Surfshark says it keeps no logs of your online activity
Surfshark says its VPN service is logs-free and that it does not store information that could show your online activities. It says it is committed not to process information about users' online activity, and that it does not collect visited IP addresses, browsing history, session information, connection time stamps, used bandwidth, network traffic or similar information. It points to Netherlands jurisdiction, which it says does not require information storage or reporting.
Supporting quotations
No-logs Policy is one of the most important features of our VPN service and we keep our VPN service logs-free. We don’t store any information that could lead us to see your online activities.
we do not collect your visited IP addresses, browsing history, session information, connection time stamps, used bandwidth, network traffic or any other similar information
Surfshark is based in the Netherlands jurisdiction, which does not require information storage or reporting.
Qualifications & exceptions
The commitment is framed around online activity: what you do online while using the VPN.
The list says connection time stamps are not collected; a later paragraph in this section describes temporary connection details that include connection time stamps, see the connection-details card.
Not stated here
The text does not say how or by whom the no-logs claim is verified.
Cross-references
contrast (model-proposed): Connection details are kept temporarily, deleted within 15 minutes after the session ends — contrast: The no-logs paragraph says connection time stamps are not collected, while the next paragraph (and section 2.2.1) says servers temporarily keep connection details including time stamps, deleted within 15 minutes after the session ends. The policy presents both without explaining the difference.
Data Access & Collection · Company practice
Surfshark says it collects limited personal data and why
Surfshark says it collects limited personal data, meaning data that can directly or indirectly identify you when you use its services. It says this data helps it provide the services, enhance your experience, improve the services and comply with legal obligations. The policy then breaks down what is collected, why, on what basis and for how long, subsection by subsection.
Supporting quotations
Surfshark collects limited personal data, which includes any data that can directly or indirectly identify you when you use our Services.
Personal data helps us to provide you Services, enhance your experience, improve our Services, and ensure compliance with legal obligations.
Here's a breakdown of the personal data we gather and what we use it for:
Qualifications & exceptions
"Limited" is Surfshark's own description; the breakdown that follows is the operative list.
Personal data is defined to include data that identifies you directly or indirectly.
Not stated here
The text does not say what is not collected beyond the specific statements in later subsections.
Data Access & Collection · Company practice
Account creation: email, encrypted password, registration date and coupon code
To let you create a Surfshark account, Surfshark collects your email address, encrypted password, account registration date and any coupon code. It uses this information to create the account so you can use the services. Surfshark gives its basis as processing that is essential to provide you a service and carry out the terms of its service agreement.
Supporting quotations
2.1.1 For you to be able to create a Surfshark account
Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.
We use this information to create your account so that you can use our Services.
Qualifications & exceptions
Coupon code is collected only if you have one.
The stated basis is that processing is essential to provide the service and carry out the service agreement.
Data Access & Collection · Company practice
Service delivery: user ID, subscription, payment and partial card details
To provide the services, Surfshark collects your user ID and subscription information (plan name, term, ID, frequency, amount, currency, status, auto-renewal status and whether two-factor authentication is on or off). It also collects payment details: date of payment, amount paid, currency, payment status, payer residence country (and state), coupon used if any, part of the credit card number and the card expiry date. The stated basis is that processing is essential to provide the service and carry out the service agreement.
Supporting quotations
2.1.2 To provide you with Surfshark Services
User ID, information about subscription (subscription plan name, subscription term, subscription ID, subscription frequency, amount, currency, status, auto-renewal status, and information about 2FA (on/off)), date of the payment, amount paid, currency, payment status, payer residence country (and state), coupon used (if any), part of the credit card number, credit card expiry date.
Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.
Qualifications & exceptions
Only part of the credit card number is listed as collected by Surfshark itself.
Coupon is listed only "if any".
Not stated here
The text does not say which part of the credit card number is kept.
Data Access & Collection · Context
Extra data is collected for each specific service you use
Beyond the account and general service data, Surfshark says it collects additional data specific to the individual service you use. It describes this data as essential for the particular service to function correctly.
Supporting quotations
2.2 Personal data needed for specific Surfshark Services
In addition to the personal data needed for account setup and general service delivery, we'll also collect additional data specific to the individual service you use. This personal data is essential for the particular Surfshark Service to function correctly:
Qualifications & exceptions
The additional data varies by service; each service has its own subsection.
Data Access & Collection · Company practice
VPN: no browsing history stored, temporary connection details kept
For the VPN service, Surfshark says it does not store any information about the websites you visit. Its servers temporarily keep details about your connection to a specific VPN server, such as your user ID and/or IP address and connection time stamps. Surfshark gives its basis as processing that is essential to provide the service and carry out the service agreement, and says the connection information is automatically deleted within 15 minutes after the session ends.
Supporting quotations
2.2.1 Provision of the VPN service
We do not store any information about the websites you visit while using our VPN.
Our servers temporarily keep details about your connection to a specific VPN server, such as your user ID and / or your IP address and connection time stamps.
Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.
Connection information is automatically deleted within 15 minutes after your session ends.
Qualifications & exceptions
The retained details are examples ("such as"), not stated as a complete list.
Deletion is automatic, within 15 minutes after the session ends.
Not stated here
The full list of connection details kept temporarily is not given.
Data Access & Collection · Company practice
Search tool: searches stay private; only an aggregated search count is kept
For the Search tool service, Surfshark says what you search for stays private and it does not collect that information. It collects only the aggregated number of searches you perform. The stated basis is that processing is essential to provide the service and carry out the service agreement, and the data is kept for as long as your subscription is active and for 2 years after the last login.
Supporting quotations
2.2.2 Provision of the Search tool service
What you search for stays private. We don't collect such information.
Aggregated number of your performed searches.
Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.
We keep your personal data for as long as your subscription is active and for 2 years after the last login.
Qualifications & exceptions
What is collected is an aggregated count, not the search content.
Retention follows the subscription-plus-2-years rule.
Data Access & Collection · Company practice
Alternative ID: alternative persona details are stored
For the Alternative ID service, Surfshark collects the details of your alternative persona: name, middle name, surname, date of birth, gender, country, city, address and postal code. The stated basis is that processing is essential to provide the service and carry out the service agreement, and the data is kept for as long as your subscription is active and for 2 years after the last login.
Supporting quotations
2.2.3 Provision of the Alternative ID service
Alternative persona
Your alternative persona’s name, middle name, surname, date of birth, gender, country, city, address, postal code.
Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.
We keep your personal data for as long as your subscription is active and for 2 years after the last login.
Qualifications & exceptions
This covers the alternative persona record, listed separately from the alternative email data.
Not stated here
The text does not say whether the persona details are generated by Surfshark or entered by you.
Data Access & Collection · Company practice
Alternative email: email content and metadata handled for forwarding
For the Alternative email service, Surfshark collects your email address, the email mask and its description, the subject line, the content of the email letter (only for technical reasons, that is, to forward it), the email sender and receiver, forwarding status, user profile data and metadata associated with the email. You must verify the email address that emails are forwarded to. Emails received through the service, along with the sender and recipient server IP address, sender email address and timestamps, are deleted as soon as they are forwarded, and Surfshark uses a trusted email service provider to provide the service. The stated basis is that processing is essential to provide the service and carry out the service agreement. A separate line also says the data is kept for as long as your subscription is active and for 2 years after the last login.
Supporting quotations
Alternative email
Your email address, email mask and its description, subject line of the email letter, the content of the email letter (only for technical reasons, i.e., to forward it), email sender and receiver, email forwarding status, user profile data, metadata associated with the email.
Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.
We keep your personal data for as long as your subscription is active and for 2 years after the last login.
To be able to use Alternative email service, you will have to verify your email address to which emails are forwarded.
We use a trusted email service provider to facilitate this service.
Qualifications & exceptions
Email content is collected "only for technical reasons, i.e., to forward it".
Deletion as soon as forwarded is stated for the received emails with sender and recipient server IP, sender address and timestamps.
A third-party email service provider is used.
Not stated here
The text does not say how the 2-year-after-last-login retention line and the delete-once-forwarded statement fit together for items such as the subject line, sender and receiver and metadata; the two statements are listed in different places.
The email service provider is not named.
Cross-references
contrast (model-proposed): Alternative email: verify your address; forwarded emails deleted once sent on — contrast: The data table says Alternative email data, including the email content, subject line, sender and receiver, is kept while the subscription is active plus 2 years after last login, while the later paragraph says received emails and listed sender and recipient details are deleted as soon as they are forwarded. The policy does not reconcile them.
Data Access & Collection · Company practice
Alternative number: assigned number plus your call and SMS logs and content
For the Alternative number service, Surfshark collects the telephone number it assigns to you, as well as your call and SMS log and content. The stated basis is that processing is essential to provide the service and carry out the service agreement, and the data is kept for as long as your subscription is active and for 2 years after the last login. Surfshark uses trusted VoIP service providers to run the service, and says it respects your privacy and does not access your private content.
Supporting quotations
Alternative number
The telephone number that has been assigned to you by Surfshark, as well as your call, SMS log and content.
Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.
We keep your personal data for as long as your subscription is active and for 2 years after the last login.
In addition, to facilitate the Alternative Number service, we use trusted VoIP service providers. We respect your privacy and we do not access your private content.
Qualifications & exceptions
"Call, SMS log and content" is listed as collected, while the text also says Surfshark does not access private content.
Third-party VoIP providers are involved.
Not stated here
The text does not say whether the call and SMS content is stored by Surfshark, by the VoIP providers, or both, or what "does not access" means technically.
The VoIP providers are not named.
Data Access & Collection · Company practice
Alert service: email, ID or card numbers you submit are kept, with some encrypted
For the Alert service, which checks for personal data leaks, you can submit your email address, personal identity number (or social security number) or credit card number for monitoring. Surfshark says it securely retains this information and encrypts personal identity and credit card numbers. It also collects information about leaks it finds. The stated basis is that processing is essential to provide the service and carry out the service agreement, and the data is kept for as long as your subscription is active and for 2 years after the last login.
Supporting quotations
2.2.4 Provision of the Alert service
Email address and / or personal identity number (or a social security number), and / or credit card number, information related to data leaks found.
Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.
We keep your personal data for as long as your subscription is active and for 2 years after the last login.
To use our Alert service for detecting personal data leaks, you can submit your email address, personal identity number (or a social security number), or credit card number for monitoring.
We'll securely retain this information, encrypting personal identity and credit card numbers.
Qualifications & exceptions
Encryption is stated for personal identity and credit card numbers, not for the email address.
The data you submit is your choice; you "can" submit any of these.
Data Access & Collection · Company practice
Data Leak Checker: consent basis, email address and results not stored
For the Data Leak Checker, Surfshark collects your email address and the data leaks it was involved in, and says its legal basis is your consent. It says it does not retain your personal data and does not store your email address or information related to data leaks. You enter the email address voluntarily to find out whether your information has been exposed.
Supporting quotations
2.2.5 Provision of the Data Leak Checker service
Email address, data leaks your email address was involved in.
Legal basis for the processing of personal data is your consent.
We do not retain your personal data.
Please note that we do not store your email address or information related to data leaks.
Qualifications & exceptions
The stated basis here is consent, unlike most other services in this section, which cite necessity to provide the service.
The tool works on an email address you choose to enter.
Data Access & Collection · Company practice
Antivirus: device information and webcam protection usage statistics
For the Antivirus service on Windows, MacOS and Android, Surfshark collects information about the devices on which you use it, to enforce the limit on the number of devices one client may use under its Terms of Service. To improve user experience it also retains usage statistics for the webcam protection feature: how many times you received a request to access your camera or microphone, which preference you chose, whether the feature is on or off, and how many apps are on your exclusion list. The stated basis is that processing is essential to provide the service and carry out the service agreement, and the data is kept for as long as your subscription is active and for 2 years after the last login.
Supporting quotations
2.2.7 Provision of the Antivirus service for Windows, MacOS, and Android users
We will collect information about your devices on which you use the Antivirus service. This information is needed to ensure the compliance with the limitation for the number of devices that one client may use for the Antivirus service as provided in our Terms of Service.
Also, to improve user experience we will retain statistical information about the usage of the webcam protection feature, including the number of times you received a request to access your camera or microphone, which preference you selected, whether this feature is turned on or off, how many apps you have included in the exclusion list.
Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.
We keep your personal data for as long as your subscription is active and for 2 years after the last login.
Qualifications & exceptions
Applies to the Antivirus service for Windows, MacOS and Android users.
The device limit comes from the Terms of Service, which are not part of this source.
Not stated here
The device limit number is not stated here.
Data Access & Collection · Company practice
Email scam checker: sender, subject and content collected for the scan
For the email scam checker, Surfshark collects the sender's email address, the email subject and the content of the email, including any website address in it. You choose which emails to scan, and your permission is required to collect this information. The stated basis is that processing is essential to provide the service and carry out the service agreement. The data is stored only for the brief period needed to run the scan and give you the results; the sender's email address is kept for 30 days to improve the services.
Supporting quotations
2.2.8 Provision of email scam checker service
The sender's email address, the email subject, and the content of the email, including any website address indicated therein.
Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.
The collected data will only be stored for the brief period necessary to perform the scan and provide you with the results. Sender’s email address will be kept for 30 days to improve our services.
Your permission will be required to collect this information, as you will actively select which emails from your inbox to scan.
Qualifications & exceptions
Collection covers emails you actively choose to scan.
The sender's email address is kept for 30 days to improve services; the other collected data is kept only briefly for the scan.
Not stated here
"Brief period" is not defined.
Data Access & Collection · Company practice
Message protection: sender number, SMS content, URLs and metadata scanned
For the message protection service, Surfshark collects the sender's phone number and the content of the SMS, including any URLs in it, plus metadata such as scan duration, total URL count and timestamp. The stated basis is that processing is essential to provide the service and carry out the service agreement. It says the collected data is only accessed for the brief period needed to perform the scan and give you the results. For message protection diagnostics it collects information such as user ID, sender's ID, sender's phone number, the SMS content and metadata such as scan duration; the policy refers to paragraph 2.3.9 for that.
Supporting quotations
2.2.9 Provision of message protection service
The sender's phone number and the content of the SMS, including any URL addresses indicated therein, metadata (e.g. scan duration, total URLs count, timestamp).
Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.
The collected data will only be accessed for the brief period necessary to perform the scan and provide you with the results.
You can find information about how your personal data is processed for message protection diagnostics in paragraph 2.3.9 of this privacy policy.
In the case of message protection diagnostics, we will collect information such as user ID, sender’s ID, sender's phone number, the content of the SMS, metadata (e.g. scan duration).
Qualifications & exceptions
"Accessed" for a brief period is the wording used for retention in the table; the longer paragraph says message content is never stored or retained.
Diagnostics collection for message protection is a separate, additional collection.
Not stated here
"Brief period" is not defined.
Data Access & Collection · Company practice
Call protection: caller number, classification and metadata
For the call protection service, Surfshark collects the caller's number, call classification and metadata such as scan duration and timestamp. The stated basis is that processing is essential to provide the service and carry out the service agreement, and the collected data is only accessed for the brief period needed to run the scan and give you the results. For call protection diagnostics it collects the user ID, caller's number, call classification and metadata; the policy points to paragraph 2.3.9 for that.
Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.
The collected data will only be accessed for the brief period necessary to perform the scan and provide you with the results.
You can find information about how your personal data is processed for call protection diagnostics in paragraph 2.3.9 of this privacy policy.
Additionally, in the case of call protection diagnostics, we will collect information such as the user ID, caller’s number, call classification, and metadata (e.g., scan duration, timestamp).
Qualifications & exceptions
The retention wording is "accessed" for a brief period; the longer paragraph says the data is never stored on Surfshark's servers.
Diagnostics collection is a separate, additional collection.
Not stated here
"Brief period" is not defined.
Data Access & Collection · Company practice
Account security: device details and last login kept; new-device login email
To ensure the security of your account, when you log in to the app Surfshark collects the device name, operating system, Surfshark app version and last login date. It says this helps it recognize your trusted devices and give better account security, and that it will email you if you log in from a new device that differs from your last-used devices. The email gives the login details; Surfshark urges you to change your password immediately if you did not log in, and encourages two-factor authentication. The legal basis stated is Surfshark's legitimate interest in the security of your account, and the data is kept for as long as your subscription is active and for 2 years after the last login.
Supporting quotations
2.3.1 To ensure the security of your account
Device name, operating system, Surfshark app version installed, last login date.
Legal basis for the processing of personal data is our legitimate interest to ensure the security of your account.
We keep your personal data for as long as your subscription is active and for 2 years after the last login.
when you log in to the Surfshark app, we collect the information indicated above. This helps us recognize your trusted devices and allows us to provide better security for your account. As part of this, we'll notify you by email if you log in from a new device that differs from your last-used devices.
This email will provide you with the login details. If you did not log in from this new device, it is crucial to change your password immediately to secure your account.
Qualifications & exceptions
Collection happens when you log in to the Surfshark app.
The notification is sent only for a login from a new device that differs from your last-used devices.
The basis here is legitimate interest, not necessity for the service.
Data Access & Collection · Company practice
Customer support: your email and inquiry content kept up to 6 years
To let you submit an inquiry and communicate with customer support, Surfshark collects your email address, the content of your inquiry (including any information you share that is necessary to resolve the query) and the date and time of the inquiry. Its legal basis is your consent or its legitimate interest in giving you the necessary information. It keeps personal data related to customer support communications for up to 6 years after receiving your message.
Supporting quotations
2.3.2 To enable you to submit an inquiry and communicate with customer support
Your email address, the content of inquiry, including any information that you share with our customer support team that is necessary to resolve the query, date and time of inquiry.
We process your personal data with your consent or in our legitimate interest to provide you with the necessary information.
We will keep personal data related to customer support communications for up to 6 years following the receipt of your message.
Qualifications & exceptions
The basis is stated as "consent or legitimate interest", without saying which applies when.
Retention is "up to 6 years" following receipt of your message.
Not stated here
The text does not say when consent is the basis and when legitimate interest is.
Data Access & Collection · Company practice
Live chatbot: name, email and inquiry time kept up to 6 years
To let you interact with the live chatbot, Surfshark collects your name, email address and the date and time of your inquiry. Its stated basis is that processing is essential to provide the service and carry out the service agreement and/or its legitimate interest. It keeps personal data related to customer support communications for up to 6 years after receiving your message.
Supporting quotations
2.3.3 To enable you to interact with the live chatbot
Your name, email address, date and time of inquiry.
Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement and / or our legitimate interest.
We will keep personal data related to customer support communications for up to 6 years following the receipt of your message.
Qualifications & exceptions
The basis is given as "and / or", so the text does not say which applies to which processing.
Not stated here
The text does not say whether chat message content is kept; only name, email and date and time are listed, but the retention line refers to customer support communications.
Data Access & Collection · Company practice
Transactional emails: your address and the email content kept while subscribed plus 2 years
To email you about important updates and announcements related to your use of the services and website, Surfshark collects your email address, the content of the email and the date and time it was sent. The stated basis is that processing is essential to provide the service and carry out the service agreement, and the data is kept for as long as your subscription is active and for 2 years after the last login.
Supporting quotations
2.3.4 To contact you via email about important updates and announcements related to your use of the Services and Website (transactional communications)
Your email address, the content of the email address, date and time of email sent.
Processing your personal data is essential for us to provide you a service and carry out the terms of our service agreement.
We keep your personal data for as long as your subscription is active and for 2 years after the last login.
Qualifications & exceptions
These are service-related (transactional) communications, separate from marketing.
Data Access & Collection · Company practice
Social media accounts: your interactions kept until you delete them
To manage and administer its social network accounts, Surfshark collects interaction data such as likes, comments, full name, pseudonym, social network profile name and pictures. Its legal basis is its legitimate interest in engaging with the community and managing the accounts. It processes the information you provide until you delete your posted content or your social network account. Surfshark adds that when you share information on social networks such as Facebook or X, it does not control how those companies use or store it; they process it for their own reasons, including marketing, and you should check each platform's privacy policy.
Supporting quotations
2.3.7 To manage and administer our accounts on social networks
Your interaction data, e.g., likes, comments, full name, pseudonym, social network profile name, pictures.
Legal basis for the processing of personal data is our legitimate interest to engage with the community and to manage our social networks accounts.
We will process your provided information until you delete your posted content or social networks account.
when you share information on social network accounts, e.g., Facebook, X, we don't control how they use or store that data.
Qualifications & exceptions
Retention ends when you delete your posted content or your social network account.
The platforms' own processing is outside Surfshark's control.
Data Access & Collection · User right or choice
Cookies: control them in your browser; the Cookie Policy is part of this policy
You can control the use of cookies at the individual browser level on your device, and the policy points to section 7 for more on cookies and how to disable them. Section 7 says Surfshark and most sites use cookies, pixels, web beacons and similar technologies to help provide, protect and improve the services and website; you can reject them, but some things may not work completely or as well as they should. It says you can see which cookies Surfshark uses in its Cookie Policy, which it calls an integral part of this Privacy Policy.
Supporting quotations
You can control the use of cookies at the individual browser level on your device. More information about cookies and how to disable them can be found in Section 7 of this Privacy Policy.
7. How do we use cookies and other tracking technologies?
If you want to, you can reject those, but some things may not work completely or as well as they should.
You can check what cookies we use in our Cookie Policy which is an integral part of this Privacy Policy.
Qualifications & exceptions
Cookie control is described at the browser level on your device.
Rejecting cookies may mean some things do not work completely or as well as they should.
The Cookie Policy is a separate linked document; its text is not part of this source.
Not stated here
Which cookies Surfshark uses is not listed in this source; the Cookie Policy is linked but not supplied here.
Data Access & Collection · Company commitment
Audited no-logs policy and only the minimum data needed to provide the services
Surfshark says having an audited No-logs Policy is one of its core principles, referring to its Terms of Service, and that it therefore collects only the minimum amount of data about you that is required to provide you with its services.
Supporting quotations
having an audited No-logs Policy is one of our core principles (see more in our Terms of Service), therefore we collect only the minimum amount of data about you, which is required to provide you with our Services.
Qualifications & exceptions
The audited no-logs claim refers to the Terms of Service, which are not part of this source.
Not stated here
Who audits the no-logs policy, and what the audit covers, are not stated in this source.
Data Access & Collection · Company practice
Cookies, pixels and web beacons are used to provide, protect and improve services; you can reject them
Surfshark says it, like most sites, uses cookies, pixels, web beacons and similar technologies (collectively "cookies") to help provide, protect and improve its services and website. You can reject them if you want, but some things may not work completely or as well as they should.
Supporting quotations
Most sites on the internet, including Surfshark’s, use cookies, pixels, web beacons, and other similar technologies (collectively called “cookies”), as they’re pretty convenient to help provide, protect, and improve our Services and Website. If you want to, you can reject those, but some things may not work completely or as well as they should.
Qualifications & exceptions
"Cookies" is defined to include pixels, web beacons and other similar technologies.
Rejecting cookies may reduce how well some things work.
Not stated here
The specific cookies and their purposes are in the Cookie Policy, which is not part of this source.
Data Access & Collection · Company commitment
No services or knowing data collection for anyone under 18; data found is deleted right away
Surfshark says it does not knowingly collect or solicit personal data from anyone under 18 and does not offer its services to them. It asks anyone under 18 not to send personal data. If it finds it has received personal data from someone under 18, it says it will delete it right away. If you believe it might have such data, you can contact support@surfshark.com.
Supporting quotations
We do not knowingly collect or solicit personal data from anyone under the age of 18.
We don't offer services to anyone under 18 and don't knowingly collect personal data from them. If you're under 18, please don't send us any personal data. If we find out that we have received personal data from someone under 18, we will delete it right away.
Qualifications & exceptions
The commitment is about knowing collection; "if we find out" triggers deletion.
The age threshold stated is 18.
Not stated here
The text does not describe any age verification.
Data Access & Collection · Company practice
Diagnostics and crash reports: collected on consent, kept up to 7 days
To maintain and improve the quality of its services and support, Surfshark collects diagnostics information and monitors crash reports on its apps and extensions. This includes aggregated performance information, how often you use the services, unsuccessful connection attempts, device information and similar information. Its legal basis is your consent, and it keeps the data until you withdraw consent but no longer than 7 days from receipt. Surfshark says diagnostics information does not contain uniquely identifiable information, except for the email scam checker and message protection diagnostics described separately. If you have problems, it may need your device information, and says it will access that only if you give a separate consent.
Supporting quotations
2.3.9 To maintain and improve the quality of our Services and provide effective support (diagnostics and crash reporting)
Aggregated performance information, the frequency of use of Services, unsuccessful connection attempts, device information, and other similar information.
Legal basis for such processing is your consent.
We keep your personal data until you withdraw your consent, but no longer than 7 days from its receipt.
we collect diagnostics information and monitor crash reports on our apps and extensions. Please note that diagnostics information does not contain uniquely identifiable information (except as provided below regarding email scam checker service, message protection service).
However, if you face some problems when using our apps, we may require your device information to solve these problems. We will access this information only if you provide a separate consent for that.
Qualifications & exceptions
Consent is the stated basis and the maximum keep time is 7 days from receipt.
The no uniquely identifiable information statement has stated exceptions.
Device information for troubleshooting needs a separate consent.
Not stated here
"Other similar information" is not defined.
The exception to the no uniquely identifiable information statement names the email scam checker and message protection only, although the call protection diagnostics also list the user ID and the caller's number.
Data Access & Collection · Company practice
Scam, message and call diagnostics: content and numbers collected, kept up to 30 days
For diagnostics of the email scam checker, Surfshark collects the sender's name and email address, the receiver's email address, the subject, the content of the email and attachment metadata (file name and type). For message protection diagnostics it collects the user ID, sender's ID, sender's phone number, the SMS content and metadata such as scan duration. For call protection diagnostics it collects the user ID, caller's number, call classification and metadata such as scan duration and timestamp. The basis is your consent. For message protection and call protection diagnostics, it keeps the data until you withdraw consent but no longer than 30 days from receipt. For the email scam checker diagnostics it says the amount of personal data collected is minimal and necessary.
Supporting quotations
In the case of email scam checker diagnostics, we will collect information including the sender's name and email address, the receiver's email address, the email subject, the content of the email, and any attachments metadata (file name, file type).
In the case of message protection diagnostics, we will collect information such as user ID, sender’s ID, sender's phone number, the content of the SMS, metadata (e.g. scan duration).
In the case of call protection diagnostics, we will collect information such as user ID, caller’s number, call classification, metadata (e.g. scan duration, timestamp).
In the case of message protection, call protection diagnostics, we keep your personal data until you withdraw your consent, but no longer than 30 days from its receipt.
In the case of email scam checker diagnostics, we will collect a minimal amount of necessary personal data.
Qualifications & exceptions
Collection is based on your consent.
The 30-day maximum is stated for message protection and call protection diagnostics; for the email scam checker diagnostics the text points to the general diagnostics line (up to 7 days), without saying so directly.
This is a separate collection from the scan itself, which the earlier sections say does not store message or call content.
Not stated here
The text does not say which retention period applies to email scam checker diagnostics.
How these diagnostics collections fit with the earlier statements that message content is scanned instantly and never stored or retained is not explained.
Data Access & Collection · Company practice
Trusted Wi-Fi auto-connect: Wi-Fi name read with your consent, kept on your device
To enable auto-connect for a trusted Wi-Fi network, Surfshark processes location data, specifically the Wi-Fi name (SSID). Its basis is your consent, and it processes the data until you withdraw consent. With your permission it accesses your device's location data strictly to identify the Wi-Fi network name. Surfshark says this data remains solely on your device and is never sent to its servers or shared with third parties, and that no physical location data is stored or shared.
Supporting quotations
2.3.10 To enable the auto-connect feature for the trusted Wi-Fi network
Location data (i.e specifically Wi-Fi name or Service Set Identifier).
Legal basis for such processing is your consent.
We will process your personal data until you withdraw your consent.
With your permission, we access your device's location data strictly to identify the Wi-Fi network name (SSID). This enables auto-connect and trusted network features. This data remains solely on your device and it is never transmitted to our servers or shared with third parties. No physical location data is stored or shared.
Qualifications & exceptions
Access to location data is with your permission and only to identify the Wi-Fi name.