Privacy policy

Who we are

Surfbase is operated by Surfbase Platforms (ABN 72 119 661 713). You can reach us at hello@surfbase.app.

What this policy covers

This policy covers surfbase.app — the website you're reading — and how signing in to Surfbase works, including signing in with Google, Apple or Microsoft. Surfbase itself is open to invited accounts. A fuller policy covering what you put into the product once you're inside it — your designs, customers and orders — is still to come, and nothing here describes that.

What we collect

The email address you give us. If you join the waitlist, we collect the address you type into the form and the date you submitted it. That is the only information you actively give us.

Standard server logs. Our host records the usual technical details of a web request — IP address, browser and device type, the page requested, and the time. We don't use these to identify you.

How the page is used. We use Cloudflare Web Analytics to count visits and see which pages get read. It sets no cookies and stores nothing on your device, it doesn't fingerprint you, and it can't follow you to other sites. It records the page you opened, the site you arrived from if any, broad details like country, browser and device type, and how quickly the page loaded.

Nothing else. No advertising, no tracking pixels, and nothing that builds a profile of you. Your light or dark theme choice is saved in your browser's local storage and never leaves your device.

Signing in with Google, Apple or Microsoft

You can sign in to Surfbase with a Google Account, an Apple Account or a Microsoft account instead of a password. If you do, that provider tells us three things: a stable identifier for your account with them, your email address along with whether they have confirmed it is yours, and your name. We store those so we can recognise you next time, and we refresh them each time you sign in.

We only ever ask for your identity. The sign-in request covers your name and email address and nothing else. We cannot read your mail, files, calendar or contacts, we never post anything, and after you have signed in we do not go back and read anything further from that account.

If you use Apple's Hide My Email, Apple gives us a relay address instead of your real one. We store and write to the relay address, and your real address is never disclosed to us. For Apple we also keep one credential, encrypted, for a single purpose: if you delete your Surfbase account we are required to tell Apple to disconnect it, and that credential is what lets us do so.

Signing in this way tells the provider that you signed in to Surfbase, and when. You can disconnect a provider at any time under Settings, as long as you still have another way to get in, and disconnecting removes what we stored from it.

These sign-in connections are separate from any cloud storage account you connect later to import board files, which you authorise separately and can disconnect separately.

Who else sees your information

Serving this page involves a few third parties, and each of them necessarily sees something:

• Amazon Web Services — hosts this site on a server in Sydney. Every request to the page passes through it, and it is where your address is received and recorded when you join the waitlist.
• Resend — delivers your address to our inbox as an email. It passes through their systems on the way.
• Cloudflare — provides DNS for the domain, receives the mail sent to our waitlist address and forwards it on, and provides the page analytics described above.
• Sentry — collects error reports when something on this site breaks. If a page fails while you're using it, Sentry receives the technical details of the failure and of the request that triggered it — the page you asked for, and your browser and device type — on servers in the United States. We have configured it not to receive what you typed into a form, your cookies, or your IP address.
• Google, Apple and Microsoft — when you choose to sign in with one of them, that provider authenticates you and tells us who you are, as described above. Which one you use is your choice, and you can use a password instead.
• Google Fonts and jsDelivr — serve the typeface and the stylesheet this page loads. Your browser requests those files directly, so your IP address and browser details are visible to those providers.

Some of these providers are located outside Australia or store data outside Australia, so joining the waitlist may involve your email address being held overseas.

We don't sell your address, rent it, or pass it to anyone else for their own marketing.

How we use your email address

Only to tell you about Surfbase becoming available, and to reply if you write to us.

How long we keep it

Until you ask us to delete it, or until we no longer need it for the waitlist — whichever comes first.

Your choices

Every email we send you will have an unsubscribe link. You can also email hello@surfbase.app at any time to ask what we hold about you, to correct it, or to have it deleted, and we'll action it.

Complaints

If you think we've mishandled your personal information, email hello@surfbase.app first and we'll try to sort it out. If you're not satisfied with how we handle it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

If this policy changes, we'll update this page and the date at the top.