Surfdesk ("the app", formerly called Strynd) is run by Sonder Project, a sole proprietorship based in California ("we", "us"). This policy explains what we collect when you use the app at thesurfdesk.app and in its mobile apps, how we use it, and the choices you have. We don't sell your data, and we don't use it for advertising.
What we collect
- Your account: email address, password (stored only as a secure hash by our sign-in provider), name and mobile number if you add them, two-factor authentication settings, and your settings. If you sign up from one of our ads, we note which campaign the link came from (no cookies or third-party trackers are used for this).
- What you enter: people and client profiles (such as name, date of birth, phone, email, gender, income level and ethnicity), notes, tasks, lists, check-ins and reminders.
- Billing: your plan, seat count, trial and payment status, and the Stripe customer and subscription IDs. Card details go straight to Stripe; we never see or store full card numbers.
- Agreements: which version of these terms and policy you agreed to, when, and the IP address and browser you used, as a record of your consent.
- Support messages: what you send through the contact form, with your plan, app version and device type so we can help.
- Calendar links: the private links to any outside calendars you choose to show in Surfdesk (see Calendar sync below).
- Device and usage data: time zone, push notification subscriptions, and standard server logs (such as IP address, browser type and the time of requests) used for security and troubleshooting.
- Approximate location: the home screen shows local weather using the approximate location of your IP address. We don't ask for or store your precise location.
What we never ask for: Social Security numbers, government ID numbers, or bank or card account details. Please don't enter them in the app.
Information about other people
If you use the app to keep track of clients or other people, you're responsible for having their permission, or another lawful basis, to record their information. We store and process that information only to provide the app to you. We don't contact the people in your records, and we don't use their information for any other purpose.
Organizations
When you use Surfdesk as part of an organization (such as an agency), the organization decides what client information is kept and why, and we process it on the organization's behalf as its service provider. The organization's admins can see and manage its client records, staff list and activity log. If you're a client of an organization and want to see, correct or delete your information, contact that organization; we will help it respond.
- Front-desk kiosk: clients who check themselves in on an organization's kiosk enter their first and last name and a reason for the visit, which go to that organization's records.
- Referral links: people who send a referral through an organization's public referral link enter the client's details (such as name, phone, date of birth and needed services) and their own name and contact details, which go only to that organization.
Calendar sync
- Showing other calendars in Surfdesk: if you paste a private calendar link, we store the link and use it only to fetch that calendar's events while you look at your Surfdesk calendar. Events are kept in memory for a few minutes and aren't saved to our database. Remove the link any time in Settings → Calendar.
- Seeing Surfdesk in other calendars: your private Surfdesk calendar link shares the titles and due times of your open tasks, never notes or client details. If you subscribe to it in Google, Apple or Outlook, that company stores a copy under its own privacy policy. Anyone with the link can see those tasks; you can replace it in Settings → Calendar.
How we use it
- To run the app: show your records, send the reminders and summaries you turn on, and keep you signed in.
- To keep accounts secure: sign-in, email confirmation, password reset, two-factor authentication and abuse prevention.
- To send account emails, such as confirmations and password resets.
- To answer your support requests and fix problems.
- To bill your subscription, and to keep records of payments and of your agreement to these terms.
We don't sell or rent personal information, share it for advertising, or use it to build ad profiles.
Text messages (SMS)
If you add a mobile number and opt in under Settings, we send text reminders about your tasks. Message frequency varies with the reminders you set. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help. You can also turn texts off in Settings.
Your mobile number and text-messaging consent are never sold or shared with third parties or affiliates for marketing or promotional purposes. They are shared only with our text-messaging provider to deliver the messages you asked for.
Who processes data for us
We use these service providers, which process data only on our instructions and only to run the app:
- Supabase: database and sign-in (data stored in the United States).
- Stripe: payments and subscriptions.
- Vercel: hosting.
- Resend: account emails.
- Twilio: text messages, if you opt in.
- Apple, Google and Mozilla push services: delivering push notifications you turn on.
- Cloudflare: bot protection on sign-in forms.
- Open-Meteo: local weather (receives only a rounded, approximate location).
Voice dictation uses your device's or browser's built-in speech recognition. Depending on your browser, the browser maker (such as Apple or Google) may process that audio under its own privacy policy.
We may also disclose information if the law requires it, to protect the safety of any person, or as part of a sale or reorganization of the business, in which case this policy continues to apply.
How we protect it
Data is encrypted in transit and at rest. Access is restricted by account at the database level, and you can turn on two-factor authentication and automatic sign-out after inactivity. No system is perfectly secure; if a breach affects your information, we'll notify you as the law requires.
Health information
Surfdesk isn't designed to hold medical records. Don't enter protected health information (such as diagnoses or treatment details) unless your organization has a written agreement with us that covers it.
Keeping and deleting your data
We keep your data while your account is open. You can export it any time (Settings → Data) and delete your account and all its data in the app (Settings → Your data → Delete account). See how to delete your account. Deleted data is removed right away from the live database and may remain in encrypted backups for up to 30 days before it's overwritten. Payment records held by Stripe are kept as long as tax and accounting laws require. Client records that belong to an organization stay with the organization when a staff member leaves or deletes their own account.
Your rights
You can access, correct, export or delete your information at any time, in the app or by emailing dante@sonderproject.co. If you live in California, you also have the right to know what we collect and how it's used, to request deletion or correction, and not to be discriminated against for exercising these rights. We don't sell or share personal information as those terms are defined under California law. We'll respond to requests within 45 days.
Children
The app isn't meant for children under 13, and we don't knowingly collect information from them. If you believe a child has given us information, email dante@sonderproject.co and we'll delete it.
Changes to this policy
If we make significant changes, we'll update the date above and ask you to agree to the new version in the app before you keep using it.
Contact
Sonder Project, California, USA. Email dante@sonderproject.co, or use Settings → About & help → Contact support in the app.