SurfpingPrivacy Policy
Last updated: 24 October 2026 · Surfping by Jiji Labs
The short version:
- No phone number and no contact upload. You sign up with an email address and a password, or with Continue with Google. The email is used only for sign-in, codes and account recovery. Everyone picks an @handle.
- Online chats, groups, media and calls are end-to-end encrypted. We cannot read them.
- Nearby (without signal) works phone to phone. Nearby messages are never sent to our servers. They travel over an encrypted link between the phones but are not end-to-end encrypted, and @handles in Nearby are not verified yet: while Radar is on, anyone in range can see your name and @handle. When you have signal during a trip, your latest roll call answer (position, battery level and time) is stored in your crew's group on our server sealed with the crew key, so we cannot read it; only your crew can.
- An SOS needs internet. It is one message to your crew's group chat, it does not alert phones nearby, and it is not an emergency service.
- Link previews are on by default: when you send a link, your phone opens that page, so that website sees your IP address. You can turn this off in Me.
- No ads, no analytics SDKs, no tracking, and we never sell your data. Delete your account inside the app or on our deletion page.
1. Who we are
Surfping (“Surfping”, “the app”) is provided by PT JIJI LABS DIGITAL, a company established in Indonesia (Kabupaten Karanganyar, Jawa Tengah) (“we”, “us”). We are the controller of the personal data described in this policy. You can reach us at support@surfping.app.
This policy explains what Surfping handles, why, who helps us, how long we keep it and the choices you have. The Surfping app for Android, distributed on Google Play, has two halves: the online messenger, which uses our servers, and Nearby, which works phone to phone without signal and does not use our servers.
2. Information we collect (online)
Account
| Data | Details |
|---|---|
| Email address | You give it when you create an account, or Google gives it to us when you choose Continue with Google. We use it to sign you in, to send you 6-digit confirmation and password reset codes, and to answer requests about your account. It is never shown to other users and never used for marketing. |
| Password | We store only a salted PBKDF2-SHA256 hash of it, never the password itself. We will never ask you for your password or a code by email or chat. |
| Continue with Google | Google shares your email address, your name and a sign-in token with us. We check the token once and keep only the email address and the name you choose. We do not get access to your Google account, contacts or files. |
| @handle and display name | The unique handle and name you choose so people can find and recognise you. |
| Profile photo (optional) | If you add one. It is stored by us and is not end-to-end encrypted. |
| Nearby public keys | Your Nearby public keys and display name are published on your profile so friends can recognise you before a trip. Only public keys, never private keys. |
Confirmation and reset emails are delivered by Resend (Plus Five Five, Inc.), which receives only your email address and the message with the code.
What we don't collect: Surfping never asks for your phone number. Surfping does not read or upload your contacts.
Messages, groups and media
Messages in one-to-one chats and groups, and the photos, videos, voice notes and files you send, are end-to-end encrypted (Matrix Olm and Megolm). They are encrypted on your device and can only be decrypted on the devices of the people in the chat. Our server stores the encrypted content and the routing data it needs to deliver messages: which accounts are in which chat, chat requests, timestamps, your devices' public keys, and delivery and read state. We cannot read your messages or media. A group's name and photo are stored as chat settings and are not end-to-end encrypted.
A Dove is an ordinary end-to-end encrypted message with a landing time; the app on each phone keeps it sealed until then. Our server sees nothing more than for any other message.
Link previews
When you send a link, Surfping can add a small preview card (title, site name and a small picture). This is on by default; you can switch it off in Me › Link previews, and then links go as plain text and nothing is fetched. To make the card, your phone opens the page directly, not our server, so the website you linked to sees your phone's IP address, just as if you had opened the link yourself. The card is sent inside your end-to-end encrypted message, so we cannot see the link or the card.
Chat backup, diagnostics and app lock
Chat backup is on by default, so your chats survive signing out and in again or a new phone. Your message keys are stored on our server encrypted with a recovery key that only you hold; we cannot open the backup without it. The app keeps the recovery key on your phone and in Google Block Store, which Google end-to-end encrypts with your phone's screen lock when your Android version supports it; we never receive the key. You can see the key or start over with a new one in Me › Chat backup. We include no analytics or crash-reporting SDK; Google Play may give us aggregated crash and performance statistics under Google's own policies. App lock uses Android's fingerprint, face or screen lock check, and Surfping only learns whether the check passed.
Calls
Voice and video calls use WebRTC and are end-to-end encrypted between the phones (DTLS-SRTP). Call set-up messages are end-to-end encrypted and deleted once delivered. To connect a call your device contacts STUN/TURN servers operated by Cloudflare, which relay encrypted media when a direct connection is not possible and cannot decrypt it. Calls need an internet connection; they do not work over Nearby. The other person's device can see your IP address during a call, as with any call between two phones. Calls are never recorded or stored. The Calls tab keeps your call history only on your phone, encrypted, and deletes it when you sign out.
Notifications
To tell you about new messages and calls while the app is closed, Surfping uses Firebase Cloud Messaging (Google). Our server sends Google only a push token, the ID of the chat event and a priority, never the message text, the sender's name or any other content; your phone then fetches and decrypts the message itself. Firebase Cloud Messaging creates a push token and a Firebase installation ID on your phone; we keep the token only to deliver notifications and delete it when you sign out or delete your account. Google Analytics for Firebase is switched off. You can choose whether notifications show the message text on your lock screen (Me › Message preview).
Safety data
When you block someone we store that block so we can enforce it. When you report an account or message, we store the report: reporter, reported account, related chat and message identifiers, the reason and any note. Because messages are end-to-end encrypted, a report does not by itself give us the content of your chats.
Your devices and technical logs
Our server keeps a list of devices signed in to your account (identifier, device name, last active time and the IP address it last connected from) to deliver messages, warn you about new devices and let you sign a device out. Our servers and network provider record IP addresses and request logs for security, abuse prevention and troubleshooting, kept for up to 30 days.
Waves and Status
Waves are public posts inside the app. Unlike chats, they are not end-to-end encrypted, so that we can moderate them. When you use Waves we store: the text of your waves and replies, photos you attach (we remove location and camera data on your phone before upload), your likes, re-waves, follows and who follows you, and your 24-hour Status. Waves are visible to signed-in Surfping users under your @handle and name; they are never published on the open web and never show your email address or who you chat with. A Status and its photo are deleted 24 hours after you post it. You can delete any wave or reply at any time. We do not track or show who viewed a wave or a Status. Reports about Waves are reviewed by our team, and we may keep reports and moderation decisions for up to 12 months to handle repeat abuse and legal requests.
Your devices and technical logs
Our server keeps a list of devices signed in to your account (identifier, device name, last active time and the IP address it last connected from) to deliver messages, warn you about new devices and let you sign a device out. Our servers and network provider record IP addresses and request logs for security, abuse prevention and troubleshooting, kept for up to 30 days.
3. Nearby, location, Bluetooth and SOS
Nearby is what makes Surfping work without signal. It is off until you switch it on, and a notification shows while it runs. Nearby messages are never sent to us. They travel directly between phones. Nearby needs an account that you have set up once while online, and both phones need Surfping with Radar on. Range is roughly 30 to 100 metres.
What Nearby uses and why
| Permission | What it does |
|---|---|
| Nearby devices (Bluetooth) and Wi-Fi | Google Nearby Connections, part of Google Play services, finds Surfping phones around you and connects to them over Bluetooth, Bluetooth Low Energy and Wi-Fi. While Nearby is on, your @handle and display name are visible to Surfping phones in range so they can recognise you. Nearby does not verify @handles yet. |
| Location | Your position gives distance and direction to your crew and is the position in an SOS. Surfping asks for it only when you open Radar or start a trip, and explains why first. It is optional: without it Nearby still carries chats, but there is no distance, direction, trail or position in an SOS. Surfping never asks for location in the background: if you record a trail with the screen off, a notification shows while it records and you can stop it at any time. |
| Camera | To scan a friend's pairing QR code (and for video calls and photos). |
| Microphone | For voice and video calls and voice notes. |
Nearby messages
Nearby messages travel over an encrypted link between the two phones (Google Nearby Connections) and are stored only on those phones; they are never sent to our servers. This link protects them on the way, but Nearby messages are not end-to-end encrypted like online chats. @handles in Nearby are not verified yet, so treat a Nearby name as unconfirmed. In the “Everyone nearby” room, any Surfping phone in range can message you. A message to someone who is out of range waits on your phone and is sent when that person comes into range. Contacts can be removed in Nearby, and deleting the app erases everything Nearby keeps on your phone.
Radar, Trip, roll call and trail
Your position is used on your phone and shared only with your crew, inside the crew's end-to-end encrypted group or over Nearby; we cannot read it. It is shared only while a trip is on. When you have signal during a trip, your latest roll call answer (position, battery level and time) is stored in your crew's group on our server sealed with the crew key, so we cannot read it. If you turn on Record my trail, your trail is a list of recent positions, each marked with whether you had signal there; the newest part travels with your position to your crew, encrypted with the crew key, so the crew can see where signal was. Leaving the crew or ending the trip stops sharing.
SOS
An SOS sends your position, if you have one, to your crew as an end-to-end encrypted message in the crew's group. An SOS needs internet. It is not sent over Nearby and it does not alert phones near you. Surfping is not an emergency service. An SOS does not contact emergency services, rescue teams or us. Always call your local emergency number when you can.
4. How we use information
- To create and operate your account and deliver your messages (performance of our contract with you).
- To keep Surfping safe, prevent spam and abuse, and enforce our rules (our legitimate interests and legal obligations).
- To respond to your requests and to comply with the law.
We do not use your information for advertising, profiling or training models.
5. Infrastructure and service providers
PT JIJI LABS DIGITAL operates the Surfping messaging server on a cloud server rented from Biznet Gio (PT Biznet Gio Nusantara) in Jakarta, Indonesia. Encrypted messages, encrypted key backups and the other server data described above are stored there.
Cloudflare, Inc. provides networking and protection against attacks, the edge compute that runs our identity service, the database that stores account records (email address and password hash, handle, display name, blocks, reports, and public Waves, Statuses and their photos), and the STUN/TURN servers used to connect calls. Cloudflare operates a global network, so some processing may take place outside Indonesia under Cloudflare's data protection commitments.
Google provides Google Play, through which the Android app is distributed; Google Play services, which runs Nearby Connections and the location and compass services on Android phones; Sign in with Google (Continue with Google); and Firebase Cloud Messaging, which delivers Android notifications without any message content. Resend delivers sign-in and reset emails. We do not share your personal data with anyone else, except where required by law (for example a valid legal order) or to protect people's safety.
6. No ads, no tracking, no selling
Surfping contains no advertising and no advertising or analytics SDKs. We do not track you across other companies' apps or websites, and we do not sell your personal data or share it for advertising.
7. Retention
- Account and profile data is kept while your account exists.
- Encrypted messages are kept on our server so they can be delivered and synced to your devices, until your account is deleted.
- Call set-up messages are deleted once delivered. Call audio and video are never stored.
- Waves and replies are kept until you delete them or your account. A Status and its photo are deleted 24 hours after posting.
- Push tokens are deleted when you sign out or delete your account.
- Technical logs are kept for up to 30 days.
- Confirmation and reset codes expire after 15 minutes; unconfirmed sign-ups are removed after 7 days.
- Reports may be kept after the related account is deleted where needed for safety, to prevent repeat abuse, or to meet legal obligations.
- Nearby data lives on your phone until you remove it or delete the app.
8. Deleting your account and your data
You can delete your account at any time in the app: Me › Delete account. Your account, profile, email address and password hash, your Waves, replies, Statuses, likes, follows and their photos, your block list and your push tokens are deleted straight away. Erasing your messaging account (its profile and messages on our server) is queued and normally finishes within a few minutes. Your @handle is then held for 60 days, so nobody else can take it during that time. Delete the app to erase everything Nearby keeps on your phone.
Without the app, follow the steps on surfping.app/delete-account, or email support@surfping.app. We complete verified requests within 7 days.
Please note: copies of encrypted messages already delivered remain on the devices of the people you talked with. Reports may be retained as described above.
9. Security
We protect data with end-to-end encryption for online chats and calls, encrypted phone-to-phone links, encryption in transit for all connections, keys stored on your phone, access controls and rate limits. No system is perfectly secure, and no app can protect a phone that is already infected with spyware, so keep your phone updated. We work to protect your information and will notify you and the relevant authorities of a personal data breach where the law requires.
10. Children
Surfping is not directed to children under 16. You must be at least 16 years old to use Surfping, or older if the law where you live requires a higher minimum age. If you are under 18 (or under the age of majority where you live), you may use Surfping only with the agreement of a parent or guardian, which you confirm when you sign up. We do not ask for or store your date of birth. If we learn that an account belongs to someone below the minimum age, we will delete it. If you believe this has happened, contact support@surfping.app.
11. Your rights
Depending on where you live, including under the EU and UK GDPR, US state privacy laws such as the CCPA, and Indonesia's Personal Data Protection Law (Law No. 27 of 2022), you may have the right to access the personal data we hold about you and receive a copy; correct inaccurate data; delete your data; object to or restrict certain processing and withdraw consent where we rely on it; and not be discriminated against for exercising your rights. We do not sell or “share” personal data as those terms are defined under US state laws.
To exercise your rights, email support@surfping.app and include your @handle. We may need to confirm that the account is yours. We respond within the time required by applicable law. You may complain to your local data protection authority.
12. Changes to this policy
We may update this policy as Surfping changes. The effective date above identifies this version, and for material changes we will tell you in the app. It covers the Surfping app and this website.
13. Contact us
PT JIJI LABS DIGITAL
Jalan Piere Tendean, Pokoh RT 02/RW 07, Ngijo, Tasikmadu, Kabupaten Karanganyar, Jawa Tengah 57721, Indonesia
Telp. +62 812-5050-598
Email: support@surfping.app