Surf PDFPrivacy policy
Surf PDF Privacy Policy
Applies to version 1.0 build 10 and later using the server ledger, from the date those builds become available. The policy for earlier builds is available in the archive.
TIFON processes only information needed to provide the service. Representative and privacy officer: Seongoh Jeong. Contact and privacy requests: [email protected] / +82-10-4790-4920.
1. Documents and sign-in
PDFs, images, document names, OCR results, search terms and projects are processed on your device and in file storage you choose. Document content and OCR or search text are not sent to the credit server. Editing and OCR work without sign-in. Exports, purchases, ad rewards and balance recovery require Sign in with Apple and a server connection. We do not request permission to receive your name or email during sign-in.
2. Information needed to provide the service
We use the Apple sign-in identifier, a pseudonymous account number derived from it, Firebase authentication identifiers and tokens, app integrity information and random purchase-linking identifiers for authentication, account linking and fraud prevention. Firebase Authentication processes the Apple identifier; the transaction ledger uses a pseudonymous account number. Pseudonymous identifiers may still constitute personal information.
We process credit balances, Apple app download identifiers, transaction and original transaction IDs, product IDs, purchase/refund/subscription status and times, credit additions and deductions, export operation IDs/page counts/status/times, daily free allowances, and ad reward session/transaction IDs and processing status to validate payments, prevent duplicate grants, restore balances across devices and resolve disputes. TIFON does not directly receive payment card or bank account details.
IP addresses, request times, app verification results and errors may be processed by Google infrastructure for connection and security purposes. We do not use or sell document content for advertising or marketing. We do not include Firebase Analytics or Crashlytics SDKs for behavioral analytics.
3. Storage, processors and international processing
TIFON uses Google Firebase Authentication, App Check, Cloud Functions and Firestore to process and store the information above. Transaction Firestore and functions are deployed in Seoul, Korea (asia-northeast3). Authentication, app verification and operational services are not restricted entirely to Korea; processing may occur on Google’s global infrastructure, including the United States. Processor: Google LLC; contact: https://firebase.google.com/support/privacy. The information in section 2 is transmitted over encrypted connections during authentication, transaction and app verification requests for authentication, the ledger, recovery and security. Retention follows section 4 and Google’s applicable contracts and policies.
Apple handles sign-in, payments, subscriptions and refunds under its own policies. Google Mobile Ads and User Messaging Platform handle ads and privacy choices. Gmail processes support emails you send. Firebase Hosting processes ordinary web request information such as IP addresses, times and browsers. Google services may process data on global infrastructure, including the United States.
Contact support for questions, objections or deletion requests concerning these transfers and processing. Declining processing needed for the transaction server may prevent sign-in, purchases, ad rewards, exports and server recovery; local editing and OCR remain available. Ads are optional.
Firebase privacy: https://firebase.google.com/support/privacy
Google privacy: https://policies.google.com/privacy
Apple privacy: https://www.apple.com/legal/privacy/
The website uses Firebase Hosting’s IP-based country routing to show Korean in Korea and English elsewhere. We do not add a separate location database, request precise device location or use an external geolocation service for this purpose.
4. Retention, deletion and account deletion
Account-linking information and the remaining credit ledger are retained while needed to provide the service and recover unused balances. You may request deletion of your sign-in profile through the app, or request access, correction, deletion or restriction by email. Deleting an account does not cancel Apple subscriptions.
Applicable law requires retention of contract, payment and supply records for five years and consumer complaint/dispute records for three years. Transaction records needed for legal obligations, unused credits or unresolved disputes are retained separately from the sign-in profile with restricted access. Information is deleted when the applicable purpose and retention period end. The operator reviews deletion scope during periodic checks and rights requests. We do not retain all activity indefinitely for analytics.
Transaction data is configured with seven-day point-in-time recovery and daily backups retained for fourteen days. Deletion from active storage does not immediately remove data from backups; backups are replaced after their retention period. External service logs and backups follow their providers’ retention policies.
5. Ads and choices
Rewarded ads are optional and disabled during an unlimited subscription. Depending on settings and consent, Google’s ad SDK may process approximate IP-based location, device/advertising identifiers, ad impressions/interactions, and performance/error information for ad delivery, measurement, fraud prevention and diagnostics. TIFON does not combine advertising identifiers with document content. UMP privacy choices are provided where required and can be changed in the app’s ad privacy menu. The server verifies Google-signed completion information and records reward IDs, sessions, account links and credit processing status.
Google SDK disclosure: https://developers.google.com/admob/ios/privacy/data-disclosure
6. Support requests and diagnostic logs
We use your email address, message and files you attach to provide support, investigate errors and resolve disputes. In-app support transfers diagnostic logs to the operator only when you actually send the email. Logs may contain app/device/OS/language/display information, operation times/types/page counts/durations/status, operation/transaction/product IDs and error codes. We do not intentionally record document names or content, OCR/search text, passwords, authentication tokens or advertising IDs. Device logs rotate in files of approximately 2 MB. Ordinary support emails are deleted one year after resolution; records subject to legal dispute retention are kept separately for the required period. Support emails are not used for advertising.
7. Rights and safeguards
You may exercise applicable rights to access, correction, deletion and restriction after proportionate identity verification. We explain limitations required by legal retention duties or others’ rights. You manage documents and projects in the file storage you choose. Modifying the app’s displayed balance or deleting the app does not change the server ledger.
Direct app access to read or write the server ledger is blocked. Authentication, app verification, transaction signature verification and least privilege are applied. Administrator and backup access are restricted to what is needed. We cannot guarantee that all breaches or errors are impossible. Changes to processing scope are announced in the app and on the website with the applicable build, effective date and material changes.