Privacy
Public beta · Updated 19 October 2026
Surfd is an independent browser surfing game. You can play without an account. Signing in is optional and enables public records.
Information used
Google or X supplies account information to Supabase Auth when you sign in, such as your provider identifier, email address, name and avatar. Surfd uses your account ID to associate your profile and records. It does not request permission to post to your social account.
Where email accounts are enabled, Supabase Auth also handles your email address and password. Your public username is separate from your email address. Resend delivers confirmation and password-reset emails and processes the recipient address, email contents and delivery information. We do not enable email open or click tracking. The email-link page does not load visitor analytics.
Online records contain your chosen username, account ID, map and movement version, completion time, checkpoint splits, date, and recorded movement commands. Usernames, account IDs, verified records and available verified replays are public. Your email address and login credentials are not included in leaderboard responses.
Public-name changes are recorded with the previous name, new name, account ID and time. Moderator changes also record the moderator account and reason. This history is available only to moderators for account moderation and is retained while the account exists. Deleting an account removes its name history. Players can change their name once every 60 days; moderators can override this wait.
Your browser saves controls, preferences, local personal bests, login session and pending submission information in local storage. You can clear these using your browser's site-data controls. There are no advertising SDKs in the game.
Signed-in finishes can keep up to six pending command replays in IndexedDB while uploads and verification complete. They are associated with the account that played them and are removed after a terminal result or when the game confirms the attempt has expired. If you stop visiting or do not sign back into that account, copies remain until you clear this site's browser data.
If you finish an eligible run as a guest, the browser also keeps one completed command replay and its temporary claim ticket in IndexedDB so you can sign in and save that run. The replay is uploaded only after you choose to save it or sign in to save it. An unclaimed replay is valid for 24 hours from the run ticket's issue time. Once linked to an account, its local copy can remain for up to seven days to recover an interrupted upload or verification. Expired copies are removed the next time the game accesses them; you can also dismiss the copy or clear site data. An already-uploaded run may still finish verification after its local copy is dismissed.
Visitor analytics
We use Vercel Web Analytics on the live game to measure a sample of visits and page views, including referral sources, approximate location, and browser/device information. Approximately 10% of browser tab sessions are selected. A temporary browser-session flag keeps that choice consistent across reloads where browser storage is available; it contains only yes/no, with no identifier, and is not sent to analytics. Vercel uses a temporary visitor hash rather than analytics cookies; it resets daily. These statistics are not linked to your Surfd account. We remove query parameters and URL fragments from the page URL sent to analytics, including login codes and replay identifiers. We do not send your email, username, account ID, or movement commands to analytics. See Vercel Web Analytics privacy information.
Multiplayer and chat
Joining an online server shares your public name, temporary or account identifier, movement, displayed run timer, rank and points with the other players there. While you are connected, the public server list also shows your public name, rank and points to anyone browsing servers, as a classic server browser does. Public chat and verified finish announcements are visible to that server. Solo play does not connect to a multiplayer room. Hiding players changes your display; it does not stop other players from seeing you.
Links, including Surfd links, are not allowed in public chat. Clear links are blocked before other players receive them and cause a five-minute chat mute in that server. The automatic moderation record contains the account ID, server, time, rule and mute expiry, but not the blocked message or URL. Ambiguous link-like filenames may be rejected privately without a mute. Private player reports can still include links for moderators to review.
Cloudflare runs the multiplayer rooms. For moderator review, each server retains up to 50 delivered chat messages per account from the last seven days, including the account ID, public name at the time, server and timestamp. Moderators can review this limited history while the player is offline. Older chat is not reconstructed. Blocked links are not included in this history.
Reports include the reporter's public name and account ID, the reported player, a reason and recent-message excerpts. Resolving a report retains its evidence and adds a private moderator resolution note. Reports remain eligible for deletion seven days after creation; room action logs after 30 days. These records and retained chat are only exposed through moderator controls. Room cleanup happens during later room activity, so physical deletion can be delayed while a room is unused; expired chat and reports are excluded from moderator views. Connection attachments disappear when the connection closes.
Manual chat mutes apply to an account across all servers and can have an expiry or last until a moderator removes them. We store their status and action history, including the moderator account, reason and any associated report, in the account database until the moderated account is deleted. The affected player can see the active mute's reason and duration. The full action history is restricted to moderators. Room copies of this status are eligible for deletion two hours after their last signed update and are refreshed while the account is connected. Chat mutes do not remove records or prevent ranked saving.
Accepted-result delivery receipts are retained for up to seven days in the records database; room copies are eligible for cleanup after one day.
A secret-salted hash of the connection's IP address is used for guest connection limits and temporary bans. The room does not store the raw IP address in player state. Guest identifiers are kept in the browser for reconnecting. “Mute for me” preferences are local to your browser. Moderators can apply account-wide chat mutes, disconnect a player or temporarily ban them from a room. Ranked-access restrictions are separate from chat mutes.
Friends and messages
Where friends are enabled, the account database stores your friendships, pending friend requests, blocks, notifications (friend requests, accepted requests and server invites, with the sender's account and the server), direct messages and optional profile extras (motto, banner map, title and up to three showcased maps). Your public name is shown to players you send requests, invites or messages to. Profile extras are visible to signed-in players, except between accounts where either has blocked the other.
Friends can see where you are playing: the server you are connected to, the map you are playing solo, or that you are in the menu, otherwise when you were last seen. While you are signed in, the game sends this state about once a minute; it is shown for two minutes. Server presence is read from the multiplayer rooms when a friend's list refreshes. Players who are not your friends, or who are blocked either way, do not see it in their friends list; the public server list and the server itself still show who is connected.
Direct messages are only possible between friends. We store the sender, recipient, text, time and whether it was read. They are not end-to-end encrypted. Links are refused, the chat language filter applies, and an account-wide chat mute also blocks messages. Messages and notifications are deleted after 30 days; you can dismiss notifications sooner. Blocking someone removes the friendship, pending requests and notifications between you; earlier messages can no longer be read and expire on the same schedule. You can report a message you received: the report keeps a copy of that message, up to ten earlier messages between you, your account, the sender and the reason, visible only to moderators, and it is deleted 90 days after it was made. Unanswered friend requests are deleted after 30 days. Short-lived records of when requests, messages and invites were sent, and to whom a request was sent, are kept for up to two hours to enforce rate limits. Deleting your account removes all of this data.
Playtime
For signed-in accounts, Surfd counts playtime: time with a map loaded, solo or in a server, while the tab is in front and you have pressed a key, clicked or moved the mouse in the last two minutes. Servers count it while you are connected and send each account's total about every five minutes; solo time is reported with the presence heartbeat described above. We store your total server seconds, total solo seconds, the date counting started and whether you hid it, not when or where you played. Your playtime is shown on your profile and when another player types /played in your server, unless you choose Hide my playtime in your account settings; hiding it does not stop counting. Guests are not counted. Deleting your account removes it.
Hosting and security
Vercel hosts the website and processes record submissions. Supabase provides authentication, the database and replay storage. Cloudflare relays multiplayer connections and stores room and moderation state. These providers may process IP addresses, request details and operational/security logs as part of running their services. See Vercel's privacy policy, Supabase's privacy policy and Cloudflare's privacy policy.
Where enabled, Cloudflare Turnstile checks account requests for automated abuse using browser and connection signals. Resend processes account email delivery; see Resend's privacy policy.
Retention and deletion
Personal-best replay files remain available with their records. Other verified replay files are eligible for removal after seven days; numeric record history remains. Abandoned/rejected uploads are removed by scheduled maintenance after upload credentials expire. Deletion may be delayed while a service is unavailable.
To remove your Surfd account and records, open Account → Delete account in the game. This removes the active profile, records and replay files and revokes login sessions. Temporary upload reservations remain until their credentials expire. Provider logs and backups follow the hosting providers' retention processes. Clearing local site data separately removes preferences and local records from your device.
When a guest run is claimed, a temporary record of its claim ID and account ID prevents the same ticket being reused by another account. This record survives account deletion until the original 24-hour ticket expires and is then eligible for cleanup.
Account deletion does not retract chat or announcements already delivered to another player's browser. Room moderation records follow the short retention periods above.
Contact
For privacy questions or deletion assistance, contact the project maintainer through the project maintainer on GitHub. Do not post passwords, login tokens or other private account details in public issues.