PRIVACY
POLICY.

1. WHO WE ARE

Ideate LLC operates Surf: Ultimate and is responsible for the personal information described here. Our mailing address is 30 N Gould St, Ste N, Sheridan, WY 82801, United States. Privacy requests may be sent to privacy@surfultimate.com.

2. WHAT THIS POLICY COVERS

This policy covers surfultimate.com, the browser game, accounts, multiplayer, leaderboards, purchases, support, and related services. Surf: Ultimate is intended for people aged 13 and older.

3. INFORMATION WE COLLECT

• Account information: email address, account identifier, sign-in provider, unique display name, and account dates.
• Gameplay information: Campaign progress, settings, equipped and owned cosmetics, start/finish records, replay recordings you choose to save online, leaderboard entries, multiplayer session records, reports, and sanctions. Multiplayer races send movement inputs so the server can verify results.
• Purchase information: product, amount, currency, Stripe/Link customer and transaction identifiers, receipt link, delivery-consent record, refund, dispute, and entitlement history. Ideate LLC does not receive your full payment-card number.
• Technical and security information: IP-derived country or region, browser and device details, request times, service errors, performance traces, security events, and limited server logs.
• Communications: information you send to support, privacy, security, or billing addresses.

4. WHY WE USE IT

• To perform our contract with you: operate accounts, cloud saves, multiplayer, leaderboards, purchases, delivery, recovery, and support.
• For legitimate interests: secure the service, prevent cheating, fraud and abuse, diagnose errors, enforce rules, and maintain reliable operations, balanced against your rights.
• To comply with law: tax, accounting, consumer, privacy, law-enforcement, dispute, and recordkeeping duties.
• With consent where law requires it, including an immediate digital-delivery acknowledgment at checkout.

5. PROVIDERS AND DISCLOSURES

Cloudflare provides hosting, asset delivery, network security, and multiplayer infrastructure. Supabase provides database, authentication, and server functions. Resend delivers account email. Google provides optional Google sign-in. Sentry receives filtered error and performance reports. Stripe and Link handle Managed Payments as merchant of record for eligible transactions, including checkout, tax, receipts, transaction support, fraud, refunds, and disputes. These providers process information under their own terms and privacy commitments. We may also disclose information when legally required or necessary to protect people, rights, and service integrity.

6. PUBLIC GAME INFORMATION

Your chosen display name and verified best times may appear publicly on leaderboards and to other multiplayer participants. Replay movement and equipped cosmetics may be shown to players who load the matching ghost, open a Share Run link, or join the same play session. A Share Run contains only the sharing racer's replay, not the other participants from its original multiplayer session. Your email address is not public.

7. COOKIES AND LOCAL STORAGE

The game uses a secure session cookie to keep you signed in. Browser storage remembers settings and preserves local progress and ghosts. We do not sell personal information, use behavioral advertising, or use a separate product-analytics service at launch.

8. RETENTION

• Account, cloud-save, entitlement, replay, and leaderboard data is kept while the account exists and is deleted or anonymized after account deletion, except where another period below applies.
• Purchase, refund, dispute, and accounting records may be kept for up to seven years, or longer if law or an active claim requires it.
• Routine security and server logs are kept for up to 30 days. Relevant records may be isolated and kept for up to two years when needed to investigate abuse, fraud, or an incident.
• Player reports, sanctions, and related evidence are normally kept for up to two years after resolution.
• Support communications are normally kept for up to three years after the request closes.
• Sentry error and performance events follow the retention period configured for our Sentry project and are not used for advertising.

Backups expire on a rotating schedule. Deleted information may remain in a protected backup until that backup expires, but it is not restored except for disaster recovery.

9. INTERNATIONAL TRANSFERS

Ideate LLC operates from the United States and uses providers that may process information in other countries. Where required, transfers rely on recognized safeguards such as adequacy decisions or contractual protections.

10. YOUR RIGHTS

Depending on where you live, you may request access, correction, deletion, restriction, objection, or a portable copy of personal information, and may appeal a denied request. Signed-in players can export and delete account data inside the game. You may also email privacy@surfultimate.com. We may verify your identity before acting. You may complain to your local privacy regulator. We will not discriminate against you for exercising applicable privacy rights.

11. CHILDREN

Surf: Ultimate is not directed to children under 13, and people under 13 may not create an account or use online services. If you believe a child under 13 supplied personal information, email privacy@surfultimate.com so we can investigate and delete it where appropriate. See the Age & Audience Policy.

12. SECURITY

We use access controls, separated staging and production systems, server-only payment and entitlement changes, encrypted transport, restricted logs, monitoring, backups, and incident procedures designed to protect information. No online service can guarantee absolute security. Report suspected security issues to security@surfultimate.com.

13. UPDATES

We may update this policy as the service or law changes. We will post the new date here and provide additional notice when required.

14. CONTACT

Privacy: privacy@surfultimate.com
Support: support@surfultimate.com
Mail: Ideate LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States.