulled into the checking loop - one more board to monitor, one more history to reread. Surf is deliberately built without those hooks: there is no feed to refresh and no community board to check, the companion never gives reassurance (rereading comforting answers is a compulsion, and we refuse to feed it), and urge-surfing chats are designed to be left behind, not reread - they do not join your chat history. Privacy here means protecting you from surveillance and from the loop.

This website

surfocd.com is a static site. It sets no cookies, runs no analytics scripts, and collects nothing. The interactive urge-surfing wave runs entirely in your browser and stores and sends nothing.

Children

Surf is for people aged 13 and over. We do not knowingly collect personal information from children under 13. If you think a child under 13 has used Surf, write to us with the Support ID from their app and we will delete anything tied to it.

Legal details

Who is responsible

Surf OCD is made by Playcake Ltd, a company registered in England and Wales (company number 09700207), with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Playcake Ltd is the data controller for the data described on this page under UK data protection law, and is registered with the UK Information Commissioner's Office (registration number ZC260236). Contact: hello@surfocd.com.

Why we use it

• Surf AI requests: to provide the features you choose to use.
• The device ID and server logs: our legitimate interest in keeping Surf working, fair, and safe from abuse.
• Usage events, crash reports, and update checks: our legitimate interest in understanding what helps and fixing problems.
• Purchases: to provide your subscription, and to meet tax and accounting obligations.

Who processes it

Our service providers process data only on our instructions: Anthropic (AI replies), PostHog (usage events), Sentry (crash reports), RevenueCat (subscriptions), Render (hosting for our server), and Expo (app updates). Each is bound by its data processing terms to protect your data at least as well as this page describes. Some of them are in the United States. Those transfers are covered by the safeguards UK law requires: the standard contractual clauses with the UK Addendum, in each provider's data processing terms, or for Expo, the UK-US data bridge.

Your rights

You can ask to access, correct, or delete the data we hold about you, to restrict or object to how we use it, or to get a copy. Most of this you can do yourself on your phone: export a backup, turn off usage stats, or delete everything in Settings. For the little we hold off your phone, email hello@surfocd.com with your Support ID, and we will reply within one month. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office at ico.org.uk. If you live in Washington or Nevada, see our consumer health data privacy policy.

Changes and contact

If we ever change how Surf handles data, we will update this page and the "last updated" date above before the change takes effect. Questions deserve answers: hello@surfocd.com.