Privacy

Somebody read the SurfPoint source code and wrote down what it actually does. That is what this page is. It is arranged the way a privacy policy is arranged so a lawyer can check it against the product, and it has not been through that check yet. Where the software has no answer, this page says so instead of inventing one.

The date at the top is the day the code was read. If you find something here that does not match what the site does, tell us and we will fix the page or the software.

• Your board photos go to OpenAI, which reads the specs off them. They are also served from a public web address with no password and no expiry.
• A description you dictate is turned into text and sent to OpenAI. The recording itself is never stored by SurfPoint.
• When a buyer taps through to you, they leave for WhatsApp, their email app or Facebook, depending on the button, and your number, your address or your Facebook link is in what opens.
• Your listing is a public page. Search engines index it, including the words you wrote yourself.
• There is no advertising pixel. Google Analytics sets a cookie that recognises your browser when you come back, and the site does not ask first. Two other measurement scripts count page views without a cookie, and the only other cookie keeps you signed in.
• The guides show a price calculator from Genki, a travel health insurance and the one partner SurfPoint is paid by, and board pages and the search results show Genki banners. The calculator loads from Genki's server, so Genki sees that request. A banner reaches Genki only if you tap it.
• SurfPoint takes no payment and never sees a card.

GEWE GmbH, a company in Switzerland, runs SurfPoint and decides what happens to the data described here. The full company details, including the address you can write to, are on the imprint page.

For anything about your data, write to hello@surfpoint.io.

Your name and your picture

If you sign in with Google, we copy the name and the profile picture Google hands us and show them on your listings. You are never asked to type them and there is no step where you approve them. Ask us and we will change or remove either.

Your email address

The one you sign in with is held by Supabase, which runs sign-in for us. It is not stored in the SurfPoint tables and it is never shown on a listing. When you publish a board, we send one mail to it with the link to your board. It becomes a way for buyers to reach you only if you put it in the contact step yourself.

Your WhatsApp number

If you give one in the contact step. We store it in international format and record that you gave it. We do not send you a code and we do not verify that the number is yours.

An email address for buyers

If you give one in the contact step. It can be your sign-in address or another one. We check that it looks like an address and nothing more.

Your Facebook link

If you give one in the contact step: the link to your profile or your m.me link. We check that it points at Facebook and nothing more.

The board

Length, width, thickness, volume, shape, brand, model, fins, condition grade, damage notes, price and currency. Numbers are stored in millimetres and shown in feet and inches.

Your own words

The description you dictate or paste is stored exactly as you gave it and published on the listing under your name. We never rewrite it. The AI writes a separate tidied version, and that version is what the page summary and the search preview use.

Where the board is

The area you choose. If you tap to use your location, your phone gives us the coordinates of the spot you are standing on, and we store them to six decimal places, which is about ten centimetres. If you then tap to check the pin on a map, that opens Google Maps with those coordinates.

When it is available

The dates you say the board can be seen, including the date you leave Bali if you give one.

What the AI guessed

Every value the model proposed, how confident it was, and which values you did not confirm. The unconfirmed ones are labelled on the public page.

Your photos

The image files, stored at Cloudflare under a name that contains your original file name. There is a section about photos below.

Taps through to you

One row when someone taps the contact button on your board: which board, when, and the account id if that person was signed in. The same person tapping your board again within a day adds no second row. No IP address, no browser fingerprint and no referrer is stored. To recognise a repeat tap from someone who is not signed in, their IP address is held in memory for up to a day and never written anywhere.

A listing page is meant to be found. It shows the board, its specs, the price, the condition, your own description, the area, and the name and picture on your account. Search engines index it. Your phone number, your email address and your Facebook link are deliberately kept out of the page: each contact button goes through a redirect on our side, so none of them is in the HTML and a crawler cannot scrape them. The number and the address are handed only to a signed-in buyer. The Facebook link opens for anyone who taps it, because your profile is a public page already.

One thing is more public than the page looks, and you should know it before you type anything.

The coordinates you attach to a listing are stored with the listing and can be read at full precision through the public data interface that the site itself uses, even though the page only names the area. The seller flow says we show the area and never your exact address. That is true of the page. It is not true of the data underneath it.

Your phone number used to be readable the same way, and it no longer is. Until 7 September 2026 anyone could read the number of every seller who had published a board, straight out of that public interface, without signing in. We closed it: the number is not readable there at all any more, and it is handed over only to a signed-in buyer who taps the contact button on one board, which we record.

So: do not attach a location you would not publish. We would rather write this down than let you find it out later.

Your photo goes from your phone straight to Cloudflare R2, which is where the files live. Our own server never holds the image. It signs a ten minute upload link and records the file name.

The address a photo is then served from is public. There is no password, no signature and no expiry. Anyone who has the address can open the photo, and that stays true after the listing is sold.

We send those addresses to OpenAI, which fetches each photo and reads the board specs off it. That is why the storage has to be publicly readable in the first place.

Most phone photos carry the position where the picture was taken. When your browser resizes a photo before upload, which is the usual path, that data is dropped. A photo that is already small, or one in a format your browser cannot decode, is uploaded exactly as it came off the camera and keeps whatever it carried. Nothing on our side strips it. Assume a photo knows where it was taken.

Removing a photo from a listing removes it from the page and from our database. The file itself stays in storage today. If you need the file gone, write to hello@surfpoint.io and say which listing it was on.

There are two paths and your browser decides which one you get.

The usual path uses the speech recognition built into your browser. In that case no audio reaches SurfPoint at all: your browser hands us text. What your browser does with the sound is between you and your browser. Chrome generally sends it to Google. Safari may keep it on the device. We cannot see which, and we will not claim either way.

The fallback path, used when your browser has no speech recognition, sends the recording to our server, which passes it straight to OpenAI Whisper and gets text back. The recording is never written to disk, never put in the database and never logged. Only the text comes back and only the text is kept.

So the true claim is that SurfPoint never stores your audio. The claim we will not make is that the audio never leaves your device, because on the fallback path it does.

SurfPoint uses OpenAI to read a board out of what you provide, so you do not have to fill in a form of twenty fields on a phone. Three things go there.

Your photos

As public web addresses, which OpenAI fetches itself. The model reads dimensions and volume off the stringer, spots damage, and proposes values.

The transcript of what you said

Verbatim and unedited, as text. Whatever you said while the microphone was on is what goes.

Text you paste

If you paste a listing out of Facebook or WhatsApp, the whole block goes. The prompt tells the model to ignore contact details inside it, but nothing removes them before they are sent, and the block is also stored and published as your own words. Take out anything about another person before you paste.

Nothing the model proposes is published as fact. Every value comes back for you to confirm or correct, and anything you leave unconfirmed is labelled as unverified on the page.

Whether OpenAI keeps a copy of any of this for abuse monitoring depends on the settings on our account there, which are not visible in the software. We will state the answer on this page once it is confirmed rather than guess at it now.

Every reading and every voice note costs us money at OpenAI, so each account has a daily allowance, and so does the whole site. To keep it we store how many of each your account used per day, next to your account and nothing else. Those counts are deleted after 7 days, and at once when you delete your account.

Supabase

The database, the sign-in system and the session cookie. Everything described above sits there, along with your email address and the times you signed in. The project runs in ap-southeast-1, Singapore.

Cloudflare

Photo storage and image resizing. Cloudflare holds the image files and serves them to anyone with the address. Cloudflare also runs the check on the sign-in page, so it sees that one request and the IP address it came from. It is not on any other page.

OpenAI

Photos, transcripts and pasted text, as described above. Also the speech to text fallback.

Meta

When a buyer taps the WhatsApp button, we send them to WhatsApp. The address that opens carries the seller's full phone number and a message that already contains the board title and the listing link. When they tap the Facebook button, we send them to the seller's Facebook profile or m.me link. From there the conversation is on WhatsApp or Facebook between the two of you, under Meta's terms and not ours. We never see it. The email button opens the buyer's own email app with the seller's address filled in, and no third party is involved on our side.

Google

Google Analytics runs on every page. Each time a page opens, Google receives its address, the page you came from, your browser, your device and your IP address, and it sets a cookie that recognises the same browser for up to two years. It receives the same seven taps Umami does, listed under what we count when you tap something. Separately, if you choose to sign in with Google, Google learns that you signed in to SurfPoint and hands us your name, your email address and your profile picture. Sign in by email link instead if you would rather it did not. Google also receives your pin coordinates if you tap to check your location on a map while listing a board.

Vercel

Hosting. Every page request passes through Vercel, which keeps its own access logs the way any web host does.

Umami

Page counts. When a page opens, a script from Umami reports it, so Umami sees that request, which means your IP address and which browser you use. What it keeps is the page, the page you came from, your browser, operating system, device type and country. It also receives the seven taps listed under what we count when you tap something. It sets no cookie.

Resend

Email delivery. Three things in the product send mail. The contact form, described in the next section, goes to our own inbox: Resend carries that message, so it sees your name, your email address and what you wrote. A short note to our inbox each time a board is published holds only what the listing page already shows anyone: its title, dimensions, price, condition, area, a link to its first photo and a link to the page. Nothing about the seller is in it. And when you publish a board from the publish step, one mail goes to the address you signed in with: the same details of your board, a link to its page, a link to where you edit it, and which of its details are still blank. Resend sees your address to deliver it. Boards published with the shop import tool send you none. The sign-in link is separate and comes from Supabase.

Genki

Travel health insurance, and the one partner SurfPoint is paid by. The guides show Genki's price calculator, beside the article on a large screen, and inside the guide on getting hurt surfing on a phone. It is a page of Genki's own, in a frame, which loads from Genki's server when you scroll to it. Genki sees that request, which means your IP address, your browser and that the calculator was opened on SurfPoint, and inside the frame it counts how the calculator is used with PostHog, a measurement tool Genki uses. The frame is sealed off from this site. It cannot read anything on the page, and nothing running in it can store anything in your browser. Genki's server does send one cookie with it, and browsers refuse a cookie like that from inside another site's page. The Genki banners on board pages and in the guides, and the Genki tile among the search results, are pictures and text served from this site, so showing them tells Genki nothing. Every link to Genki, those included, opens in a new tab and carries the word surfpoint in its address, which is how Genki knows a sign-up came from here and pays us for it. What you do on Genki's own site is between you and Genki, under Genki's privacy policy.

The contact form asks for a name, an email address, a subject and your message. All four go into one email to our inbox and that is the whole of it. Nothing is written to the database, because there is no table for it: the form has no storage behind it at all.

What happens to the message after that is what happens to any email. It sits in an inbox until somebody deletes it, and Resend, which delivers it, holds it in transit. If you would rather not use the form, the same address is printed on the page and you can write to it directly.

Your IP address is counted, in memory, so one connection cannot send us a hundred messages. It is never written to a log and never stored. A hidden field in the form catches automated posts, and if you are a person you will never see it.

When something goes wrong, the page shows you a reference number and we write one line to our server log so we can find what happened. That line holds the reference, the address of the page, the names of any filters that were set, and the error message. It does not hold your IP address, your account, your session, anything you typed into a filter, or anything off a listing.

This only happens when something fails. Nothing is written when a page works, which is why this is not analytics: there is no record of where you went, only of where something broke.

Umami and Google Analytics count the pages that open, which is the ordinary part and is described above. Seven other things are counted too, because a page address cannot show them. This is the whole list. The page builds it from the same file the site reports from, so it cannot quietly fall behind the code.

• That you tapped the contact button on a listing, and which of the three it was: message on WhatsApp, message on Facebook, or sign in first. Not which board.
• That a step of the listing flow opened, and which step it was. Not the board, not your draft, not anything you typed into it.
• That a board was published. Not which board.
• That a sign-in was started, and whether by email link or with Google. Never your email address.
• That you changed the display currency in the footer, and which of the three you chose.
• That you tapped a link, banner or tile to Genki, the travel health insurance, or tapped inside its price calculator, and which spot it was: the footer, a board's page, the search results, a guide, or a guide's side column. Not what you did on Genki's site, and not what you picked in the calculator.
• That you tapped a share button on a board, which one it was (WhatsApp, Facebook, Telegram, email, copy link or your phone's share sheet), and whether it was on the board's page or on the screen you see after publishing one. Not which board, and not who you sent it to.

None of it says who you are. There is no name, no email address, no account and no board in any of it, and none of it is joined to anything else we hold. Google Analytics can still tell that the same browser came back, because of its cookie, and that is true of a page view as well.

The contact tap is the one thing here that is also counted on our own side, and that record is the fuller one: the board, the time, and your account id if you were signed in. It is listed under what we store, as taps through to a seller, because it belongs to the person selling the board. The two never meet. What goes to Umami and Google says only that a contact happened and which button it was.

These are worth stating because they are unusual and because you can check every one of them.

• No audio is stored. There is no code path that writes a recording anywhere.
• No payment data is touched. There is no card field, no payment processor and no payment table. The only price is the one the seller is asking.
• There is no messaging between buyers and sellers inside SurfPoint. You talk on WhatsApp, by email or on Facebook, so there is no message history for us to keep, read, lose or hand over. The contact form writes to us, not to another user, and stores nothing.
• Four third party scripts run on this site. Vercel Analytics counts page views: it sets no cookie and keeps no identifier that lasts beyond a day, so it cannot follow you between visits or to another site. Umami counts page views too, also without a cookie, and keeps the page, where you came from, your browser, device type and country. Google Analytics counts page views as well, and it is the one that sets a cookie: it recognises the same browser when it comes back, for up to two years, so it can tell a returning visit from a new one. Umami and Google Analytics also receive seven taps, which are listed one by one further up under what we count when you tap something, and none of them carries anything you typed. Cloudflare Turnstile runs on the sign-in page and nowhere else, where it checks that a real browser is asking for a sign-in link so that nobody can use us to send mail in bulk. We give it nothing about you: it receives a site key that is printed in the page anyway and hands back a one time token, which goes to Supabase and never to us. Cloudflare sees the request for its own script, which means your IP address and which browser you use. There is no tag manager, no advertising pixel and no session recorder. Even the fonts are served from this site rather than from a font network. The guides also show Genki's price calculator in a sealed frame, described above under Genki: it runs Genki's code, not ours, and cannot reach this page.
• We do not build a profile of who you are. Google Analytics connects the pages one browser opens through its cookie, but we send it no name, email address or account, and we do not join its reports to one. The only other record is the one line written when a page fails on you, described above.
• We do not ask your age, your date of birth, your gender, your nationality or any identity document, and there is no field for any of them.
• We do not sell data to anyone.

Two kinds of cookie exist on this site. The session cookie Supabase sets when you sign in keeps you signed in and refreshes as you move around. Pages that carry it are marked so no cache can hand your session to somebody else.

Google Analytics sets two cookies whose names start with _ga. They recognise your browser for up to two years, so a return visit counts as one. There is no cookie banner, so the site does not ask before setting them. You can block them in your browser's settings or with Google's opt-out add-on, and every page works the same without them. The other two page counts set no cookie, and neither does the sign-in check, which is set up without pre-clearance, the one setting that would make it set one. Genki's calculator on the guides cannot store anything either, for the reason given under Genki above.

While you are filling in a listing, your browser keeps a local copy of what you have typed so a dropped connection on a slow phone does not lose your work. It is cleared once the value is saved, it stays in your browser, and it never reaches us as anything other than the value you submit.

Honestly: apart from the daily OpenAI counts described above, which go after 7 days, nothing on SurfPoint deletes itself. There is no scheduled clean up, listings do not expire, contact taps are kept without limit, and photo files stay in storage after the photo is removed from a listing. There is no retention period we could print here that would be true.

One piece of that is deliberate. A sold board keeps its page rather than becoming a dead link, because someone who followed a link to that board deserves to land on something that says it is gone and points at similar boards.

The rest is simply not built yet. We would rather write that down than promise a deletion after 24 months that nobody implemented.

What you can do yourself is delete your account, and that does delete things immediately. It removes your sign-in, your email address, your name, your picture, your WhatsApp number, the email address and Facebook link you gave for buyers, your saved searches, and every board you never published, with its photos. Boards that were public stay: a board you sold keeps its page and says it sold, and a board that was still listed keeps its page and says it is no longer listed. Neither one carries your name or any way to reach you afterwards.

Photo files behind a deleted board are removed from storage at the same time. That step talks to a second service, so if it does not go through we are told about it and finish it by hand rather than pretending it happened.

You can ask what we hold about you, ask us to correct it, ask us to delete your listings or your whole account, and ask for a copy of what you gave us.

Deleting your account is the one you can do yourself. It is at the bottom of your boards, under 'Delete your account', and the screen tells you exactly what goes and what stays before you confirm it. It cannot be undone.

There is still no export button and no settings page, and a listing that was public is not removed by deleting your account: the page stays up without your name or your number on it. If you want the words and photographs of one of those listings taken down as well, ask us. Write to hello@surfpoint.io and we will do it by hand and tell you what we did.

Depending on where you live, these rights come from Swiss data protection law, from the GDPR, or from Indonesian law, and you can complain to a supervisory authority as well as to us: the Federal Data Protection and Information Commissioner in Switzerland, your national authority in the EU, or the competent authority in Indonesia.

The database and your account sit with Supabase in ap-southeast-1, Singapore. Photos sit with Cloudflare. Pages are served by Vercel. What goes to OpenAI is processed in the United States.

So data about you leaves Switzerland. The database sits in Singapore, which is outside the EEA, so for a reader in the EU the hosting itself is a transfer and not only what goes to OpenAI. The contracts and transfer mechanisms behind those transfers are exactly the part a lawyer has to check, and we are not going to claim they are all in place before that check has happened.

SurfPoint is written for adults buying and selling surfboards. We do not ask your age and we do not knowingly collect anything from a child. If you think a child has listed a board, tell us and we will remove it.

The software changes and this page has to change with it. The date at the top is the last time somebody checked the two against each other. If something material changes, such as a new company receiving your data, we will say so on the site rather than quietly editing a sentence.

The terms cover what SurfPoint is and what it is not.