SurfSense is a desktop application that runs on your own computer, so most of this policy describes data we never receive. The rest describes this website, which is an ordinary website and behaves like one. This policy is written by SurfSense, the publisher of the SurfSense desktop application and the operator of surfsense.com, and we are the data controller for the processing described in section 4. You can reach us at any time at rohan@surfsense.com.

1. What this policy covers

This policy covers the SurfSense desktop application for Windows, macOS and Linux, and this website at www.surfsense.com including its documentation, pricing, licence and free chat pages. It applies from the date above.

It does not cover the separately licensed scraper plugins beyond what section 4.4 says about them, third-party model providers you choose to connect, or other people's websites that we link to. Each of those is governed by its own terms. If you run your own copy of the open source server components, you are the operator of that deployment and this policy does not describe it.

Our previously hosted web application is being retired. If you used it, the export and deletion arrangements in the SurfSense 2.0 announcement apply to that data rather than this policy.

2. The short version

The desktop app has no account and no sign-in, and sends no usage analytics unless you opt in, and even then only counts in ranges and the app's version, platform and language, with no identifier. Your documents, chats and search index are files on your disk, we never receive them, and there is therefore nothing for us to disclose, sell, leak or lose. This website counts page views using analytics that is on by default and that you can block, and carries no advertising. We do not sell personal data, we do not share it for advertising, and we do not build profiles for anyone else.

3. The desktop application

3.1 What stays on your computer

When you add a document, the app parses it, splits it into passages and builds a search index entirely on your machine. The result is written to a database file in your user folder, under ~/.surfsense. Your chats, your search index, your settings and everything Studio generates from your sources live in that same folder. Deleting the folder deletes all of it, and no copy exists anywhere else unless you made one.

There is no account and no sign-in, so nothing you do in the app is attached to an identity we hold. The only identity involved is your operating system user.

3.2 What the app can send, and when

The app can reach the destinations below. Each one is switched off until you allow it, when the app first starts or under Network in Settings, and switching one off there blocks the call rather than hiding it.

Update checks, to updates.surfsense.com, falling back to github.com. From version 2.2.4, once a day and whenever you click Check now, the app asks updates.surfsense.com whether a newer release exists. That request sends your IP address, a user agent that says only SurfSense, the app's version, your platform (such as win32-x64) and your operating system (such as windows-11), and no identifier and no cookies. If that service fails or answers wrongly, the app asks github.com for the same release file directly, sending only your IP address and that user agent, so an update never depends on our service. A newer release downloads from GitHub, whose download host, githubusercontent.com, also sees your IP address, and installs when you restart from the prompt or the next time you quit the app. Versions up to 2.2.3 ask github.com alone: they read its list of releases, then the release file for your platform, identifying themselves as electron-builder, and they also send a random identifier that the update library, electron-updater, creates for staged rollouts. Off until you turn it on, and you can check manually instead. An administrator can turn it off, or point it at their own update server, for every user of a computer.
Usage statistics, to usage.surfsense.com. From version 2.2.4, only if you opt in, and at most once a day. Each report sends the app's version, platform, operating system and interface language, the week the app was installed, and whether this is its first report ever, this week and this month. Once a week it adds counts in ranges, such as 10-49, for the past seven days: chat turns, agent turns, whether a local or a remote model answered, the documents in your library, Studio outputs, plugin calls, and how far setup got. The first report adds your computer's memory, graphics card maker and graphics memory, also in ranges. It never sends documents, prompts, file names, model names, model hosts, your licence key or an identifier. Settings shows the exact next report and the last one sent.
Model search and downloads, to huggingface.co. Searching sends what you type into the model search as you type it. Downloading sends the name of the model you chose. Both send your IP address, as any request does. No document content and no prompts are involved.
Plugins, to plugins.surfsense.com. Fetching the list of third-party plugins sends your IP address and nothing else. SurfSense's own plugins run on the same service, and using one sends it what each tool needs, such as the page or search you asked the plugin to fetch. For paid plugins the app also sends your licence key so the service can check it, as section 3.3 describes.
The Office pack, from downloadarchive.documentfoundation.org. Turning on Office support downloads The Document Foundation's LibreOffice build, sending the file's name and your IP address. That host redirects the download to one of its mirrors, which also sees your IP address.
A plugin server you connect. A third-party plugin's server, and its sign-in server if it has one, receives what each tool you allow is sent, along with your IP address, never your whole conversation.
A model provider you configure. Sends your prompts, excerpts of the documents your answer is drawn from, and the API key you supplied, to whichever host you entered.

The last one deserves emphasis. If you connect a model that you do not run yourself, the content of your questions and parts of your documents leave your machine and are handled by that provider under their privacy policy and their retention rules, not ours. We are not a party to that request, we do not proxy it, and we never see it. Choose a local model if you would prefer that nothing leaves: document parsing, retrieval, chat, image generation and the podcast voice can all run on your own hardware with every destination above disabled. One thing these switches do not hold: the scripts a model writes to build documents, for Studio's Office formats and for the agent, run on your computer and can open connections of their own.

3.3 Usage statistics, and how your licence is checked

The desktop app contains no analytics library, no crash reporting and no advertising identifiers, and sends no usage analytics unless you opt in. From version 2.2.4, with update checks on, SurfSense can count the installs that checked in each day, with their versions, platforms and countries. With usage statistics on, it also receives the weekly counts in ranges that section 3.2 lists. Neither carries documents, prompts, file names, model hosts, your licence key or an identifier, so we cannot see what you did in the app, and no identifier ties one install's reports together, although an uncommon combination of version, platform, language, install week and country could single one install out. Each request's IP address is used by our hosting providers to route it and to derive a country. Their server and edge logs hold it for the short time sections 4.5 and 8 describe, and SurfSense keeps only the country. With both off, we cannot tell whether you ever opened the app. You can turn either off in Settings at any time, set DO_NOT_TRACK=1 to keep usage statistics off, or have an administrator turn either off for a whole computer. SurfSense's own plugins are separate. That service sees the requests you send them, as section 4.4 describes, and, once you have added a paid one, the licence checks described below, which show it roughly when you open the plugin list or ask the agent something.

If you buy a licence, the licence file is verified on your own machine. The app checks its cryptographic signature against a public key compiled into the build, without contacting anyone. The exception is SurfSense's paid plugins. Once you add one and allow plugins.surfsense.com, every request to those plugins carries your licence key. The app also asks that service to check the key: at once when you import or replace a licence, and, at most about every five minutes, when you open the plugin list or before the agent answers, whether or not that answer uses a plugin. If you have not added a paid plugin, your licence key never leaves your machine. The app does not compute or transmit a device fingerprint.

The retired 0.0.x desktop app, which wrapped our former hosted service, still sends events to our analytics when it starts, updates and quits: its version, operating system, processor architecture, whether it started at login, and a machine identifier. We use them only to count how many of those installs remain and to point them to the new app. The current app sends no machine identifier, and nothing beyond what section 3.2 lists.

3.4 What is encrypted, and what is not

Your provider API keys are encrypted before they are stored, with the encryption key held by your operating system's keychain through Electron's safeStorage. On Linux, where no keyring is available, that mechanism falls back to weaker local protection.

Your documents, chats and search index are not encrypted at rest. They are ordinary files with ordinary file permissions. If you need them encrypted, use your operating system's full-disk encryption, such as BitLocker on Windows, FileVault on macOS or LUKS on Linux, or keep the folder on an encrypted volume. Anyone with access to your user account or an unencrypted backup of your disk can read them.

Whether any of this satisfies a particular regulation depends on the controls you put around it, and those are yours to establish. No software carries compliance as a property on its own. What we can tell you is narrower and checkable: where the files are, what can leave, and that we hold no copy.

4. This website

4.1 Analytics

We use PostHog to understand how the site is used. In your browser it records the pages you open and when you leave them, the address that referred you, and any referral code or campaign (UTM) tags in the link. It also records which links, buttons and form fields you click, change or submit (the element and its visible text, never what you type into a field), where on a page you click, move the pointer and scroll, for heatmaps, how quickly pages load, and JavaScript errors your browser hits on our pages, with the error message and where in our code it happened. Every request carries the technical details any browser sends: your IP address, from which an approximate location is derived, and your browser, operating system and device type. We do not record sessions: session replay is switched off.

These requests go to assets.surfsense.com, a subdomain of ours that PostHog runs as a reverse proxy for us, rather than to PostHog's own domain. PostHog assigns your browser a pseudonymous identifier so that repeat visits are counted as one visitor rather than several.

A few steps are counted on our own servers instead, without that identifier: downloading an installer (the platform, whether the link was on this site, in our README, in an email, in the app or on the pricing page, the version, and the country our host derives from your request), a trial licence being issued, and a completed purchase (the plan, the amount and the currency). The trial and purchase counts also carry the channel you arrived from: a referral code, a campaign source, the domain of the site that linked to us, or “direct”. No email address, licence, IP address or browser identifier is sent with any of them, so they are not tied to your browser's analytics identifier or to a person profile. To count purchases by channel, the checkout link passes that same channel tag to Stripe.

Two steps are recorded in your browser with the rest of the analytics, and so with its pseudonymous identifier: requesting a trial licence, with whether it was sent, already claimed, refused or failed, and pressing Continue to checkout. Both carry the channel tag, and neither includes the email address you type.

Analytics is enabled by default and we do not display a consent banner. Because the browser requests go to our own subdomain, a content blocker that works from lists of tracking domains may not stop them. Blocking assets.surfsense.com, or turning off JavaScript for this site, does stop them, and every page keeps working when you do. Blocking cookies and site storage for surfsense.com stops PostHog from recognising a repeat visit, but not from counting the visit. Nothing in your browser stops the server-side counts above, which is why they carry no identifier. We do not currently detect the Global Privacy Control signal or Do Not Track headers, so please do not rely on either with us.

4.2 Cookies and browser storage

We set the following, and nothing for advertising:

A session cookie, if you sign in, to keep you signed in. Strictly necessary; blocking it prevents signing in.
Preference cookies and local storage, remembering your locale, theme, sidebar width, panel state and which notices you have dismissed, so the site looks the same when you return.
A PostHog cookie and local storage entry, holding the pseudonymous visitor identifier described in section 4.1, and the first page you landed on with the address that referred you there. The channel tag in section 4.1 is worked out from that first page and referrer when you request a trial or start checkout.
Session storage holding the referral code from the link you arrived with, kept until you close the tab, for the same channel tag.
Cloudflare Turnstile, set by Cloudflare on the free chat pages to distinguish a person from a script.

Your browser controls all of it. Blocking everything except the session cookie costs you nothing but your saved preferences.

4.3 Free chat without an account

The free chat pages let you talk to a model without registering. Those conversations are not stored against any user account. The prompts you type are passed to the model provider serving that model so it can answer you, which means you should not paste anything confidential into a page that is explicitly free and anonymous. Cloudflare Turnstile protects those pages from automated abuse, and Cloudflare receives the technical signals it needs to make that determination.

4.4 Licences, payment and the scraper plugins

If you request a trial licence or ask us to resend one, we receive the email address you type and use it to send you that licence and to answer support about it. Paid licences are sold through Stripe. Stripe processes your payment, receives the billing details you give them, and keeps the transaction records that tax and accounting law require them to keep. Your card details never reach us and we cannot see them.

The scraper plugins, which a licence unlocks, run against a service we operate. When you ask a plugin to fetch something, that service receives the request and its target so it can carry out the fetch, along with the licence identifying the request. For each licence, the service counts which plugins and tools were called on which days, whether each call worked and how long it took, and notes the day the licence first used a plugin. We use these counts to detect abuse, to plan fair-use limits and to decide which plugins to improve. They never include what you asked a plugin to fetch. Daily totals with no licence in them, such as how many calls a tool received and how many licences used it, are sent to PostHog.

4.5 Hosting and server logs

This site is hosted on Vercel and fronted by Cloudflare. Both keep short-lived server and edge logs containing IP addresses, requested URLs, timestamps and user agents, which is how any web server works and is necessary to serve pages, absorb attacks and diagnose faults.

5. Why we are allowed to process it

Where the GDPR or UK GDPR applies, we rely on these legal bases. We do not process special category data, and we do not use your data for automated decision-making or profiling that has a legal or similarly significant effect on you.

Contract. Sending you a licence you asked for, taking payment, providing the plugin service and supporting it, and answering the desktop app's update checks, which is the update service you enabled when you turned them on.
Legitimate interests. Keeping the site available and secure, preventing abuse of free and trial offers, and understanding aggregate usage so we can improve the product. We have weighed these against your interests, which is why analytics is limited to what section 4.1 lists and is straightforward to block.
Legal obligation. Keeping tax, accounting and payment records, and responding to lawful requests.
Consent. The desktop app's usage statistics, which are off unless you opt in. You can withdraw that consent at any time by turning them off in Settings or by setting DO_NOT_TRACK=1, and an administrator's policy can withdraw it for a whole computer. Reports already sent carry no identifier, so we cannot pick out yours to delete, although an uncommon combination of version, platform, language, install week and country could single one install out. We also rely on consent where we ask for it elsewhere, such as if you opt in to product emails, and you can withdraw it at any time.

6. Who else sees it

We do not sell personal data and we do not share it for cross-context behavioural advertising. We use a small number of service providers, each processing data only as needed to do their job for us and bound by their own terms:

Vercel and Cloudflare, for hosting, content delivery and bot protection.
PostHog, for the product analytics described in section 4.1.
Stripe, for payments.
Our email provider, to deliver licence and support email.

We may also disclose data where the law requires it, to enforce our terms, or to protect our rights or someone's safety. If our business is ever transferred, data may transfer with it, and we will say so here before that takes effect.

Model providers you connect yourself are not our processors. You choose them and your relationship is with them directly.

7. Where it goes

The providers listed above are largely based in the United States, so personal data relating to this website may be transferred outside the United Kingdom and the European Economic Area. Where those transfers are subject to UK or EU data protection law, they rely on the European Commission's Standard Contractual Clauses, the UK Addendum or an applicable adequacy decision, as offered by each provider. Data handled entirely inside the desktop app is not transferred anywhere, because it never leaves your computer.

8. How long we keep it

Analytics data is retained by PostHog for its configured retention period and then deleted or aggregated beyond recognition. Email addresses used for licences are kept for as long as the licence is live and for a reasonable period afterwards, so we can resend it and honour support. Payment and invoice records are kept by Stripe and by us for the period tax law requires, commonly six to seven years. Server and edge logs are short-lived, typically days to a few weeks. The plugin service's per-licence daily counts are kept in our own database for 13 months and then deleted; the day a licence first used a plugin is deleted once that licence has made no call for 13 months. Daily totals with no licence in them may be kept longer. Aggregated figures that can no longer identify anyone may be kept indefinitely.

Anything inside the desktop app is kept for exactly as long as you keep it, because we are not holding it.

9. Security

We use measures appropriate to a small team running a mostly local product: encryption in transit for the website and the plugin service, access limited to the people who need it, reliance on established providers for payments and hosting rather than handling card data ourselves, and a public codebase that anyone can audit. The strongest protection here is structural: the data most people care about never reaches us.

No service can promise perfect security, and we do not. If we ever suffer a breach affecting personal data we hold, we will notify the relevant authority and affected people as the law requires.

10. Your rights

For anything you do in the desktop app there is nothing for us to give you or delete, because we never had it. Your copy is the only copy, and you can export, move or destroy it without involving us.

For this website, and wherever the GDPR, UK GDPR or a comparable law applies, you can ask us to give you a copy of the personal data we hold about you, correct it, delete it, restrict or object to how we use it, provide it in a portable format, or withdraw consent where consent is what we relied on. Email us and we will act on it without undue delay and within the period the law allows. We may need to verify who you are first, and we will not charge you or treat you differently for asking. If you are unhappy with our answer, you can complain to your national data protection authority; in the United Kingdom that is the Information Commissioner's Office.

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what we collect and why, to delete it, to correct it, and not to be discriminated against for exercising those rights. The categories we collect for this website are identifiers, internet activity and commerce information, as described in section 4, collected for the purposes in section 5. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is no opt-out of sale or sharing to offer. You may use an authorised agent to make a request on your behalf. Residents of other US states with comprehensive privacy laws have equivalent rights and can use the same email address.

11. Children

SurfSense is not designed for or directed at children, and is not intended for anyone under 13, or under 16 in the European Economic Area and the United Kingdom. We do not knowingly collect personal data from children. If you believe a child has sent us something, email us and we will delete it.

12. Changes to this policy

When something material changes we update the date at the top of this page, and for a change that meaningfully affects people holding a paid licence we will email the address on that licence. Because the application is open source, you do not have to take this document on trust: the code that reads your files, the list of destinations the app can reach and the analytics configuration for this site are all public and reviewable.

13. Contact

Questions about this policy, or a request about your data, go to rohan@surfsense.com and a person will read it. Our Terms of Service cover the rest of the relationship.

Privacy Policy