Privacy Policy

1. Who We Are

2. Data We Collect

2.1 Data you provide directly

• Account information: email address and password (hashed with bcrypt) when you sign up
• Preferences: digest frequency, preferred digest time, and timezone

2.2 Data collected via the Chrome Extension

• Bookmark content: tweet text, tweet URL, author name, author handle, author avatar URL, media URLs, engagement metrics (likes, retweets, replies), and bookmark timestamp

This data is only collected from the X/Twitter bookmarks page (x.com/i/bookmarks) that you actively visit. The extension does not access any other pages or your X account credentials.

2.3 Data generated by use

• Search queries: queries you enter in the BackSurf search feature
• AI-generated data: vector embeddings of bookmark content (for semantic search) and AI-assigned categories
• Digest logs: records of which bookmarks were included in digest emails and when they were sent

3. How We Use Your Data

We use your data exclusively to provide and improve the BackSurf service:

• Authentication: to verify your identity and secure your account
• Bookmark storage & backup: to store and preserve your synced bookmarks
• AI search: to generate vector embeddings of bookmark content enabling semantic search
• Auto-categorization: to classify bookmarks into categories using AI
• Digest emails: to send you periodic emails resurfacing bookmarks (only if you opt in)

4. Legal Basis for Processing (GDPR)

Under the General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:

5. Third-Party Processors

To provide the Service, we share limited data with the following processors. No data is sold or transferred for unrelated purposes.

6. Chrome Extension Data

The BackSurf Chrome Extension collects data only from the X/Twitter bookmarks page (x.com/i/bookmarks). Specifically:

• Data collected: tweet text, author name, author handle, author avatar URL, tweet URL, media URLs, engagement metrics, and bookmark timestamp
• Stored locally: authentication token and set of synced bookmark IDs (via chrome.storage.local)
• Transmitted to: BackSurf servers (back.surf) over HTTPS for storage and processing
• Not collected: X/Twitter credentials, browsing history, data from other websites, or any data outside the bookmarks page

7. Data Retention

When you delete your account, all associated data is permanently deleted via cascading deletion. This includes your profile, bookmarks, categories, search history, and digest logs.

8. Your Rights

Under the GDPR and applicable data protection laws, you have the following rights:

• Right of access (Art. 15): request a copy of the personal data we hold about you
• Right to rectification (Art. 16): request correction of inaccurate data
• Right to erasure (Art. 17): delete your account and all associated data from your dashboard settings
• Right to data portability (Art. 20): request an export of your data in a machine-readable format
• Right to restrict processing (Art. 18): request that we limit how we use your data
• Right to object (Art. 21): object to processing based on legitimate interest
• Right to withdraw consent (Art. 7(3)): withdraw consent for digest emails at any time from settings

To exercise any of these rights, email us at support@back.surf or use the account deletion feature in your dashboard settings. We will respond within 30 days.

9. International Transfers

Your data may be processed in countries outside the European Economic Area (EEA) by our third-party processors (Supabase, Voyage AI, Anthropic, Resend, Cloudflare). These transfers are protected by appropriate safeguards, including Standard Contractual Clauses (SCCs) and the processor's own data protection commitments.

10. Security

We implement appropriate technical and organizational measures to protect your data:

• Passwords are hashed with bcrypt (cost factor 12)
• All data transmitted over HTTPS/TLS
• Database access restricted to service-level credentials with row-level security enabled
• Extension authentication via signed JWT tokens (HS256, 30-day expiry)
• Environment secrets stored securely in Cloudflare Workers

11. Children's Privacy

BackSurf is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on the Service before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact