Privacy Policy

1. Who operates Surprilo

Surprilo is currently operated as an independent software project. The service is being developed and validated as an early-stage product; it is not presented as a registered company or commercial legal entity.

If you have questions about this policy or about privacy at Surprilo, contact us at contact@surprilo.com.

2. What Surprilo is

Surprilo lets visitors create and share small message experiences (surprises, quizzes, choice prompts and prank reveals). A creator composes an experience and shares a public link; recipients open that link and interact with the experience. Surprilo has no geolocation, no tracking of recipients and no location-based features.

3. Anonymous creator sessions

You can create experiences without an account. To make this possible we set the strictly necessary cookie `surprilo_sid`, a random, opaque identifier stored only in an HttpOnly cookie on your device. It identifies your browser session so that drafts and experiences you create remain accessible to you ("My experiences"). It contains no personal data, is not used for tracking and never leaves your browser except to our server.

4. Accounts and authentication

Optionally you can create an account to keep ownership of your experiences across devices. Accounts are handled by Supabase Auth: we process your email address and a password hash (or a one-time login link sent to your email). We do not offer social logins, and we do not process names, photos or payment data.

Anonymous drafts created before signing up can be claimed by the account after signup. Claiming is intentional and user-initiated.

5. Experience content (user-generated content)

Experiences contain the text and settings you enter. This content is stored in our database and — once you publish an experience — is served to everyone who has the public link. You are responsible for the content you create; please do not include personal data of other people without their permission.

Recipients' answers inside quiz or choice experiences are processed only in the recipient's browser and are not stored on our servers.

6. Analytics

We operate a minimal, first-party, server-side analytics system to understand how the product is used (e.g. how many created experiences get published or opened). It records only event names, the experience type, an opaque random session identifier and a small allowlisted set of values (such as whether a share link was copied).

The analytics system does NOT record: IP addresses, user agents, referrers, message content, recipients' answers, free-form data, or any advertising identifiers. There is no cross-site or cross-device tracking and no profiling. We do not use Google Analytics, Google Tag Manager, Meta Pixel or any other third-party analytics or advertising tool.

7. Recipient funnel sessions

When a recipient interacts with an experience, we set the strictly necessary cookie `surprilo_aid` (a random opaque identifier, 30 days). It protects the service against abuse (rate limiting) and groups anonymous funnel events. It contains no personal data and is never linked to an identity.

8. Cookies

We use only the strictly necessary cookies described in our Cookie Policy. We do not use advertising or third-party marketing cookies and therefore no cookie consent banner is required. You can delete cookies at any time in your browser settings; deleting `surprilo_sid` will detach your browser from previously created anonymous drafts.

9. Service providers

• Supabase (database, authentication) — stores account data, experience content and analytics events on our behalf.
• Vercel (hosting and content delivery) — serves the website.
• Email delivery for account emails (signup, login links, password reset) is handled through Supabase Auth.
• YouTube: creators may embed YouTube videos in their experiences. When a video is played, YouTube may set its own cookies and process data under Google's privacy policy. Videos are only loaded when you play them.

10. Data transfers

Our service providers may process data in data centers outside the European Union. Where that happens, we rely on the transfer safeguards these providers offer for customer data (such as the EU Standard Contractual Clauses) and keep the set of providers deliberately minimal. The current providers are listed in section 9.

11. Retention and deletion

• Experiences: kept until you delete them; expired content is removed periodically.
• Anonymous session identifiers: stored as cookies (see the Cookie Policy) and removed when you clear them; orphaned session data is cleaned up periodically.
• Accounts: you can request account and data deletion at any time via contact@surprilo.com; personal data of the account and its experiences are then deleted.
• Analytics events: retained only in pseudonymous form (no IP, no identity); they cannot be linked back to a person by us.
• Attribution between recipients and new creators: single-use, server-side only, deleted no later than 30 minutes after issuance.

12. Your privacy rights

Depending on where you live, you may have rights such as access to your data, correction, deletion, restriction of processing, objection and data portability (for users in the EU/EEA these are the GDPR rights in Articles 15–21). Where processing is based on consent, you can withdraw it at any time.

Because most of the service works anonymously, we often cannot link data to a specific person. To exercise your rights or ask privacy questions, contact

contact@surprilo.com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or where you believe a breach of data protection law occurred.

13. Security

We apply a privacy-first architecture: session cookies are HttpOnly and opaque; access to stored data is strictly restricted; analytics contains no personal data; public experience pages never expose ownership information or hidden answers. No system is perfectly secure, but we keep the amount of processable data as small as technically possible.

14. Changes to this policy

We may update this policy as the service evolves. The date at the top of this page reflects the current version. Material changes will be announced on the website.