Privacy policy

Last updated: 9 October 2026 · applies to Surfwise Browser for Android and for iPhone and iPad (com.anvillabs.surfwise; what differs on iPhone and iPad is in section 10) and to the surfwisebrowser.com website, including its “Open in Surfwise” page at /check/ (section 9), published by Anvil Digital Labs.

1. What stays on your device

The browser writes the following to the app’s private storage on your phone. This storage is never uploaded to us, and the app sets allowBackup=false, so Android does not copy any of it into a Google Drive backup either:

• browsing history, open tabs and the sites in them;
• your list of the links you checked and their results. Each of those links did reach our server when it was checked (section 2); the list itself stays on your phone;
• bookmarks;
• the downloads you start and the files themselves;
• cookies and site data of the websites you visit;
• settings: search engine, theme, desktop mode, reader preferences, your ad privacy choices, the rewards you have unlocked by watching a video (including how many Pro actions you have left and how many optional videos you watched today), and whether Surfwise has already asked to be your default browser;
• your Surfwise Plus status, if you subscribe: the plan, its renewal or end date, and how many AI answers are left this month. The purchase token is not kept on the phone;
• per-site settings: JavaScript on or off, and the browser identity a site is told (Default, Android, iPhone or Computer). Choices made in a private tab are kept in memory only and are forgotten when you close your private tabs;
• the sites you told the Password & OTP shield to trust. Sites you trust from a private tab are forgotten when you close your private tabs;
• user scripts you add, with their names and whether each one is on.

The page tools also work on your phone and send nothing to us:

• The Password & OTP shield decides on the phone, from checks you already made and the site’s name and address. It never sends what you type or which site you are on.
• Page X-ray reads what the page reports to the browser (the files it loaded, their sizes, cookies and the page’s source), on the phone. Nothing is sent, and nothing it shows is stored.
• Scam evidence PDFs are made on the phone and saved to your phone’s Downloads folder, where your file manager and other apps with file access can see them (from a private tab they are not saved). They leave the phone only if you share them.
• Save to phone’s Downloads (Settings → Downloads, off unless you turn it on, Android 10 and newer): finished downloads are also copied to your phone’s Downloads folder, where your file manager and other apps with file access can see them. It never copies an Android app (APK), a download made from a private tab or finishing while one is open, or a file the download check flags. The copy stays on your phone and nothing is sent to us.
• The list of what an Android app (APK) you downloaded can access is read from the file on your phone. (The “What this link downloads” card on a check’s result is different: our server makes it, see section 2.)
• User scripts are stored on the phone and run only inside the web pages their site patterns name. When you add one from a link, Surfwise downloads it straight from that link’s site, like opening a page (that site sees your IP address, as any site you open does), never through our server. They never run in private tabs, and they are turned off on a few sites. A script’s own saved values stay on the phone. A script can make web requests only to the sites its header names (@connect), straight from your phone, never through our server and without your cookies.
• Request details and developer tools. Page X-ray can show a request’s headers, what was sent and what came back. This is read on the phone and kept in memory only while the tab is open. The optional Record mode fetches the page’s files again from your phone to show more detail. Requests you build or resend (Surfwise Pro, or a few Pro actions unlocked by an optional video, section 6), rules you set, cURL commands and HAR files are made and stored on your phone; a request you send goes straight from your phone to the site you choose. None of this is sent to us.

Copied links. On the home screen, on Check a link and in the empty address bar, Surfwise asks Android what kind of item is on the clipboard (whether it is text, when it was copied and, on Android 12 and newer, whether Android thinks it is a link) so that it can offer to check a copied link. It does not read the text for this. A clip that an app marks as sensitive, such as a copied password, is never offered (Android 13 and newer). The text is read only when you tap Check it or Paste (Paste and go in the address bar), and only its first link is used. Nothing about the clipboard is sent to us: a link you check this way reaches our server like any other check (section 2), and Paste and go just opens it as a page (section 3). The phone remembers only when the clip you dismissed was copied, so the same offer does not come back. You can turn the offer off in Settings → Link checker → Offer to check copied links.

Private tabs are not written to history and are not cached. When you close the last private tab, Surfwise deletes the cookies and site data of the sites you visited privately. A link you check from a private tab still goes to our server like any other check (section 2), our server keeps the same records for it (section 4), Ask AI works on it as on any check, and the check’s screens show ads as for any other check (section 6). Only the records on your phone are skipped: it is not added to your list of checked links or to the address bar’s safety results.

Clearing the app’s data in Android settings, or uninstalling it, removes all of it. That has never needed our involvement.

2. What reaches our server

Our server is surfwisebrowser.com, reached over HTTPS. The app sends it something in these cases only.

When the app starts, and again when its copy is more than 30 minutes old, it downloads its settings: a signed file that switches features and ad limits on or off. That request carries the install id (below), the app version and platform, and your IP address, which any internet request reveals. It says nothing about what you browse, and our server stores nothing from it, apart from our web host’s standard access log (section 4). If Surfwise Plus is on sale, or you have bought it, the app also asks our server for your subscription’s status when it starts (at most every 6 hours) and when you open the Plus screen. That request carries the install id and nothing else about you.

When a link is checked. Surfwise sends a link to our server only to check it. That happens in these cases:

• You ask for a check. You paste or type a link into Check a link; tap Check or “Check this page”, which sends the full address of the page you are on; tap “Ask AI about this page” in a site’s settings sheet, which checks the page you are on and then offers Ask AI; choose Check in a link’s long-press menu; check an entry in your history; tap Check on a link the message checker found; scan a QR code (a UPI payment code is never sent); or tap “Check site” on the UPI payment warning, which sends only the web page’s address, never the payment details.
• A check starts on its own, without a Check tap:
  • you open a short link from one of our partner short-link services inside Surfwise, or the short-link service hands a link you tapped elsewhere to Surfwise;
  • you share a link to Surfwise from another app (“Scan with Surfwise”), or you select text in another app and choose “Check with Surfwise” (the first link in the selected text is checked), or another app or website opens a Surfwise check link or short link, such as the “Open in Surfwise” button on our website (section 9). An ordinary web link that another app opens in Surfwise, including when Surfwise is your default browser, just loads as a page and is not sent (section 3);
  • the first time you open Surfwise after installing it from one of our link pages, it checks the short link that sent you there, using the alias from Google Play’s install referrer.

With each check the app sends:

• the link itself — its full address, including anything after the ?. For a partner short link the app sends a sealed token instead, and for an install it sends the alias; our server reads the destination from the token, or looks the alias up in the shortener’s records. Our server then follows the link and sees the addresses it redirects to;
• an install id — a random identifier (a UUID) the app generates the first time it runs. It is not your Android ID, not your advertising ID and not tied to your Google account. Reinstalling the app produces a new one;
• the platform (android), the app version, and a random one-time number per check;
• a country code — two letters such as IN, worked out on the phone without any permission: the country of your SIM card, else of your mobile network, else the region of your language setting (a plain “English (United States)” setting counts as unknown and sends nothing). It is not your location; the app has no location permission. Our server uses it to decide how many videos Ask AI needs in your country and for statistics of ad revenue per country;
• the language the app is set to;
• a Play Integrity token — a statement issued by Google that this really is our app, unmodified, on a genuine device. Our server has Google decode it and keeps the outcome with the check: pass or fail and, for a fail, the reason, such as the device or licence check. It does not identify you to us. Ask AI and Plus requests can carry one too, when our server asks for it;
• whether you chose a Deep check (with Surfwise Plus, every check is a Deep check while Deep checks are offered);
• your IP address.

If the check came from a partner short link, our server also records which short link it was (its alias and domain) so the app can show you the same link and, afterwards, hand you back to it.

Our server then fetches the link itself, following its redirects the way a browser would. The sites along the way see a request from our server, not from your phone. The server records the redirect chain, the final page’s title and response headers, and its server’s IP address and certificate, and it looks the link up with the services in section 5. It reads up to 512 KB of the final page to look for signs of a scam, such as a password, OTP or card form, a brand the site does not own, a payment request or an app-download button, and it keeps what it found rather than the page’s text (section 4; the AI review below is the one exception). For a page with a form, a brand or an app link, it may fetch the page once more as a desktop browser, and fetch the same site’s home page, to spot pages that hide from checkers and sites that were hacked. It also keeps, with each check, how the check started, when the report was shown and when you opened the link, which it uses for statistics and to stop abuse (section 4).

Files a link downloads. If the checked link leads to a download, such as an Android app (APK), our server reads parts of that file straight from the site that serves it, usually its first bytes, its list of contents, its signing certificate and the app’s manifest. That is how the result can show “What this link downloads” before you download anything: the file’s name, real type and size and, for an app, its name, package, version, the permissions it asks for and who signed it. When the site does not allow reading parts of a file, our server downloads the whole file only if it is 25 MB or smaller, and then also works out its SHA-256 fingerprint. The file is never stored: it is held in a temporary buffer or temporary file only while it is examined. Nothing extra is sent from your phone for this, and the site sees our server, not you. “Look up on Google Play” on that card opens the Google Play app on your phone for that package; the app makes that link itself.

AI review. This is switched on and off from our server, so it may not be running for you. While it is on, our server can ask Anthropic’s AI (Claude) for a second opinion in two cases:

• On its own, during a check whose signs are mixed: for example exactly one of our checks found a warning sign and none found danger, or the page asks for a password, payment or app install without clear warning signs, or an app file shows only minor signs. It never runs when a check already found the link dangerous, on a well-known site (its pages may show someone’s private content), or on a page with less than 200 characters of text. It never needs a video.
• When you ask, with “Ask AI about this page” on a check’s result. How the videos and Plus work is in section 6. Ask AI is not offered for well-known sites. For our partners’ short links it is offered, but our server removes every site name and address before anything goes to Anthropic. On iPhone and iPad neither kind runs until you have allowed AI review (section 10).

What our server sends to Anthropic comes from its own fetch of the page, not from your phone: the page’s title, its visible text shortened to 6,000 characters, and the names of its form fields (never what anyone typed in them). For a download without a page, it sends the file summary above instead (name, size, type, and an app’s package, label, version and permission names). For the automatic review that is all: it does not send the link’s address or the site’s name. Ask AI sends more, and only when you ask for it (on iPhone and iPad also only after you allowed AI review): the page’s visible text shortened to 18,000 characters; for each form field its name, type, placeholder and label (never what anyone typed); the site’s name (its domain, such as example.com); the host names of the addresses the link redirected through and of the sites the page’s links and forms point to; the domain’s age and registrar; the hosting country and network; and the warning signs our own checks found. It never sends the full address of a page (the path or anything after the ?), and for a partner short link it sends no site name or address at all. Neither kind sends your install id, your IP address, cookies or anything you typed. For Ask AI, your phone sends our server only the check’s id, the Ask AI offer’s id, your country code, the app’s language (so the answer comes in it) and, when our server asks for one, a Play Integrity token. Anthropic handles this under its commercial terms: it may not train its models on it, and it deletes it within 30 days unless it is flagged under Anthropic’s usage policy or the law requires Anthropic to keep it longer (Anthropic’s retention page). The AI can be wrong. On its own it can make a result Be careful at most; it makes a result Dangerous only together with another warning sign from our own checks, and it can clear a Be careful that rested only on minor signs. An Ask AI answer never changes the result.

The Surfwise intel list. When our own checks (not an outside list) find a link dangerous, our server adds it to the Surfwise intel list, our own list of dangerous sites, so that later checks of it are faster and surer. It also keeps, for up to 90 days, a one-way hash of the page layout of well-known sites it checked, so a copy of such a page elsewhere can be recognised; the hash contains no text you typed and no details about you. The list holds the full checked and final addresses (including anything after the ?), for a new or look-alike domain also its host or domain name, the site’s server IP address and network, the SHA-256 fingerprint of a dangerous app file, a fingerprint of the page’s layout, and one-way hashes of any UPI IDs, phone numbers and Telegram handles on the page. It holds nothing about who checked the link. A Dangerous result on a well-known site is also kept for 7 days so that we can review it by hand.

Download check. This check is currently switched off, so today nothing below is sent. When we switch it on, it runs only while Settings → Link checker → Check downloads for known malware is on, and you can turn it off there at any time. Then, after a download finishes, the app sends the file’s SHA-256 fingerprint (a 64-character code worked out from the file’s contents), your install id, the app version and, when our server asks for one (normally the first check of the day), a Play Integrity token. Nothing is sent for downloads made while a private tab is open, or for files over 512 MB. It never sends the file, its name, its web address or the page it came from. Our server looks the fingerprint up in the Surfwise intel list and, only while we have also switched abuse.ch on (it is off too), asks abuse.ch’s MalwareBazaar about it. It returns “known malware” (with the name of the malware family, when there is one) or “not listed”. “Not listed” is not a guarantee that a file is safe.

When you use Ask AI, the app asks our server for an Ask AI offer (the check’s id, your country code, the app’s language, a random one-time number and, when asked, a Play Integrity token), checks the offer while your videos are confirmed, and then asks for the answer (the check’s id, the offer’s id and the language). For each Ask AI video it also sends that video’s ad data from LevelPlay (section 6). When you buy or restore Surfwise Plus, the app sends our server the purchase token that Google Play issued, the product and plan ids, a random one-time number and, when asked, a Play Integrity token (section 6). Your payment details never reach us.

When you use “Report an ad”, the app sends your install id, the id of your most recent check (see section 6), the place in the app, the reason you picked and your note. It also sends a network field, which currently always says “unity”, whichever network showed the ad. When you use “Clear my data on the server”, the app sends the install id with the deletion request.

Every one of these requests carries your install id. We do not ask for or receive your name, email address, phone number, contacts, precise location, or any file on your phone. Our server does not work out where you are from your IP address; the country code above comes from your phone’s settings, and the ad networks do infer an approximate location from your IP address (section 6).

3. What browsing does not send

Ordinary browsing in Surfwise is not reported to us. Pages you open, searches you type and sites you sign in to never reach our server, and the AI review never looks at them. Only links that Surfwise checks do: the ones you ask it to check, and the cases in section 2 where a check starts on its own.

Surfwise as your default browser. Surfwise can be your default browser. On Android 10 and newer it asks once, with Android’s own dialog, the first time you are on its home screen after setting it up, and you can change it later in Settings → General → Default browser or in Android’s settings. When it is your default, a web link you tap in another app opens in Surfwise as an ordinary page: it is not sent to us and not checked unless you tap Check. The only links from other apps that open a check are our partners’ short links and Surfwise’s own check links (section 2).

Two things are worth naming because they are not ours:

• Websites you visit see your requests, exactly as in any browser, and may set cookies. Your search engine sees your searches.
• Android’s WebView — the browsing engine Surfwise uses — has Google Safe Browsing turned on, and Surfwise keeps it on; it is how the browser can warn you before a known malicious page loads. That check is performed by Android itself against Google’s lists, under Google’s privacy policy. When it flags a page, Surfwise keeps the page closed and shows its own warning, and Android’s WebView may send Google a report of that page’s address, under the same policy. We neither see nor keep these results or reports.

4. How long we keep it

Old records are removed by a clean-up that runs while our server is handling requests, at most every 10 minutes, not on an exact timer. A record can therefore outlast the times above by a little. Separately, our web host keeps its standard access logs (IP address, time and the address requested) on its own schedule.

5. Third parties

Services that receive data because of something the app or our website does:

Surfwise has no analytics or crash-reporting SDK of its own, and we do not measure how you browse. Our server does keep statistics about checks and totals of ad revenue (section 4). The ad SDKs, and Google’s billing library, send their makers their own diagnostic and crash information (for example device model, Android version, app version and error events), as they do in any app that uses them.

6. Advertising and your choices

Surfwise is free because it shows ads. Where they are offered, you can subscribe to Surfwise Plus, which removes Surfwise’s own ads, or to Surfwise Pro, which also adds the developer tools (below); nothing else in the app is for sale.

• Where ads appear — only on Surfwise’s own screens: one 300×250 ad on the home page and on each step of a link check; a small banner on the list screens (tabs, history, bookmarks, downloads and the Check a link screen); and a 300×250 ad on the sheet that shows when a download finishes.
• Full-screen ads — at most one per link check, when you tap Continue from step 2 to step 3; and a “browsing break” ad when you go back Home after 4 minutes or more of browsing. Full-screen ads are spaced apart and limited per day.
• Where ads never appear — on or over a web page, in private tabs (a link check you start from a private tab is a Surfwise screen and shows the check’s ads), on a link we found dangerous, in the message checker, or on error screens.
• Optional videos (rewarded ads) — you choose to watch one, and the reward is stated first:
  • a Deep check, offered at the start of a link check and as “Detailed site report” on the result: every lookup runs live instead of from our short-lived cache, and the report adds the certificate, domain and server details. Up to 25 a day;
  • No waiting on link checks for 2 hours: no pause between the steps of a check (every check still runs in full);
  • Turbo downloads for 6 hours;
  • all theme packs for 3 days;
  • 3 Surfwise Pro actions, where offered: three uses of the developer tools that otherwise need Surfwise Pro (Edit & resend, editing a request’s address or headers, cURL import and export, saving a request, rules, HAR export and opening a page with chosen headers). They are counted on your phone, nothing about them is sent to our server, and unused ones expire 24 hours after you earn them. Up to 5 such videos a day. They are never offered to Pro subscribers, and the developer tools stay off on the few sites where they are always off;
  • an AI answer about a page (“Ask AI about this page”), offered on a check’s result while Ask AI is switched on: 2 short videos in most countries and 1 in a few, such as the US and the UK. The number is shown before the first video. These videos use their own ad unit, and a video counts only once LevelPlay’s server confirms it to ours. You can earn up to 5 answers a day this way, and an answer you earned stays usable for 24 hours. It is never offered on a link we found dangerous.
  Each kind of video has its own daily limit, and in all you can watch at most 30 optional videos a day. These rewards are unlocked only by watching a video, or with Plus (the Pro actions: with Surfwise Pro), so when no video can be played they are not available at that moment. The standard safety check never needs a video: the Standard check runs every safety check, and the automatic AI review never needs one; the detailed report (Deep check) and Ask AI answers are the extras a video (or Plus) unlocks.
• The ad SDKs use your Android advertising ID. You can reset or delete it at any time in Android Settings → Privacy → Ads; deleting it stops ads from being personalised.
• User id for videos — before each optional video, Surfwise gives LevelPlay a user id. For an Ask AI video it is the id our server made for that Ask AI offer, and afterwards it goes back to the check’s id. For other videos it is our server’s id for your most recent link check, including a check started in a private tab; if you have not checked a link since the app started, it is a random id for that run of the app. Our server files the check and the offer under the same ids (section 4), so the id connects the ad network’s record of the video with that check or offer on our side. We never give the ad SDKs your install id.
• Ask AI video confirmations and revenue — after an Ask AI video, LevelPlay’s server calls our server with the offer’s id, a unique event id, the reward name and amount, a time and a signature (and sometimes a country), so that only a video that really played earns the answer. The app also sends our server each Ask AI video’s ad data from LevelPlay: the place, ad format, ad unit, ad network and its instance name, LevelPlay’s country for the view, the estimated revenue and how exact it is, the auction id, the offer’s id and the check’s id. Our server adds the revenue to that offer and to daily totals by place, country and network, so that it can switch the offer off in countries where the videos do not pay for the AI. It does not keep the ad unit, instance or auction ids.
• “Why this ad” and “Report an ad” are in Settings → Ads. A report sends us the place in the app where you saw the ad, a network field (currently always “unity”, whichever network showed the ad), the reason you picked and your note, with your install id and the id of your most recent check — not the ad’s contents.

Ad networks

Surfwise uses Unity LevelPlay, a mediation service: for each ad it asks the networks below and shows the one that answers best. The app contains the SDKs of all of them; LevelPlay starts a network’s SDK only once we have switched that network on for Surfwise. Google AdMob is one of these networks. Every ad, Google’s included, is requested through LevelPlay; Surfwise does not request ads from any network directly.

These SDKs collect the following and share it with their makers, to show ads, measure them, prevent fraud and keep the ads working. Each network’s privacy policy, linked above, has the details.

• Device and advertising IDs: your Android advertising ID, the App Set ID, and the SDKs’ own device and user IDs, including the Ad Quality SDK’s internal user id. Google’s ads SDK and its consent library also contain code that can read the Android ID.
• User IDs: Unity lists “personal identifiers”, and LevelPlay receives the user id for videos described above.
• Approximate location, which they infer from your IP address. Surfwise has no location permission.
• Device details: device model, Android version and language. Depending on the network, their code can also read the name of your mobile carrier, the battery level and the motion sensors.
• App interactions with ads: which ads were shown, tapped, watched or closed. Unity may also record how long the app is used.
• Diagnostics and crash data about the SDKs and their ads.
• Installed apps: we checked the code of every ad SDK in this version of Surfwise (LevelPlay 9.5.0 with Ad Quality 9.7.0, and each network’s SDK) for Android’s functions that list all installed apps and found none. They only ask Android about particular apps: Unity Ads whether a few app stores (such as Google Play) are installed, and Google’s ads SDK which apps can open a web link, a text message, the dialler or a calendar entry from an ad.
• Purchase history: Unity lists it among the data its ads SDK may collect. Surfwise does not report your Plus or Pro purchase to any ad network, but we cannot rule out that an SDK notices it on its own.

Unity Ads and LevelPlay can also use Android’s Privacy Sandbox (the Topics and Attribution APIs) on phones that have it; you can turn these off in Android’s ad privacy settings. We do not send the ad networks your browsing, history, bookmarks or the links you check. Apart from the user id for videos, above, we give them nothing that identifies a check.

Surfwise Plus

Where it is offered, Surfwise Plus is a monthly or yearly subscription sold through Google Play. It removes Surfwise’s own ads, including the optional videos. Checks of our partners’ short links still show their ads, marked “Sponsored”. Plus also includes Deep checks (while they are offered), Turbo downloads and theme packs without a video and, once our server confirms subscriptions with Google and while Ask AI is switched on, 100 AI answers a month.

Surfwise Pro is the higher plan, sold the same way: everything in Plus, plus the developer tools described in section 1 (Edit & resend, cURL import and export, saved requests, rules and HAR export). Its first month can come at an introductory price. Everything below about Plus applies to Pro as well.

• Payment is handled by Google Play; we never see your card, UPI or bank details. With the purchase, the app gives Google Play an account reference made from a one-way hash of your install id, so that the subscription can be matched to this install.
• Checking the subscription: the app sends our server the purchase token that Google Play issued (section 2). When confirming with Google is switched on, our server asks Google Play about that token, keeps the token, the plan, the renewal or end date and whether it renews under a one-way hash of your install id, and asks Google again about once a day. One subscription can be linked to at most three installs in 30 days, for example after a reinstall. When confirming is off, our server keeps only a hash of the token and the plan, and the app relies on what Google Play reports on your phone.
• On your phone the app keeps your plan, its renewal or end date and how many AI answers are left this month, not the purchase token (section 1).
• You can cancel at any time in Google Play; “Manage subscription” on the Plus screen opens it.

Ad consent in the EEA, the UK and Switzerland

If your phone appears to be in the European Economic Area, the United Kingdom or Switzerland — judged from its time zone and language settings, never from your location — Surfwise asks for your ad consent before the ad SDK starts, using Google’s consent tool (Google’s User Messaging Platform, a Google-certified consent management platform that works with the IAB Transparency & Consent Framework, version 2.2). To load its question the tool contacts Google, which receives your IP address and basic device and app information under Google’s privacy policy, and Google decides from its own estimate of where you are whether the question is needed. Its first screen offers Consent and Manage options; Manage options lets you choose purpose by purpose and partner by partner. Google keeps your answer on your phone, where Google’s ads SDK reads it, and does not ask again unless it needs a new answer, for example when its list of ad partners changes. Surfwise reads the same stored answer for Unity Ads and ironSource Ads: they may personalise ads only if you consented to storing and accessing information on your device, to creating a personalised ads profile and to using it to select ads (TCF purposes 1, 3 and 4); otherwise they are told not to. The app works the same whichever you choose; if you say no, you still see ads, but they are not personalised.

If Google’s tool cannot answer — for example when the phone is offline, or Google says the question is not needed where you are — Surfwise asks its own question once instead: whether the ad networks may use your advertising ID to personalise ads. Its first screen offers Accept and Manage options; Manage options lets you choose Allow or Don’t allow. It cannot be closed without an answer, so it is asked only once. On those phones you can change or withdraw your answer at any time in Settings → Privacy → Privacy choices: it opens Google’s privacy options if you answered Google’s question, and Surfwise’s own question otherwise; a change fully applies the next time Surfwise starts. Phones outside these countries are not asked, make no call to Google’s consent tool and do not show this row.

United States: Do Not Sell or Share My Personal Information

We never sell your data for money. Some US state privacy laws, such as California’s, can treat passing your advertising ID to ad networks for personalised ads as “selling” or “sharing” personal information. If your phone appears to be in the United States — judged from its language region and time zone, never from your location — Settings → Privacy shows Do not sell or share my personal information (off by default). Turn it on and Surfwise tells the ad networks, through LevelPlay, not to sell or share your data; it takes full effect the next time Surfwise starts, and you can turn it off again at any time. On any phone you can also delete your advertising ID in Android Settings → Privacy → Ads, so the ad networks can no longer personalise ads for it, or email support@anvillabs.app with the subject “Do not sell or share” and we will help.

7. Android permissions

The libraries in the app also declare a few permissions that need no prompt: access to Google Play’s install referrer and billing services, and Android’s basic phone-state permission (for example the mobile network type), from Google’s ads SDK. Surfwise asks for no contacts, no location, no microphone and no access to your photos or files outside its own download folder; a picture you pick for the QR scanner comes through Android’s photo picker. The optional copy to your phone’s Downloads folder (section 1) adds files there through Android’s own Downloads collection, which needs no permission, and never reads the folder.

The newer features — the Password & OTP shield, Page X-ray, scam evidence PDFs, the download check, the list of what a downloaded app can access, per-site settings, user scripts, the default-browser choice, Ask AI and Surfwise Plus — need no permission that asks you. The app-access list only opens files in Surfwise’s own download folder, and Surfwise has no permission to install apps.

8. Deleting your data

• On our server: Settings → Privacy → Clear my data on the server immediately deletes every record we keep under your install id or its one-way hash: scan sessions, the checks’ working records, the statistics rows of those checks, ad reports, the genuine-app check result, the day counters (Deep checks, download checks, file inspections, AI reviews, Ask AI requests, ad-data reports and Plus checks), your Ask AI offers, credits (including any you have not used yet) and questions, the video confirmations, and your Surfwise Plus record and its links to this install.
• If you have Plus, your Google Play subscription is not affected. Open the Plus screen and tap Restore purchases to link it to this install again.
• What it cannot reach are records that are not filed under your install id. They expire on their own (section 4): the 24-hour redirect cache (full redirect-chain addresses, page title and headers, and the page analysis, filed under the checked link), the domain and threat-list lookups (up to 24 hours), the home page summaries (7 days), the file inspections (24 hours) and AI answers (up to 7 days), filed under the address, the file fingerprint answers (up to 7 days, filed under a key that does not contain the fingerprint), the Surfwise intel list and its review copies, which are about sites and not about who checked them, the 24-hour IP abuse counter, statistics rows older than 7 days (they no longer link to your install and are deleted at 30 days), and our web host’s access logs.
• Your install id stays the same after clearing; the app keeps using it. Clearing the app’s data or reinstalling it creates a new one.
• On your phone: uninstall the app, or clear its data in Android settings. History, bookmarks, downloads and settings go with it.
• Everything else in section 4 is also removed on that schedule whether or not you ask, except the daily totals, which are counts only. The clean-up runs while our server is in use, so a record can last a little past its time.

9. The website and the Open in Surfwise page

This policy also covers the pages on surfwisebrowser.com and go.surfwisebrowser.com. They have no accounts and no ads.

• The website does not check links. Since 7 October 2026 the page at /check/ is an “Open in Surfwise” page: you paste a link, and its Open in Surfwise button hands the link to the Surfwise app on your phone, which then checks it as described in section 2. Our server does not check, store or count a link pasted there. (Before that date the page checked links on our server; those checks were kept for 15 minutes and have expired.)
• When you paste a link into the box on /check/ itself, the page shows it back to you in your browser and the link is not sent to our server. When you use the box on our home page or how-it-works page, or the page without JavaScript, the link travels in the page’s address (after ?url=), so it appears in your browser history and in our web host’s access logs; our server only shows it back to you.
• The page’s Google Play button carries a fixed note that you came from this page (utm_source=surfwisebrowser.com, utm_medium=open_page), never the link you pasted. On a phone without the app, the Open button takes you to Google Play.
• How-to video. The page can show a short video on using Surfwise. If it is hosted on YouTube, nothing is loaded from YouTube until you tap the video; then it plays from youtube-nocookie.com (YouTube’s privacy-enhanced mode), and Google receives your IP address and browser details and may store cookies or similar data in your browser while it plays, under Google’s privacy policy. A video hosted on our own site loads only when you press play and sends nothing to anyone else.
• A partner short link opened on a phone without the app may pass through surfwisebrowser.com/scan/web.php, which stores nothing and sends you on to our partner’s web link checker (section 5). For our public demo link it shows the same Open in Surfwise page instead, with the demo’s sealed token in the Open button.
• Data-source credits for the lists our server’s checks use: Majestic Million (CC BY 3.0), the Public Suffix List (MPL-2.0) and Unicode’s confusables (Unicode License v3).
• The pages load their fonts from Google Fonts, so Google receives your IP address and browser details when you open them, under Google’s privacy policy. The app does not use Google Fonts.

10. Surfwise on iPhone and iPad

The iPhone and iPad app works like the Android app, and everything above applies to it, except for what this section says. Where the sections above name an Android feature (Android settings, the Android advertising ID, Google Play, Play Integrity, ML Kit), the iPhone and iPad app uses the Apple counterpart described here. The download check, the ad and pop-up blocker and the developer tools of Surfwise Pro are not in the iPhone and iPad app.

• Apple’s tracking question (App Tracking Transparency). Once, during the first-run steps (after the ad consent question in the EEA, the UK and Switzerland), Surfwise shows Apple’s own question whether it may track you across apps and websites owned by other companies. Only if you choose Allow can the ad networks in section 6 use your device’s advertising identifier (IDFA) to personalise ads and measure them. If you choose Ask App Not to Track, they do not get the IDFA, you still see ads, and Surfwise works the same. You can change your answer at any time in Settings → Privacy & Security → Tracking on your iPhone or iPad. The ad networks still receive your IP address and basic device information, as section 6 describes.
• Apple App Attest instead of Play Integrity. To show our server that a request really comes from the Surfwise app on a genuine Apple device, the app asks Apple’s App Attest service on your device for a key made for this install, and Apple certifies that key. The app sends our server the key’s identifier and Apple’s certificate for it once (after the first check that needs it, and again after a reinstall), and from then on a short signed statement with each check and with Ask AI, report and Plus requests, made over the same values a Play Integrity token covers (what is checked, your install id and a random one-time number). Our server keeps, under your install id: the key’s identifier, its public key, a counter and when it was made, until the key is replaced (an old key is kept 30 days after that) or you clear your data on the server; and a 24-hour “passed” mark, as for Play Integrity (section 4). The statements identify the app and the device’s key, not you. If App Attest is not available on your device, checks still run, without it.
• QR codes. On iPhone and iPad the QR scanner uses Apple’s Vision framework, on the device; on Android it uses Google’s ML Kit, also on the device. In both cases the camera image or the picture you pick is decoded on your phone and is never uploaded or saved; only a link you then choose to check reaches our server (section 2).
• Surfwise Plus through the App Store. On iPhone and iPad, Plus is a monthly or yearly subscription sold through Apple’s App Store; Apple handles the payment and we never see your payment details. With the purchase the app gives Apple an account reference (appAccountToken) made from a one-way hash of your install id, so the subscription can be matched to this install. The app sends our server the signed transaction that Apple issued for the purchase (it names the product, the purchase and expiry dates, Apple’s transaction ids, that account reference and whether it was bought in Apple’s test environment), a random one-time number and an App Attest statement, when you buy or restore and each time the app starts while you subscribe. Our server checks Apple’s signature itself, without contacting Apple, and keeps the plan, the expiry date and a one-way hash of the original transaction id under a one-way hash of your install id (it does not keep the signed transaction). One subscription can be linked to at most three installs in 30 days. Surfwise Pro is not sold on iPhone and iPad. You cancel in Settings → your name → Subscriptions; “Manage subscription” on the Plus screen opens it.
• AI review only with your consent. The AI provider is Anthropic, the maker of Claude. Before the first automatic AI review or Ask AI, the iPhone and iPad app asks, on a sheet that says what is sent, to whom and why: Allow or Not now. Only those two answers are kept: if the sheet closes without one (you swipe it away, or a link you open closes it), nothing is stored, that check runs without AI, and the sheet asks again next time. With Not now no AI runs for your checks: the app tells our server with each check that you have not agreed, our server then never sends that check’s page to Anthropic, and Ask AI opens the same sheet instead of an offer. You can change it at any time in Settings → Link checker → AI review (Anthropic); turning it on is your consent. What is sent when you allow it is the same as in section 2: it comes from our server’s own fetch of the checked page, not from your device — the page’s title, its visible text and the names of its form fields (never what anyone typed), for a download the file summary, and for Ask AI also the names of the site and of the sites its links, forms and redirects point to. Never your install id, IP address, cookies or anything you typed. Anthropic may not use it to train its models and deletes it within 30 days, as section 2 describes. The result of a check never depends on whether AI is on.
• Permissions on iPhone and iPad. iOS asks you before any of these is used. Camera: the QR scanner, and when a website you visit asks you to take a photo or video to upload (iOS’s own picker on the site’s upload button). Microphone: only when a website you visit asks you to record a video or audio to upload, and you choose to record; Surfwise never gives websites live camera or microphone access. Photos: picking a picture of a QR code (decoded on your phone, as above), and adding an image from a web page to your photo library when you save it; Surfwise does not read your photo library. Whatever you upload goes to that website, under its own privacy policy, not to us. Face ID or Touch ID: only to unlock your private tabs, when you turn on that lock; iOS checks it and the app only learns yes or no. Surfwise asks for no location and no contacts.
• Saving files. On iPhone and iPad, scam evidence PDFs and downloads you save go where you choose in Apple’s Save to Files sheet; there is no shared Downloads folder, and the optional copy to the phone’s Downloads folder (section 1) is Android-only. Downloads stay in Surfwise’s own folder, which the Files app shows, until you delete them.
• Opening links in Surfwise. A link to go.surfwisebrowser.com can open the app directly (Apple’s Universal Links). For that, Apple’s servers download a small public file from that address that names our app; it contains nothing about you.

11. Children

Surfwise is intended for adults (18 and over) and is not directed at children. It does not ask anyone’s age and has no accounts, names or contact details. We do not knowingly collect personal information from children. If you believe a child has used Surfwise, Clear my data on the server on that phone removes what our server holds under that install’s id.

12. Your rights

Depending on where you live, you may have the right to ask what personal data we hold about you, to have it corrected, or to have it deleted. Because we hold no account and no contact details, the only handle we have is the install id, which the app does not display — so the reliable route is the in-app Clear my data on the server button, which needs no request and no waiting. You can also email support@anvillabs.app with any question about your data.

13. Changes to this policy

If this policy changes materially, the date at the top changes and the new version is published here before the change takes effect in the app.

• 9 October 2026 (iPhone and iPad permissions): section 10 now lists what the iPhone and iPad app asks iOS for (the camera and microphone also for a website’s own upload, adding a saved image to your photo library, Face ID or Touch ID), where saved files go (Save to Files), and that the AI question keeps only an Allow or Not now answer.
• 9 October 2026 (Ask AI): section 2 now says exactly what Ask AI sends to Anthropic: more of the page, the site’s name and the host names its redirects, links and forms point to (never a page’s full address), only when you ask; for partner short links no site name or address at all. The automatic review is unchanged.
• 9 October 2026 (iPhone and iPad): added Surfwise for iPhone and iPad: Apple’s tracking question and the advertising identifier (IDFA), Apple App Attest in place of Play Integrity and what our server keeps from it, QR codes read with Apple’s Vision framework on the device, Surfwise Plus through the App Store (the signed transaction, the hashed original transaction id and the account reference), Anthropic named as the AI provider with the iPhone and iPad consent question before any AI review, and Universal Links (new section 10; sections 10 to 13 are now 11 to 14).
• 8 October 2026 (consent): in the EEA, the UK and Switzerland the ad consent question now comes from Google’s consent tool (IAB TCF v2.2), whose stored answer also decides whether Unity Ads and ironSource Ads may personalise ads; Surfwise’s own question remains as the fallback, and Privacy choices opens Google’s privacy options when you answered Google’s question (sections 5 and 6).
• 8 October 2026 (later): said that a link check you start from a private tab shows the check’s ads like any other check; described how Surfwise offers to check a copied link without reading the clipboard; described Surfwise Pro next to Plus (sections 1, 5 and 6).
• 8 October 2026: described the optional Save to phone’s Downloads setting, the “Check with Surfwise” action in other apps’ text selection, and the report Android’s WebView may send Google when Surfwise blocks a page that Safe Browsing flags (sections 1, 2, 3 and 7).
• 7 October 2026: removed ad partners we no longer use: none of them is switched on for Surfwise, their SDKs are left out of the app from the next update, and Surfwise works only with Unity Ads, ironSource Ads and Google AdMob, through Unity LevelPlay; updated what the remaining ad SDKs can read and the permissions they declare (sections 5, 6 and 7).
• 7 October 2026: the website’s /check/ page no longer checks links on the website: it hands a pasted link to the Surfwise app, and our server keeps nothing from it; added its optional how-to video (YouTube, loaded only when you tap it); added optional videos that unlock 3 Surfwise Pro actions, the “No waiting on link checks” video and the new limits for optional videos (at most 30 a day in all); the EEA/UK/Swiss ad consent question is now asked once and cannot be skipped, Privacy choices appears only on phones in those countries, and the Do not sell or share switch only on phones that appear to be in the US; all ads, Google’s included, come through LevelPlay (sections 1, 2, 4, 6 and 9).
• 28 September 2026: added Surfwise as a default browser (links from other apps load as pages and are not sent); the country code and language sent with checks; our server’s page analysis and its reading of files that a checked link downloads; the AI review by Anthropic and the Ask AI videos, with their confirmations and ad revenue reports; Surfwise Plus through Google Play; the Surfwise intel list; seven more ad networks, Google AdMob among them (the other six were removed on 7 October); the Majestic Million credit; and abuse.ch URLhaus, now switched off (sections 1 to 9).
• 27 September 2026: added the page tools that work on your phone and send nothing to us (the Password & OTP shield, Page X-ray, scam evidence PDFs, the list of what a downloaded app can access, per-site settings and user scripts), and described the download check, which is switched off for now (sections 1, 2, 4, 5 and 7).

14. Contact

Anvil Digital Labs — support@anvillabs.app