What we know about you. (Nothing.)
Effective May 4, 2026
Urge Surfer ("the app") helps you ride out cravings instead of acting on them. This policy explains exactly what data the app handles, where it lives, and what it never does.
Short version
- Everything stays on your device. The app has no backend, no account system, no analytics, no crash reporting, no advertising SDKs.
- No data is collected by us, sold, shared, or transmitted off your device.
- You can delete all of it anytime by uninstalling the app.
Who runs this
Urge Surfer is an open-source project maintained by Abhay Katheria.
- Source code: https://github.com/abhaykatheria/urgesurfer
- Contact: abhay.katheria1998@gmail.com
What the app stores on your device
When you use Urge Surfer, the following information is saved locally on your phone (in iOS's standard AsyncStorage):
| What | Why it's stored |
|---|---|
| The name you enter during onboarding | Shown on the home screen as a greeting |
| The list of urges you choose to track (preset or custom) | Drives the urge picker, stats, and history |
| Log entries — for each surf attempt: date, time, urge, duration, outcome (rode / caved), trigger, intensity | Powers your stats, history, and streak |
| Counts of attempts, successful rides, and the date of your last cave per urge | Used to compute streaks and success rates |
| Photos taken during the "victory selfie" flow (URIs, plus metadata: which urge, streak at the time, duration, intensity) | Shown in the in-app Album |
| Theme preference (light/dark) | Remembered across sessions |
This data lives in your device's app sandbox under the storage key @urge-surfer/state-v2. Photos taken in-app are stored at the URI returned by iOS's image picker, also inside the app's sandbox.
No part of this data is uploaded to a server. There is no server.
What the app does NOT do
- It does not include any analytics, telemetry, crash reporting, or A/B testing SDKs.
- It does not track you across apps or websites.
- It does not access your contacts, location, microphone, calendars, health data, or files outside its own sandbox.
- It does not have ads.
Permissions the app requests
The app asks for two iOS permissions, and only when you explicitly trigger the flow that needs them:
- Camera — only when you tap "Victory selfie" after riding out an urge. Used to capture the photo. The photo stays on your device.
- Photo library — used by the system camera flow to save the captured photo into the app's sandbox. The app does not browse your existing photo library.
You can revoke either permission at any time in iOS Settings → Urge Surfer. The rest of the app keeps working.
Sharing
If you choose to share a victory selfie, the app uses iOS's built-in system share sheet (UIActivityViewController). At that point you decide where it goes — Messages, Photos, AirDrop, another app, or cancel. Urge Surfer does not control or monitor what happens after you pick a destination; that's between you, iOS, and the app you chose to share with. It also does not receive any acknowledgment of whether or how the share completed.
Third-party services
The running app makes no network requests. It has no third-party SDKs that collect or transmit data.
The only third parties involved at all are:
- Apple — operates the App Store you downloaded the app from, the operating system the app runs on, and the share sheet you may use. Apple's own data collection is governed by Apple's privacy policy.
- Expo — used as the build framework and (for development builds) over-the-air JavaScript delivery. In the production App Store build, the app does not communicate with Expo's servers.
Children's privacy
The app is rated for ages 17+ on the App Store and is not directed at children under 13. The app collects no personal data from anyone, including children.
Your rights and how to exercise them
Because no data leaves your device, the app cannot send you a copy of your data — it's already entirely in your possession. You have full control:
- View all your data — it's all visible inside the app (Home, Stats, History, Album, Profile).
- Delete a single entry — long-press a photo in the Album to delete; future versions will also support deleting log entries.
- Delete everything — uninstall the app. iOS removes the entire app sandbox, including all stored data and photos.
If you have questions about your data, email abhay.katheria1998@gmail.com.
Changes to this policy
If the privacy posture of the app ever changes — for instance, if a future version adds optional sync or notifications — this policy will be updated and the app's release notes will call out the change. The "Effective" date at the top of this document reflects the most recent revision.
Open source
The app is released under the AGPL-3.0 license, and the full source is published at https://github.com/abhaykatheria/urgesurfer. Anyone, including security researchers, can verify that the claims above match what the app actually does. If you find a discrepancy, please report it via the project's SECURITY.md.