Privacy

What happens to your photos, your voice, your phone number and your location when you list a board or contact a seller. Written to be checked, not skimmed.

Last checked against the software on 5 September 2026. It describes what SurfPoint does, in the words of the people who built it. A lawyer has not reviewed it yet.

How this page was written

Somebody read the SurfPoint source code and wrote down what it actually does. That is what this page is. It is arranged the way a privacy policy is arranged so a lawyer can check it against the product, and it has not been through that check yet. Where the software has no answer, this page says so instead of inventing one.

The date at the top is the day the code was read. If you find something here that does not match what the site does, tell us and we will fix the page or the software.

The short version

Your board photos go to OpenAI, which reads the specs off them. They are also served from a public web address with no password and no expiry.
A description you dictate is turned into text and sent to OpenAI. The recording itself is never stored by SurfPoint.
When a buyer taps through to you, they leave for WhatsApp and your phone number is in the address that opens.
Your listing is a public page. Search engines index it, including the words you wrote yourself.
There is no advertising pixel and no tracking cookie. One measurement script counts page views without identifying you, and the only cookie keeps you signed in.
SurfPoint takes no payment and never sees a card.

Who is responsible

GEWE GmbH, a company in Switzerland, runs SurfPoint and decides what happens to the data described here. The full company details, including the address you can write to, are on the imprint page.

For anything about your data, write to hello@surfpoint.io.

What we store when you list a board

Your name and your picture: If you sign in with Google, we copy the name and the profile picture Google hands us and show them on your listings. You are never asked to type them and there is no step where you approve them. Ask us and we will change or remove either.
Your email address: Held by Supabase, which runs sign-in for us. It is not stored in the SurfPoint tables and it is never shown on a listing.
Your WhatsApp number: You type it in the contact step. We store it in international format and record that you gave it. We do not send you a code and we do not verify that the number is yours.
The board: Length, width, thickness, volume, shape, brand, model, fins, condition grade, damage notes, price and currency. Numbers are stored in millimetres and shown in feet and inches.
Your own words: The description you dictate or paste is stored exactly as you gave it and published on the listing under your name. We never rewrite it. The AI writes a separate tidied version, and that version is what the page summary and the search preview use.
Where the board is: The area you choose. If you tap to use your location, your phone gives us the coordinates of the spot you are standing on, and we store them to six decimal places, which is about ten centimetres. If you then tap to check the pin on a map, that opens Google Maps with those coordinates.
When it is available: The dates you say the board can be seen, including the date you leave Bali if you give one.
What the AI guessed: Every value the model proposed, how confident it was, and which values you did not confirm. The unconfirmed ones are labelled on the public page.
Your photos: The image files, stored at Cloudflare under a name that contains your original file name. There is a section about photos below.
Taps through to you: One row each time someone taps the contact button on your board: which board, when, and the account id if that person was signed in. No IP address, no browser fingerprint, no referrer.

What is public, and how public

A listing page is meant to be found. It shows the board, its specs, the price, the condition, your own description, the area, and the name and picture on your account. Search engines index it. Your phone number is deliberately kept out of the page: the contact button goes through a redirect on our side, so the number is not in the HTML and a crawler cannot scrape it.

One thing is more public than the page looks, and you should know it before you type anything.

The coordinates you attach to a listing are stored with the listing and can be read at full precision through the public data interface that the site itself uses, even though the page only names the area. The seller flow says we show the area and never your exact address. That is true of the page. It is not true of the data underneath it.

Your phone number used to be readable the same way, and it no longer is. Until 7 September 2026 anyone could read the number of every seller who had published a board, straight out of that public interface, without signing in. We closed it: the number is not readable there at all any more, and it is handed over only to a signed-in buyer who taps the contact button on one board, which we record.

So: do not attach a location you would not publish. We would rather write this down than let you find it out later.

What happens to your photos

Your photo goes from your phone straight to Cloudflare R2, which is where the files live. Our own server never holds the image. It signs a ten minute upload link and records the file name.

The address a photo is then served from is public. There is no password, no signature and no expiry. Anyone who has the address can open the photo, and that stays true after the listing is sold.

We send those addresses to OpenAI, which fetches each photo and reads the board specs off it. That is why the storage has to be publicly readable in the first place.

Most phone photos carry the position where the picture was taken. When your browser resizes a photo before upload, which is the usual path, that data is dropped. A photo that is already small, or one in a format your browser cannot decode, is uploaded exactly as it came off the camera and keeps whatever it carried. Nothing on our side strips it. Assume a photo knows where it was taken.

Removing a photo from a listing removes it from the page and from our database. The file itself stays in storage today. If you need the file gone, write to hello@surfpoint.io and say which listing it was on.

What happens when you describe a board out loud

There are two paths and your browser decides which one you get.

The usual path uses the speech recognition built into your browser. In that case no audio reaches SurfPoint at all: your browser hands us text. What your browser does with the sound is between you and your browser. Chrome generally sends it to Google. Safari may keep it on the device. We cannot see which, and we will not claim either way.

The fallback path, used when your browser has no speech recognition, sends the recording to our server, which passes it straight to OpenAI Whisper and gets text back. The recording is never written to disk, never put in the database and never logged. Only the text comes back and only the text is kept.

So the true claim is that SurfPoint never stores your audio. The claim we will not make is that the audio never leaves your device, because on the fallback path it does.

What we send to OpenAI

SurfPoint uses OpenAI to read a board out of what you provide, so you do not have to fill in a form of twenty fields on a phone. Three things go there.

Your photos: As public web addresses, which OpenAI fetches itself. The model reads dimensions and volume off the stringer, spots damage, and proposes values.
The transcript of what you said: Verbatim and unedited, as text. Whatever you said while the microphone was on is what goes.
Text you paste: If you paste a listing out of Facebook or WhatsApp, the whole block goes. The prompt tells the model to ignore contact details inside it, but nothing removes them before they are sent, and the block is also stored and published as your own words. Take out anything about another person before you paste.

Nothing the model proposes is published as fact. Every value comes back for you to confirm or correct, and anything you leave unconfirmed is labelled as unverified on the page.

Whether OpenAI keeps a copy of any of this for abuse monitoring depends on the settings on our account there, which are not visible in the software. We will state the answer on this page once it is confirmed rather than guess at it now.

Everyone else your data reaches

Supabase: The database, the sign-in system and the session cookie. Everything described above sits there, along with your email address and the times you signed in. The project runs in ap-southeast-1, Singapore.
Cloudflare: Photo storage and image resizing. Cloudflare holds the image files and serves them to anyone with the address. Cloudflare also runs the check on the sign-in page, so it sees that one request and the IP address it came from. It is not on any other page.
OpenAI: Photos, transcripts and pasted text, as described above. Also the speech to text fallback.
Meta: When a buyer taps the contact button, we send them to WhatsApp. The address that opens carries the seller's full phone number and a message that already contains the board title and the listing link. From there the conversation is on WhatsApp between the two of you, under Meta's terms and not ours. We never see it.
Google: Only if you choose to sign in with Google. Google learns that you signed in to SurfPoint, and hands us your name, your email address and your profile picture. Sign in by email link instead if you would rather it did not. Google also receives your pin coordinates if you tap to check your location on a map while listing a board.
Vercel: Hosting. Every page request passes through Vercel, which keeps its own access logs the way any web host does.
Resend: Email delivery. One thing in the product sends mail today: the contact form, described in the next section. Resend carries that message, so it sees your name, your email address and what you wrote. The sign-in link is separate and comes from Supabase.

When you write to us

The contact form asks for a name, an email address, a subject and your message. All four go into one email to our inbox and that is the whole of it. Nothing is written to the database, because there is no table for it: the form has no storage behind it at all.

What happens to the message after that is what happens to any email. It sits in an inbox until somebody deletes it, and Resend, which delivers it, holds it in transit. If you would rather not use the form, the same address is printed on the page and you can write to it directly.

Your IP address is counted, in memory, so one connection cannot send us a hundred messages. It is never written to a log and never stored. A hidden field in the form catches automated posts, and if you are a person you will never see it.

When a page breaks

When something goes wrong, the page shows you a reference number and we write one line to our server log so we can find what happened. That line holds the reference, the address of the page, the names of any filters that were set, and the error message. It does not hold your IP address, your account, your session, anything you typed into a filter, or anything off a listing.

This only happens when something fails. Nothing is written when a page works, which is why this is not analytics: there is no record of where you went, only of where something broke.

What SurfPoint does not do

These are worth stating because they are unusual and because you can check every one of them.

No audio is stored. There is no code path that writes a recording anywhere.
No payment data is touched. There is no card field, no payment processor and no payment table. The only price is the one the seller is asking.
There is no messaging between buyers and sellers inside SurfPoint. You talk on WhatsApp, so there is no message history for us to keep, read, lose or hand over. The contact form writes to us, not to another user, and stores nothing.
Two third party scripts run on this site and neither one follows you. Vercel Analytics counts page views: it sets no cookie and keeps no identifier that lasts beyond a day, so it cannot follow you between visits or to another site. Cloudflare Turnstile runs on the sign-in page and nowhere else, where it checks that a real browser is asking for a sign-in link so that nobody can use us to send mail in bulk. We give it nothing about you: it receives a site key that is printed in the page anyway and hands back a one time token, which goes to Supabase and never to us. Cloudflare sees the request for its own script, which means your IP address and which browser you use. There is no Google Analytics, no tag manager, no advertising pixel and no session recorder. Even the fonts are served from this site rather than from a font network.
We do not build a profile of what you browse. Page views are counted, not attributed: the count tells us that a page was opened, never who opened it or what else they opened. The only other record is the one line written when a page fails on you, described above.
We do not ask your age, your date of birth, your gender, your nationality or any identity document, and there is no field for any of them.
We do not sell data to anyone.

Cookies and what stays in your browser

One kind of cookie exists on this site: the session cookie Supabase sets when you sign in. It keeps you signed in and it refreshes as you move around. Pages that carry it are marked so no cache can hand your session to somebody else. There is no cookie banner because neither third party script sets a cookie: the page count sets none, and the sign-in check is set up without pre-clearance, which is the one setting that would make it set one. So there is nothing here to consent to.

While you are filling in a listing, your browser keeps a local copy of what you have typed so a dropped connection on a slow phone does not lose your work. It is cleared once the value is saved, it stays in your browser, and it never reaches us as anything other than the value you submit.

How long we keep things

Honestly: nothing on SurfPoint deletes itself. There is no scheduled clean up, listings do not expire, contact taps are kept without limit, and photo files stay in storage after the photo is removed from a listing. There is no retention period we could print here that would be true.

One piece of that is deliberate. A sold board keeps its page rather than becoming a dead link, because someone who followed a link to that board deserves to land on something that says it is gone and points at similar boards.

The rest is simply not built yet. We would rather write that down than promise a deletion after 24 months that nobody implemented.

What you can do yourself is delete your account, and that does delete things immediately. It removes your sign-in, your email address, your name, your picture, your WhatsApp number, your saved searches, and every board you never published, with its photos. Boards that were public stay: a board you sold keeps its page and says it sold, and a board that was still listed keeps its page and says it is no longer listed. Neither one carries your name or your number afterwards.

Photo files behind a deleted board are removed from storage at the same time. That step talks to a second service, so if it does not go through we are told about it and finish it by hand rather than pretending it happened.

What you can ask for

You can ask what we hold about you, ask us to correct it, ask us to delete your listings or your whole account, and ask for a copy of what you gave us.

Deleting your account is the one you can do yourself. It is at the bottom of your boards, under 'Delete your account', and the screen tells you exactly what goes and what stays before you confirm it. It cannot be undone.

There is still no export button and no settings page, and a listing that was public is not removed by deleting your account: the page stays up without your name or your number on it. If you want the words and photographs of one of those listings taken down as well, ask us. Write to hello@surfpoint.io and we will do it by hand and tell you what we did.

Depending on where you live, these rights come from Swiss data protection law, from the GDPR, or from Indonesian law, and you can complain to a supervisory authority as well as to us: the Federal Data Protection and Information Commissioner in Switzerland, your national authority in the EU, or the competent authority in Indonesia.

Where your data is

The database and your account sit with Supabase in ap-southeast-1, Singapore. Photos sit with Cloudflare. Pages are served by Vercel. What goes to OpenAI is processed in the United States.

So data about you leaves Switzerland. The database sits in Singapore, which is outside the EEA, so for a reader in the EU the hosting itself is a transfer and not only what goes to OpenAI. The contracts and transfer mechanisms behind those transfers are exactly the part a lawyer has to check, and we are not going to claim they are all in place before that check has happened.

Children

SurfPoint is written for adults buying and selling surfboards. We do not ask your age and we do not knowingly collect anything from a child. If you think a child has listed a board, tell us and we will remove it.

When this page changes

The software changes and this page has to change with it. The date at the top is the last time somebody checked the two against each other. If something material changes, such as a new company receiving your data, we will say so on the site rather than quietly editing a sentence.

The terms cover what SurfPoint is and what it is not.