Effective date: October 25, 2026 Operator: Symonic LLC Contact: jacob@symonic.com
This policy covers the surface iPhone app (bundle id com.getsurfaceapp.surface). It describes what the app does today. When that changes, we'll update this page before the change ships (see "Changes").
| data | where it lives | who can see it |
|---|---|---|
| Messages you type on the main screen | in the app's memory only; not saved. They're gone when the app closes | only you, on your device |
| Room points (name, colour, creation time) and the Room mode | your device's local app storage | only you, on your device |
| Your own AI provider API key (only if you add one) | the iOS Keychain on your device, not synced to iCloud | only the app on your device |
We don't run servers that receive this data. The app makes no network requests unless you turn on a feature that clearly says it does, such as your own API key.
If you add an API key from an AI provider (for example OpenAI, Anthropic or Google): - The key is stored in the iOS Keychain on your device. We never see it. - When you send a message in that mode, its text (and the conversation context the app includes) is sent directly from your device to that provider over HTTPS, and the reply comes back the same way. Messages sent this way are marked in the app. - That provider's terms and privacy policy govern what they do with it, including retention and training. Read them before you enable this. - To stop, turn the option off and tap Remove key. iOS can keep Keychain items after an app is deleted, so remove the key in the app first if you want it gone.
If the app offers a downloadable on-device model, the model file is downloaded from its public host (for example Hugging Face). That download is a normal file request: the host can see your IP address, as with any download. It doesn't include your messages. After that, the model runs entirely on your phone.
surface doesn't have accounts today. When accounts ship, this section will apply and we'll update this policy before release: - We'll log when your account was created (a UTC timestamp and the app version), and when you sign in or ask for deletion. - You can delete your account inside the app. Your content on the device is erased immediately, and any copy on our servers is erased from active systems right away. A copy in an encrypted backup is erased when that backup is overwritten or restored, and is never used in the meantime. - We keep a minimal deletion record (event names, timestamps, app version, and a one-way hash of your account id, with no messages, name or email) for 30 days to prove the deletion happened and to prevent abuse. Then it's erased too. If your region needs a different period, we'll state it here. - We'll respond to deletion and access requests within one month (EU/UK) or 45 days (California). Where the law allows an extension, we'll tell you. - If we use your region to choose these rules, it's read from your device's region setting, not from your IP address.
surface isn't directed at children under 13, and we don't knowingly collect personal information from anyone, including children.
We don't hold your data, so there's nothing on our side to access, correct or delete. You control everything on your device: - Delete Room points in the app, and remove your API key in Settings. - Deleting the app removes its local storage (see the Keychain note above).
If you have questions or a privacy request, email jacob@symonic.com. We'll answer within 30 days.
Data stays on your device and is protected by iOS (device passcode, app sandbox, Keychain). Calls to an AI provider use HTTPS. No method is perfect. Keep your device updated and protected with a passcode.
If we add features that change this (for example accounts, sync or backups), we'll update this policy and the effective date before that version ships. If a change means data starts leaving your device, the app will tell you before it happens.
Symonic LLC ยท jacob@symonic.com