Privacy policy.

What Surface collects

Surface stores the domain you scan, the resulting report (a public record it read), a timestamp, and the report’s permalink id. It keeps only the most recent report per domain — not a history — so a report is replaced when its domain is scanned again.

Each scan also reads the first part of the domain’s homepage, reusing the request Surface already makes for headers, to see whether the Surface badge is on it. Only the yes or no is stored with the report; nothing else from the page is kept. Badge images are served without cookies and without logging who views them.

When a scan finds the badge, Surface rescans that domain automatically about once a week, so the report and grade stay current. The same data is stored as for any scan, and a rescan that no longer finds the badge stops the schedule.

What Surface does not collect

Surface requires no account, no email, and no name. It does not store your identity or associate a scan with you personally beyond the technical records below.

Abuse prevention

To keep the service from being abused, we process a small amount of technical data: your IP address, used only to enforce rate limits and stop automated abuse, and a Cloudflare Turnstile token that is verified on the server and discarded.

The anti-bot widget is provided by Cloudflare. It may set a cookie and process a minimal amount of data to decide whether a visitor is human. Use of the widget is subject to the Cloudflare Turnstile Privacy Policy & Addendum. Cloudflare’s privacy practices are described in the Cloudflare Privacy Policy.

Analytics

Surface uses Vercel Analytics to understand aggregate traffic (page views, referrers, geography). This is anonymised and used only to improve the service. It does not profile individual visitors.

Cookies

Surface itself sets no cookies. The Cloudflare Turnstile widget may set cookies as described above. Your browser’s controls for cookies and third-party scripts remain fully available to you.

Data sharing

We do not sell your data. We share only what is necessary to operate the service: Cloudflare (bot protection and DNS) and Vercel (hosting and analytics), each under their own privacy policies. To report whether a domain is on the browser HSTS preload list, Surface also sends the scanned domain name to hstspreload.org, the list’s public status service. Reports you generate are public by design — a domain’s report is reachable by its permalink to anyone who has it. Report pages are marked noindex so search engines are asked not to list them.

Your rights

If you control a domain and want its stored report deleted, ask through the contact form below and we will remove it. The next scan of that domain creates a new report.

Because Surface stores only a public report and technical anti-abuse data, there is little personal data to request. If you believe a report contains inaccurate information about you, or have any other privacy question, contact the operator through the contact form.