Privacy policy

srf.gg is a hosting and tooling platform for work produced with AI agents. It is operated by srf.gg ("we"). Questions about this policy go to hello@srf.gg.

• Account details. Your name, email address and a password hash, or the identity a sign-in provider (Google or GitHub) gives us. Two-factor secrets and recovery codes are stored encrypted.
• What you host. The files, projects, versions, documents (Tokens), comments and notes you or your agent push to srf, and the runtime configuration of your apps.
• App operations. Build logs, deployment records, container logs, health events and tool-call logs for the apps and Bullets you run, so you can see what happened.
• Connections you authorize. When you connect a third-party account to an app or Bullet, we store its OAuth tokens encrypted so the app can act for you. When you connect an agent such as Claude to srf, we record that consent and the organization you chose.
• Security and usage records. Sign-ins and failed sign-ins, API key use, IP addresses and user agents, and platform events such as deletions and visibility changes. We keep these to protect accounts and to operate the service.
• Billing. Payments are handled by Stripe. We store your Stripe customer and subscription identifiers, never card numbers.
• Visitors to hosted content. When someone opens a page or a tracked link you share, we record the open, the approximate country and device type, and how long the page was engaged, and show that to the owner of the content.

Some features use Google's APIs. This section describes exactly what we receive from Google, what we do with it, and the limits we hold ourselves to.

• Signing in with Google. We receive your name, email address and profile picture to create and identify your account. Nothing else from your Google account is read.
• Connecting a Chrome Web Store developer account. An organization admin can connect the organization's Chrome Web Store developer account so that srf can upload and publish the organization's own browser extensions as store listings on its behalf. With that permission we create, update and publish the listings for extensions built in srf, and read their review status. We do not read, change or publish any other listing, and we do not access any other Google data through it.
• Connecting Google to an app or Bullet you build. When you authorize a Google account for one of your own apps or Bullets, we store the resulting tokens encrypted and make them available only to that app or Bullet, which uses them as you have configured it. The permissions requested are shown on Google's consent screen at the time, and we request only what that app declares.

Google data is used only to provide the feature you connected it for. We do not use it for advertising, we do not sell it, and we do not transfer it to anyone except as needed to provide that feature, to comply with the law, or as part of a merger or acquisition with notice to you. No person at srf reads it except with your permission, for security reasons, or where the law requires it. Tokens are encrypted at rest and deleted when you disconnect the account in srf or revoke access at myaccount.google.com/permissions.

srf.gg's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

To run the service: host and serve your projects, run your apps, deliver tool calls from your agents to your Bullets, send the emails you and your apps ask us to send, bill your plan, and keep accounts safe. We do not sell personal data and we do not use your content to train models.

• Your organization. Members of your srf organization see the projects, Tokens and activity the organization shares, according to its permission settings.
• People you share with. Anyone you give a link or grant access to sees that content.
• Processors. Google Cloud (hosting, storage and databases, United States), Stripe (payments), Resend (email delivery), and GitHub or Google when you sign in or connect with them (see Google account data above). They process data on our instructions.
• Agents you connect. An agent such as Claude that you connect to srf acts as you and receives what you ask it to read. We never give it your password or API keys.
• The law. We disclose data when legally required.

• Your account, projects and Tokens: until you delete them or close your account.
• Container logs: 7 days on Free, 30 on Pro, 90 on Business. Project and platform events: 180 days.
• Tool-call, tracked-link and email delivery logs: while the project exists.
• OAuth tokens for connected accounts: until you disconnect the account or delete the project that used it.
• Database backups: 7 daily backups with point-in-time recovery, then discarded.

You can edit or delete projects, Tokens and comments at any time, revoke API keys and connected apps under Settings, disconnect third-party accounts, and delete your organization. To delete your account entirely or to request a copy of your data, email hello@srf.gg from the address on the account.

Data is encrypted in transit. Secrets, OAuth tokens and two-factor material are encrypted at rest. Apps run in isolated containers with resource limits, and every call from an agent to a Bullet is signed and logged. No system is perfect; if you find a problem, tell us at hello@srf.gg and we will respond promptly.

srf.gg is not directed at children under 16 and we do not knowingly collect their data.

When this policy changes we update the date above. Material changes are announced to account holders by email.