Privacy Policy

What SURAYA is

SURAYA is an anonymous, text-first social client on Nostr. There is no SURAYA account system: your account is a cryptographic keypair. You do not need an email address, a phone number, or an ID to create an account, and SURAYA does not ask for any of them.

What we do not collect

The SURAYA client sends no analytics and loads no third-party scripts. It does not store your IP address or your private key on any SURAYA server, because today there is no SURAYA server that holds accounts: the app runs in your browser and talks directly to relays you choose.

Your key, in your browser

If you create or import an account with a passphrase, your private key is stored in this browser encrypted under that passphrase (NIP-49). Without a passphrase, the key lives in memory only until you log out or reload. Signing out clears the in-app session, but a stored encrypted key remains until you use “Delete all local data” in the Account tab, which removes all SURAYA local data from this browser.

There is no account recovery. If you lose your private key and your passphrase, the account is gone, and no operator can restore it, because there is no operator account system to restore it from. Do not share your private key or your passphrase with anyone.

What stays in your browser only

The following are stored locally, per account, in this browser, and are not published to relays as plain data: your theme and navigation style, your learned feed weights and whether learned ranking is on, your muted and saved lists, the authors you have liked, your browsing history in the app, your composer drafts (text only — media attachments are not saved across reloads), your relay list, your media-server list, and which notifications you have already seen.

Two exceptions travel, encrypted only: settings sync and catchphrase transfer. Settings sync publishes a small settings bundle as ciphertext to your relays (kind 30078, “suraya-settings-v1”), encrypted to yourself. Catchphrase transfer publishes a bundle of your local data as ciphertext (kind 30078, “suraya-transfer-v1”), encrypted under a 24-word catchphrase you create. In both cases a relay sees ciphertext only, never your preferences, history, or a private key in plain text, and a raw private key never travels at all.

What is published to relays

Everything you post is public by design: posts and replies, reposts, likes, follows, your profile (name, bio, picture URL, website, and links), reports, and deletion requests. They are signed events tied to your public key, and any relay that receives them can keep a copy. A deletion request asks relays to delete a post; it is not a guarantee that every relay will do so, and other relays may still hold copies.

Media you attach is uploaded to a Blossom media server you choose, not to a relay. The file is public to anyone with its URL, and deleting a post does not delete the file from the server. Before upload, JPEG, PNG, and WebP images are re-encoded in your browser to strip EXIF and other metadata; GIF and video are not re-encoded, so their metadata may survive — check a file before posting it if that matters to you.

What relays and network observers can still see

SURAYA does not promise untraceability, permanent deletion, or account recovery — all three would be false for a Nostr relay system. Today, SURAYA’s own relay is not yet deployed, so the app connects by default to third-party relays (currently relay.damus.io and nos.lol, which you can change in the Relays tab). Those relays’ own privacy policies also apply, and a relay you connect to directly can see your IP address.

The frontend is served over the network, so Cloudflare and your internet provider can still see that a connection happened, even though the client sends no analytics. For higher-risk situations, use Tor or a VPN, a separate browser profile, and never link your SURAYA key to your real identity.

Children

SURAYA does not ask for your age and does not enforce an age gate today. That is a limitation, not a protection: there is no age verification in the app today, and this point must be decided by the operator before a public launch.

Changes to this policy

If this policy changes, the new version will be published on this page. The effective date above must be updated at the same time. Nothing in this policy changes what is already public on relays: posts already published cannot be made private by a policy change.