Privacy Policy
Effective August 28, 2026 · OhSurf is operated by Plug Marketplace LLC
OhSurf runs on verified attention, so we're unusually direct about what we measure. This page says exactly what we collect, why, and what we never do with it.
What we collect
- Account basics — email address, handle, password (stored hashed by our auth provider), and the intent you pick at signup.
- Profile content you write — display name, quote, about, interests, site link, avatar and theme choices. Your profile page is public by design.
- Exchange activity — drops you launch, responses and reactions you give, credits earned and spent (kept in an append-only ledger so balances always add up).
- Attention telemetry — this is the heart of the product: while you surf we measure things like verified time with the page, whether the tab was visible and focused, clicks into the framed site, pages explored, scroll and hands-on signals, and answers to in-loop checks. It exists to prove attention was real and to pay you fairly.
- Technical basics — IP address and device/browser info used for security, rate limiting, and fraud prevention; cookies for signing you in; localStorage for small preferences (like sound on/off and demo progress).
How we use it
To run the exchange: verify attention, grant and spend credits, deliver feedback to drop owners, compute quality and reputation scores, prevent fraud and abuse, send account notifications, and improve the product. Aggregate, non-identifying stats (like a drop's reaction percentages or the exchange's live counters) appear on public receipts and pages.
What we share (and what we never do)
We never sell your personal data and we run no third-party advertising trackers. Data is processed by the infrastructure we build on: Supabase (database and authentication) and Railway (hosting). If we add payments (Stripe) or transactional email (Resend), those providers will process the data needed for their function. Feedback you write on a drop is shown to that drop's owner with your handle. We disclose data if the law genuinely requires it.
Retention and deletion
Your data lives as long as your account does. Deleting your account removes your profile, wallet, and associated records from the exchange. Feedback you gave to other members' drops may remain part of their results. Backups age out on our infrastructure providers' schedules.
Your choices
- Edit your public profile any time in the You tab.
- Your profile page and receipts for your drops are public; what you put on them is up to you.
- You can request access to or deletion of your data via the contact details on ohsurf.com.
Age, changes, and contact
OhSurf is for people 13 and older. We'll update this policy as the service evolves (the effective date above will change). Questions about privacy: reach us via the contact details on ohsurf.com.