This Cookie Policy explains how Surff uses cookies and similar technologies across our website and app, what each one does, and the choices you have. It should be read alongside our Privacy Policy, which explains how we handle personal data more generally, and our Terms of Use.
Who we are
Surff is operated by Surff Limited, a company incorporated in England and Wales under company number 15411120, whose registered office is at Collingwood Buildings, 38 Collingwood Street, Newcastle, NE1 1JF. For the cookies and data described here, we are the "data controller" under UK data protection law. We are registered with the Information Commissioner's Office (ICO) under registration number ZC172506.
This policy is governed by UK data protection law: the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), which is the law that specifically covers cookies.
What cookies and similar technologies are
A cookie is a small text file that a website stores on your device. It lets a site remember things between pages and visits - like keeping you signed in, or remembering a preference. We also use similar technologies, such as your browser's local storage, for the same kinds of purpose. In this policy, when we say "cookies" we mean cookies and these similar technologies together.
Cookies set by the site you are visiting are called "first-party" cookies. Cookies set by another organisation are "third-party" cookies. Almost all of ours are first-party. The only exception is our analytics tool, described below.
How we use cookies, and your consent
Surff is built to be consent-first. We use only the cookies we genuinely need to run the service securely, plus - if you agree - a single analytics tool that helps us understand how the site is used. We do not use advertising cookies and we do not sell your data.
Under PECR, cookies that are "strictly necessary" to provide a service you have asked for do not need your consent. Everything else - including analytics - needs your consent before it is set. So when you first visit, we show a banner: nothing non-essential runs until you choose "Accept", and if you choose "Reject" no analytics cookies are set. You can change your mind at any time (see "How to manage or withdraw your consent" below).
The cookies we use
Strictly necessary cookies (always on)
These make the site work and keep it secure. Under PECR they do not require consent, because the service cannot run without them.
Cookie | Provider | Purpose | Expires after |
|---|---|---|---|
surff-session | Surff (first-party) | Keeps you signed in and carries your session between pages. | 2 hours after you go idle |
XSRF-TOKEN | Surff (first-party) | A security token that protects our forms against cross-site request forgery. | Your browsing session |
remember_web_* | Surff (first-party) | Set only if you choose "Remember me" at login, to keep you signed in beyond a single session. | Up to around 400 days |
surff_consent | Surff (first-party) | Remembers your cookie choice so we do not ask again, and so both our website and app apply the same decision. It holds only your accept or reject choice. | 6 months |
Functional cookies
These remember choices you make so the site behaves the way you expect. They are not essential, so we set them in line with your preferences.
Cookie | Provider | Purpose | Expires after |
|---|---|---|---|
surff_voter | Surff (first-party) | On our public vote pages, remembers which topics you have voted on so you see the results, and prevents repeat votes. It contains no personal data. | 12 months (renewed each time you vote) |
appearance | Surff (first-party) | Remembers your light, dark or system theme choice. | 12 months |
sidebar_state | Surff (first-party) | Remembers whether the app sidebar is open or collapsed. | 7 days |
Analytics cookies (only if you opt in)
If you accept analytics cookies, we use Google Analytics to understand how the site is used - which pages are popular and where visitors come from - so we can improve it. The information is aggregated and we never use it to advertise to you. These cookies are set only after you accept, and only on our live site.
Cookie | Provider | Purpose | Expires after |
|---|---|---|---|
_ga | Google Analytics | Tells one visitor apart from another, using a randomly generated id. | 2 years |
_ga_ (followed by our property id) | Google Analytics | Keeps Google Analytics session state for our specific property. | 2 years |
Advertising cookies
We do not use any. Surff sets no advertising or cross-site tracking cookies.
Similar technologies (local storage)
We also use your browser's local and session storage for the same kinds of purpose as the cookies above - for example remembering your theme and your cookie choice, and short-lived interface state such as showing a confirmation after you vote. These are not cookies, but we treat them the same way under this policy. They stay on your device until they expire or you clear your browser storage.
Cookies set by third parties, and international transfers
Our only third-party service is Google Analytics, provided by Google. The Google Analytics cookies are stored on your device as first-party cookies, but the information they collect is processed by Google on our behalf. This can involve transferring data to countries outside the UK, including the United States. Where that happens, the transfer is protected by appropriate safeguards recognised under UK data protection law, such as the UK Addendum to the EU Standard Contractual Clauses. You can read how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites.
How to manage or withdraw your consent
Our banner. The first time you visit you can Accept or Reject non-essential cookies. If you reject, no analytics cookies are set.
Change your mind at any time. Use the "Cookie settings" link in the footer, or in your account menu inside the app, to reopen the banner and change your choice.
Your browser. You can block or delete cookies in your browser settings, and manage local storage there too. Blocking strictly necessary cookies may stop parts of the site working.
Opt out of Google Analytics. You can install Google's opt-out browser add-on at tools.google.com/dlpage/gaoptout.
How long cookies last
The "Expires after" column in the tables above shows how long each cookie stays on your device, unless you clear it sooner. We also keep a server-side record of each cookie choice (the accept or reject decision, the date and the version of this policy it was made under) so we can show that consent was given. If you are signed in when you choose, that record is linked to your account. That record does not store your IP address in the clear: it holds only a keyed one-way code derived from it, under a dedicated secret. This is pseudonymous rather than fully anonymous - it lowers the chance of the record being linked back to you, but does not remove it entirely.
Your rights
Where cookies involve your personal data, you have rights under the UK GDPR, including the right to access, correct, erase or restrict the use of that data, and to object to it. Our Privacy Policy explains these rights and how to exercise them in full.
Complaints
If you have a concern about how we use cookies or your data, please contact us first so we can help. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
Changes to this policy
We may update this policy as our service changes or the law develops. When we make a significant change, we will update the version shown on this page and, where appropriate, ask for your consent again.
Contact us
If you have any questions about this Cookie Policy, please contact us at [email protected] or write to us at our registered office address above.