Privacy Policy
Last updated 6 August 2026
This policy describes what SurfSort actually does, written from the code itself rather than from a template. If anything here is ever less than true of the software, the policy is the thing that gets corrected.
Who we are
SurfSort is made and sold by Innovation Anywhere OÜ, a limited company registered in Estonia (registry code 17010770, VAT number EE102749214), Sepapaja tn 6, 15551 Tallinn, Harju maakond, Estonia. We are the data controller for the information described here.
Questions, or want your data removed? Email contact@surfsort.app.
The short version
Your photos never leave your Mac. SurfSort sorts them on your own computer. What travels to us is your account details, a private backup of the people you have taught the app, and counts of how much you have sorted.
What we collect, and why
Your account
Email address, first and last name, and — if you sign in with Google — the profile picture URL Google gives us. We need these to give you an account, show you as signed in, and support you. If you answer the optional "how did you hear about us?" question, we store your answer.
Why we're allowed to: to provide the service you signed up for (contract). The attribution question is optional and you can skip it or change it later in Settings.
Your photos — what happens to them
Your photos stay on your Mac. SurfSort reads them locally, finds faces and surfers, and writes the sorted folders on your own disk.
To decide who is who, SurfSort sends cropped pictures of people (not whole photos) and the first names you have given them to Anthropic's Claude models, through a relay we run. We deliberately never send filenames, file paths, folder names, EXIF data, GPS coordinates, or timestamps. Anthropic processes these for us and does not train its models on them.
Why we're allowed to: to provide the sorting you asked for (contract).
Your people backup
So a new Mac or a reinstall restores your work, we store, privately to your account: each person's name, their mathematical "face signatures" (lists of 512 numbers derived from a face — it is biometric data; up to four per person, the app's memory of how they look), any traits you noted, and a few small face photos per person — the clearest crops the app has seen (at most six: one best face, plus up to five the recognition memory was built from).
Face signatures and face photos are biometric data, which European law treats as sensitive. We only store them because you ask us to by using the app, only to recognise the same people in your own future sessions, and never to identify anyone outside your own account. Your face data is readable only by your account — enforced by the database itself, not just by our code.
Usage and billing
- Sorting activity: one record per sorting session — when it ran, how many photos, and which version of SurfSort you were running — plus a daily photo total. This is how your plan's monthly photo allowance, the 3 free sessions, and the 3,000-photo AI limit on a free session are enforced. The version number lets us see how many people are still on an older build before we make an update compulsory, and answer "which version are you on?" when you write to support.
- AI cost: how many tokens each session used and what it cost us.
- Trial protection: while you are on the free trial only, we store a one-way scrambled fingerprint of your Mac's hardware id, so the same computer cannot claim unlimited free trials under new email addresses. It cannot be turned back into your hardware id, is only ever compared against other scrambled fingerprints, and is not recorded for paying customers.
- Payments: handled entirely by Stripe. Your card number never reaches us. We store your Stripe customer and subscription ids, your plan, its status, and when the current period ends.
Why we're allowed to: contract (billing and limits) and our legitimate interest in preventing abuse of the free trial.
Crash and error reports
This one is always on and there is no switch for it. When SurfSort crashes, when a sort fails, when an AI call is refused, or when the app hits an error it cannot get past, it sends us a report. Reports are the only way a bug that happens on your Mac and not on ours ever gets fixed.
A report contains: a short failure code, the stage of the sort or the screen it happened on, how many photos were in that session, which version of SurfSort you were running, your macOS version, your Mac's model identifier (like Mac16,10), a short trail of the last few things the app did, the error message itself, and — for a crash — the list of program functions that were running at the moment it died (a "stack trace"). It also records which account it came from, so we can write back to you about it; a crash before you sign in carries no account.
A report never contains your photos, filenames, file paths, folder names, EXIF data, or the names of the people you have tagged. Those are not stripped out afterwards — they are never put in, which is the same rule the rest of the app follows.
Why we're allowed to: our legitimate interest in keeping software we sell working, and in fixing it before it costs you a session.
Anonymous counts
The website and app record plain counters — "landing page viewed", "download clicked", "signed in", "session started". These rows contain only an event name and a time. There is no user id, no IP address, and no device id in them, so they cannot be traced back to you. We use no third-party analytics, no advertising trackers, and no cookies for tracking. When we invite a photographer to try SurfSort, the link we send may carry a short code that tells us that invitation was opened and led to a download — the code identifies the invitation, not the visitor or their device.
Feature requests
If you post or comment on the in-app requests board, your name and what you wrote are visible to other SurfSort users. Don't put anything private there.
Who else handles your data
| Who | What they do | Where |
|---|---|---|
| Supabase | Hosts our database, sign-in, and the people backup | European Union (Ireland) |
| Anthropic | Runs the AI that decides who is who | United States |
| Stripe | Takes payments and holds your card details | United States / Ireland |
| Only if you choose "Sign in with Google" | United States | |
| Netlify | Hosts surfsort.app | United States |
Transfers to the United States rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
We do not sell your data, and we never will.
How long we keep it
Be aware of this one, because it is not what most policies say.
When you delete your account, we do not erase your rows — we mark them closed. Your account is closed immediately, your subscription is cancelled, and nothing of yours is shown or used in the normal running of the service again. But the underlying records — including your people backup and face thumbnails — remain in our database, excluded from use, rather than being wiped.
The one thing we do remove is your sign-in identity: your password and login stop working the moment the account closes, and that is also why the same email address is free to sign up again later.
Crash and error reports outlive the account they came from: closing your account detaches your id from the report, and what is left — the code, the versions, the stack trace — stays, because a bug does not stop existing when the person who found it leaves.
Anonymous counters are kept indefinitely, since they are not linked to anyone. Invoices are kept for the seven years Estonian accounting law requires.
If you want your data genuinely erased rather than closed, say so — email us and we will scrub it by hand, which is your right under GDPR Article 17. See below.
Your rights
If you are in the EU/EEA or the UK, you can ask us to: give you a copy of your data, correct it, erase it, restrict or object to how we use it, or hand it to another provider. Where we rely on your consent, you may withdraw it at any time.
Email contact@surfsort.app and we will answer within one month. Deleting your account in Settings closes it; email us if you want erasure, because as explained above, deleting in the app does not by itself wipe the records.
If you think we have handled your data badly, you may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to your own country's authority.
Children
SurfSort is not for under-16s and we do not knowingly collect their data.
Security
Every table enforces, in the database, that you can only read your own rows — so a bug in our app code cannot expose another customer's data. Face thumbnails sit in private per-user storage. Traffic is encrypted. Our AI key lives only on the server and is never inside the app you download.
Changes
If we change this policy materially, we will tell you in the app or by email before it takes effect.