Privacy Policy

Updated October 23, 2026

What stays on your phone

These are kept only on your device and never sent to us. Deleting the app deletes them (like any app's data, they're in your own device backups).

• Your channels, settings, saved sites (the Stash), followed sites and blocked sites.
• Sites you've seen or that were skipped, so they don't keep coming back: kept as scrambled fingerprints, not addresses, and forgotten after 30 days.
• Topics you seem to like, picked out on your phone from pages you saved, followed or spent a while on. Never the pages' addresses. You can see them, forget them or turn this off in Settings › Your Interests.
• Recent search results, deleted within a week.

Websites open in private browsing: cookies and website data last only while the app is open, and there's no browsing history.

What the app sends, and to whom

Like any internet request, each one carries your IP address and basic device information. None of these services receive anything that identifies you to us, and each has its own privacy policy.

Netsurfer's own index

A channel's search words go first to Netsurfer's own index (index.netsurfer.app, on our server in Canada), with your filter settings: the era, the languages you read, the Family filter and the skips you've turned on. Shuffle asks it for random sites with the same settings and no search words. The index keeps no logs of what's searched or who asked. Your IP address is used only to limit how many requests one device can make: it's held in memory for a minute and never stored.

Help Find Missing Topics (only if you allow it)

Off until you say yes: the app asks once, and you can change it any time in Settings. When it's on, a search you chose that finds fewer than 10 sites may be counted.

• Searches with a number, an @ sign, a web address or more than five words are never counted, since they can be about a person.
• A topic is kept only if several different people searched it on the same day, and then only the topic, how many people searched it and the date. Never who searched, their IP address or anything else they searched.
• Each day's list is deleted after 90 days.

We use it only to choose new sites for the index, by hand. It isn't shared or sold.

Other search services

When the index runs low, search words also go to some of these: Wiby, ooh.directory, mastodon.social, Neocities, Hacker News search (run by Algolia), Wikipedia and Mwmbl. Related topics come from Apple Intelligence on your phone when it's available, otherwise from Wikipedia.

Random sites also come from Wiby, Neocities, indieblog.page, Kagi's Small Web, the 512KB Club (via GitHub) and the IndieWeb webring, with no search words.

Websites you visit

Each site you see, and the next couple that load early, receives what any browser visit sends. Netsurfer blocks many ads, trackers and cookie pop-ups, but each site follows its own policy. Following a site downloads its feed from that site; unless you turn off notifications for new posts, your iPhone also checks those feeds now and then in the background. Notifications are made on your iPhone, with no notification server. In Old mode, the addresses of dead sites go to the Internet Archive's Wayback Machine for its saved copy.

Safety checks

Before a site loads, its domain name (not the full address) is checked with Cloudflare's 1.1.1.1 DNS service to block known malicious sites and, with the Family filter on, adult ones. Apple's fraudulent website warning, the same one Safari uses, is on (Apple's privacy policy).

“About This Site”

Only when you open this panel, the site's domain name is looked up with rdap.org, the Wayback Machine, Cloudflare's DNS and ipinfo.io.

Done on your phone

Rabbit Holes, topic cards, Summarize Page, reader view, language detection and the Family filter's text check all run on your phone, and the page isn't sent anywhere. A topic becomes search words only when you choose it, or when a channel that has run out of results drifts toward topics you seem to like.

Information Apple may share with us

If you share analytics with app developers in your device's settings, Apple may send us anonymous crash reports and usage statistics. You can turn this off in Settings › Privacy & Security › Analytics & Improvements.

When you email us

We receive your email address and what you write, use it only to answer you, never share it, and delete it when it's no longer needed. Report a Problem writes that email for you, with the page, the channel, what the app noticed about the site, and your app version, system version and device model. Nothing is sent until you send it, and you can change anything first.

Test versions

TestFlight versions keep a Diagnostics log of what the app did, in memory only. It leaves your phone only if you share it, for example attached to a Report a Problem email. The App Store version doesn't have it.

Children

Netsurfer is rated 16+ and isn't directed at children. We don't knowingly collect information from anyone, children included.

Your rights

We hold no personal information about you, so there's nothing for us to access, correct, export or delete. Help Find Missing Topics counts aren't linked to anyone; turning the setting off stops your searches from being counted. Everything else is on your phone, under your control. For data held by the services above, contact them directly.

Changes

If this policy changes, the new version will be posted here with a new date. If a change ever means sending more information from your phone, we'll say so in the app's release notes.

Contact