Cookies policy

This Cookies Policy explains how UpgradIQ, Inc. (which owns and operates Surfil) uses cookies and similar technologies on surfil.com. It should be read together with our Privacy Policy.

1. What cookies are

Cookies are small text files placed on your device when you visit a website. Similar technologies, including local storage, session storage, and pixel tags, are used for related purposes. We refer to all of these collectively as “cookies” in this Policy.

2. Categories we use

Strictly necessary

Required for the site to function. These cookies cannot be disabled. They include:

• Sign-in session: set by our authentication provider, Supabase, when you sign in, so you stay signed in. It is removed when you sign out.
• Audience preference: if you open one of our pages for founders, growth managers or marketing managers, a cookie called uiq_for remembers which, for 30 days, so sign-up can start from the right place. It holds one word, is never used for tracking and is never sent to other sites.
• Display preference: your light or dark choice, kept in your browser’s local storage and never sent to us.
• Abuse prevention on forms: we do not run a CAPTCHA and set no cookie for one. Form submissions are protected by a rate limit counted against your IP address and by a hidden field that a real person never fills in. Neither one of these identifies you personally.
• Stripe checkout cookies: session and security tokens set by Stripe during the payment flow. Required to process your payment securely. These are set and controlled by Stripe and are governed by Stripe’s Privacy Policy.
• Device id: a random identifier in a cookie called uiq_dev, shared across surfil.com and its sub-domains and kept for 1 year. We use it to limit how many devices share one account. It holds no personal data, and we never use it for advertising purposes.
• Device check: uiq_dok is a signed stamp, kept for 10 seconds, that tells our servers this device was not revoked a moment ago, so they do not ask the database on every request.
• Support session: when our team opens your account at your request to help you, uiq_support marks that session. It lasts 4 hours and is removed when the session ends.
• Current workspace: uiq_business remembers which of your workspaces you have open. It holds one workspace id and is kept for 1 year.
• Invite link: uiq_invite_link carries a team invite link to the page that shows it once, and is kept for 5 minutes.
• Google connection: g_oauth_state guards the step where you connect Google Analytics or Search Console, so the answer can only come back to the browser that asked. It is kept for 10 minutes.
• Region preview: geo_country is read only for signed-in team sessions that preview another country’s pricing. We do not set it for visitors, and it lasts for the browser session.

Performance and analytics

We measure this site with the same first-party tag we offer our customers, served from px.upgradiq.com. It sets no cookies and writes nothing to your device storage, does not follow you to other sites, and sends nothing at all when your browser has Do Not Track or Global Privacy Control turned on. It records page views, page speed and script errors, and uses no advertising identifier or cross-site tracking identifier.

On surfil.com we also use Mixpanel for product analytics. It sets no cookies. It keeps a random identifier in your browser’s local storage (your account id once you sign in) and records the pages you view and a few key actions, never your name or email address. This in-browser analytics does not run when your browser has Do Not Track or Global Privacy Control turned on, and it uses no advertising or cross-site identifier. A few account events (checkout, trial, payment, cancellation and first score) are recorded by our servers, not in your browser. They describe your account, not your visit, so that signal does not change them.

To compare two versions of a page we set a cookie called uiq_ab. It holds a random id that decides which version you see, for 90 days, and no personal data. It is never sent to other sites, and it is not set when your browser has Do Not Track or Global Privacy Control turned on.

We do not run Google Analytics, the Meta Pixel or any advertising cookies on this site.

Error monitoring

We use Sentry to record errors so we can fix them. Sentry as we run it does not set cookies. When an error occurs it may record a short session replay, which is held in your browser’s own storage for that session rather than in a cookie, and personal fields are stripped from what is sent to Sentry.

3. Third-party services

The following service providers may set cookies or similar identifiers through the site:

• Rate limiting: abuse prevention on form submissions (strictly necessary). No CAPTCHA cookie is set.
• Stripe: payment session and security tokens during checkout (strictly necessary).
• Sentry: error monitoring that does not set any cookies on your device.

Each of these providers maintains its own cookie and privacy policy. Links are available on request.

4. Managing your preferences

You can control or block cookies in your browser settings. Note that blocking strictly necessary cookies may break parts of the site, including the ability to submit forms or complete a purchase. You can also request deletion of any data tied to cookies we have set by emailing hello@surfil.com.

5. Changes

We may update this Cookies Policy as our use of cookies changes. The “Last updated” date above reflects the most recent substantive change.

6. Contact

Questions about this Policy may be directed to hello@surfil.com.