Privacy Policy

Depending on how You interact with Surge Networks, we collect the following information:

• License and purchase information: license email address, License Key, product type, Seat count, receipt ID, purchase date, Update Entitlement and trial status, renewal status, refund requests, and payment status. For App Store purchases we receive transaction identifiers and receipts from Apple. Payment card details are handled by Stripe or Apple and are not stored by Surge Networks.
• iCloud binding information: if You bind a Surge for iOS license to iCloud, a random identifier that the app creates and stores in Your iCloud key-value storage. It is not derived from Your Apple Account, and we do not receive Your Apple Account email address or password.
• Device and activation information: a device identifier generated by Surge, the device name (which may contain Your name, as in "Alex's iPhone"), device model, operating system and version, app version and build, language, whether the device appears to be jailbroken, a public key the app uses to sign license requests, activation and deactivation history, IP address, and the last time the device contacted our license service.
• Crash reports: stack traces, error messages, device model, operating system, memory and app state, app version, the pseudonymous Surge device identifier, and a short trail of recent app events (such as menu actions, mode switches, file paths, and error messages) that led to the failure. Crash reports are on by default and processed by Bugsnag. You can turn them off in the Privacy settings of Surge for iOS or the License settings of Surge for Mac.
• Usage statistics (Surge for iOS): the number of proxies, policy groups, rules, scripts, WireGuard sections, rewrite and local mapping rules, hosts, panels, subnet settings, modules, external resources, widgets, Ponte devices, and DDNS entries; whether HTTPS decryption and a managed profile are in use; which feature categories the profile requires; interface preferences; language; the Feature Subscription expiration date; whether the license and app are enterprise editions; and whether the app came from the App Store or TestFlight. Mixpanel adds basic device information such as device model, operating system version, and app version, and assigns a device identifier of its own. These statistics are sent periodically for activated, non-trial licenses, are on by default, are not linked to Your license or email address, and are processed by Mixpanel, which is configured not to use Your IP address to determine Your location. You can turn them off with "Share Analytics Data" in the Privacy settings of Surge for iOS. Surge for Mac does not currently send usage statistics.
• Diagnostic uploads: only when You choose to upload them, a package that can contain verbose logs (which include hostnames, IP addresses, URLs, ports, and names of the processes that made connections), a copy of Your profile with passwords and keys removed (some fields, such as server addresses, are kept), diagnostic reports about the current session, and, on Mac, gateway mode DHCP logs that include the hardware addresses and hostnames of other devices on Your local network. We give You an ID for each upload so that You can refer to it in support conversations.
• Support and communication information: messages You send to us, support tickets, email address, information You provide, and records of our responses.
• Website and service logs: browser type, operating system, referring and exit pages, requested URL, IP address, timestamps, and similar log information.
• Beta program information: beta enrollment details, TestFlight identifiers provided by Apple, feedback, and crash reports from beta builds.

We use personal information for the following purposes. Where the GDPR or similar laws apply, the legal basis for each purpose is shown after it.

• To provide, activate, validate, update, maintain, and secure the Software and License Keys, and to provide license management, activation reset, iCloud binding, beta, and support features. (Performance of a contract.)
• To process purchases, renewals, refunds, chargebacks, taxes, and receipts. (Performance of a contract; legal obligation.)
• To diagnose crashes and reported problems, improve performance and reliability, and maintain compatibility. (Legitimate interests in keeping the Software working; for diagnostic uploads, also Your request.)
• To understand which features and configurations are used, so that we can decide what to develop, maintain, or retire. (Legitimate interests in improving the Software. You can turn usage statistics off at any time.)
• To send service, security, license, renewal, update, and policy notices. (Performance of a contract; legitimate interests; legal obligation.)
• To send newsletters or marketing communications, only where permitted by law. (Consent where required; otherwise legitimate interests. You can unsubscribe at any time.)
• To detect, prevent, investigate, and respond to piracy, cracking, license sharing, payment fraud, refund abuse, security incidents, violations of our Terms and End User License Agreement, and other unlawful or harmful activity. (Legitimate interests in protecting our business, customers, and services.)
• To comply with legal obligations and to establish, exercise, or defend legal claims. (Legal obligation; legitimate interests.)

If we reasonably believe that a License Key, account, purchase, Device, or request is associated with cracking, piracy, license sharing, chargeback fraud, refund abuse, security risk, or violation of our Terms, we may preserve and use relevant license, activation, purchase, device, network, communication, and diagnostic information to investigate, prevent harm, enforce our Terms, respond to disputes, block or revoke licenses, deny refunds, cooperate with payment providers or platforms, and establish, exercise, or defend legal claims.

Our license service uses automated checks, such as activation counts and activation patterns, to limit resets or flag suspicious activity.

Our website uses only cookies and local storage that are needed for it to work and stay secure, such as the security cookies set by Cloudflare, which delivers the website. Stripe sets cookies on checkout pages to process payments and prevent fraud. We do not currently use advertising cookies or third-party analytics on our website. Our emails may contain click-through links used to deliver the service You requested. You can control cookies through browser settings, but some features may not work correctly if cookies are disabled.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only as described in this Privacy Policy or as otherwise permitted by law. We use the following service providers, which process personal information on our behalf:

• Stripe for payments made on our website, including Alipay, and for subscription management.
• Apple for App Store purchases, TestFlight beta testing, and iCloud. When You use Apple's services, Apple's own privacy policy also applies.
• Bugsnag (SmartBear Software) for crash reports.
• Mixpanel for usage statistics from Surge for iOS.
• Cloudflare for website delivery, network security, and storage of diagnostic uploads.
• Providers that host our servers and databases, send email, and run our support tools.

We may also disclose personal information:

• to payment providers, app stores, banks, and tax or accounting providers as needed for purchases, refunds, chargebacks, tax compliance, and fraud prevention;
• to law enforcement, courts, regulators, government authorities, or other parties when required by law or reasonably necessary to protect rights, safety, security, and legal interests;
• to successors or affiliates in connection with a merger, acquisition, reorganization, financing, sale of assets, or similar transaction.

Service providers are required to process personal information only as necessary to provide services to us and to protect that information with appropriate safeguards.

Surge connects to third-party services because You, or a profile, module, or script You installed, tell it to. These include proxy servers and proxy subscriptions, remote rule sets, modules, scripts and other external resources, Tailscale coordination and relay servers, WireGuard peers, DNS servers, and the connectivity and speed test endpoints used to measure network quality. These services receive Your IP address and the requests that Surge sends to them, and a proxy server can see the traffic You route through it.

Surge Networks does not operate, control, or receive data from these services, and their own privacy practices apply. Choose providers You trust.

Surge Networks is based in the United States, and personal information may be processed in the United States and other countries where we or our service providers operate. Where required, we use appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses or other lawful transfer mechanisms.

We keep personal information only as long as needed for the purposes in this Privacy Policy:

• License, purchase, and refund records: for as long as the license exists, and afterwards for as long as tax, accounting, and other laws require or as needed to resolve disputes and prevent abuse.
• Device records: while the device is activated. Deactivating a device deletes its device record. The license history keeps a note of activations and deactivations, which may include the device name, so that we can manage activation limits and prevent abuse.
• Diagnostic uploads: only as long as needed to investigate the problem they were uploaded for and any follow-up on it, after which they are deleted. You can ask us to delete an upload earlier by sending its ID to privacy@nssurge.com.
• Crash reports: for the retention period configured in our Bugsnag account, after which Bugsnag deletes them.
• Usage statistics: for the retention period configured in our Mixpanel account, after which Mixpanel deletes them.
• Support communications: for as long as needed to handle Your request and keep a record of our support history with You.
• Website and service logs: for a limited period for security and troubleshooting, unless needed longer to investigate an incident.

Information connected to a suspected violation, dispute, or legal claim may be kept until the matter is resolved.

We use administrative, technical, and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for protecting Your Devices, Your license email account, and any credentials You set in the Software, such as HTTP API and remote control passwords and HTTPS decryption keys.

• Crash reports: turn them off in the Privacy settings of Surge for iOS or the License settings of Surge for Mac.
• Usage statistics: turn off "Share Analytics Data" in the Privacy settings of Surge for iOS.
• Diagnostic uploads: are never sent unless You start an upload. You can ask us to delete an upload at any time.
• Marketing email: use the unsubscribe link in any marketing email.
• Device records: deactivate devices You no longer use in the app or, for devices that have been inactive, from the License page on our website.

Depending on where You live, You may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information, withdraw consent where processing is based on consent, and lodge a complaint with a data protection authority. Residents of some U.S. states have similar rights to know, correct, and delete personal information, and we will not discriminate against You for exercising them. To make a request, contact privacy@nssurge.com. We may need to verify Your identity, usually by confirming control of Your license email address, and we may decline or limit requests where permitted by law, including where information must be retained for security, fraud prevention, legal compliance, dispute resolution, or protection of the rights of others.

Our Software and services are not directed to children. We do not knowingly collect personal information from children under 16, or the equivalent minimum age in the relevant jurisdiction, without legally valid consent. If You believe a child has provided personal information to us, contact privacy@nssurge.com.

Our websites, Software, and services may link to third-party websites, app stores, payment providers, community forums, documentation hosts, support portals, or other services. We are not responsible for the privacy practices of third parties that we do not control.

We may update this Privacy Policy from time to time. When we make changes, we will post the updated policy on this page and update the "Last updated" date. If changes are material, we may provide additional notice through the website, the Software, email, or another reasonable method.

Surge Networks Inc. is the controller of the personal information described in this Privacy Policy.

Surge Networks Inc.
2035 Sunset Lake Road, Suite B-2
Newark, Delaware 19702
United States

Privacy questions and requests: privacy@nssurge.com