Privacy, in plain language.

Effective September 12, 2026. SurfRewind is published by Rightek I.T. Services Ltd. Direct Windows theme purchases are sold by Brad Simpson operating as SurfRewind. This notice describes the Windows and TV apps, this website, our theme-account service and testing programs.

Your library stays yours.

SurfRewind connects to Plex, Jellyfin or Emby servers you select to sign in, read your permitted libraries and play media. Plex and those server operators receive the account credentials or access tokens, app-generated client identifiers, library requests and playback-status requests needed for these features, under their own policies. Jellyfin and Emby passwords are sent to your chosen server for sign-in; saved access uses the returned token. SurfRewind does not provide or host your movies, shows or commercial collection.

The Windows app keeps its library catalog, settings, saved looks and connection information on your PC. Plex credentials stored by the Windows app are protected using Windows-backed encryption. Local commercial files are read from the folder you choose, not uploaded to SurfRewind.

Website downloads and updates.

Cloudflare hosts this website and our downloads. Requests necessarily include technical information such as your IP address and browser or app request headers. Cloudflare processes request information to deliver and protect these services.

We count installer download requests by date and release filename. These aggregate counters do not store IP addresses, email addresses or device identifiers, and are not a count of unique people or installations. By default, Windows checks our download service shortly after opening and every six hours while running. You can disable automatic checks in Settings → Windows updates, or check manually there. Checks do not download or install an update without your choice, and do not upload your library or viewing history.

This website does not use advertising trackers or a third-party marketing analytics script. The Windows beta has no automatic crash-report or viewing-history upload to us.

The homepage promo uses a click-to-load YouTube player in privacy-enhanced mode. We do not load that player until you select it. After loading, your browser connects to YouTube/Google, which processes technical and playback information under Google’s privacy policy. You can browse the rest of the site without loading the player.

Purchases and email.

You do not need a SurfRewind account or payment details to use the free app. Optional Windows purchases use a separate email account so they are not tied to a particular media server. We store your email, an account identifier, hashed sign-in sessions, purchase and refund records, and the theme entitlements needed to restore your extras. The app keeps its session and signed ownership proof locally, with Windows-backed protection for the saved account session.

Cloudflare hosts this account service and database. Resend delivers sign-in codes to your email address; requesting a code does not subscribe you to marketing. Codes expire after 10 minutes, sessions after 30 days, and expired codes, sessions and temporary abuse-prevention counters are cleaned up on a scheduled basis. Rate-limit counters use keyed hashes rather than raw IP addresses. These providers also process technical request and delivery information under their own policies, potentially outside your country.

Stripe hosts payment entry and processes your card, billing information and transaction. We do not receive or store your full card number or security code. Our service checks Stripe transaction identifiers, amounts and purchase or reversal status before granting themes. We retain purchase records as needed to restore purchases, handle disputes and meet legal recordkeeping duties. You can request account deletion at the support address below; required transaction records may need to remain, and deleting an account may prevent future purchase restoration.

General newsletter signup is not enabled. You can separately opt in to Apple TV testing and release updates after verifying your email. We store that choice, its consent version and dates against your SurfRewind account in Cloudflare’s database. Signing in or purchasing never subscribes you. Visit Apple TV updates, sign in, uncheck the box and save to leave the list. You can also contact support to withdraw consent or request deletion. We keep the preference record until you request deletion; opting out stops these updates without deleting purchases.

Sign-in and purchase information is not used for advertising or automatically added to an email list. See Cloudflare’s privacy policy, Resend’s privacy policy and Stripe’s privacy policy for their processing.

Fire TV, Android TV and Google TV.

The TV apps keep library metadata, preferences and media-server linkage on the device. Saved connection credentials use Android Keystore-backed encryption. Requests to your selected media service include the information described above; SurfRewind does not upload your library or viewing history to our own service. Remote internet connections require HTTPS; a server you choose on your private local network can use HTTP.

Amazon and Google handle their respective store accounts, product listings and payment entry. When a store purchase feature is enabled, the app sends the product and purchase receipt or token to our Cloudflare-hosted verification service. Amazon verification also uses the Amazon user identifier. We check ownership with the relevant store and return signed theme entitlements. Purchase identifiers or hashes and purchase, refund or revocation status are used to verify and restore access; temporary hashed request identifiers help prevent abuse. We do not receive your full payment-card details. Store processing is covered by Amazon’s privacy notice or Google’s privacy policy.

Request deletion or contact us.

To request deletion of SurfRewind account data, purchase-verification records or support correspondence, email info@rightek.ca with the subject “SurfRewind data deletion” and identify the account or request you want removed. Do not send passwords or purchase tokens. We may need to verify that the request is yours. We delete information we no longer need; transaction records required for legal, accounting or dispute obligations may be retained for the applicable required period. Media-server and app-store accounts must be managed with their providers as described below.

If you email support, we receive your email address and the information you choose to send. We use it to respond and investigate your request. Please do not send passwords, Plex tokens, link codes or payment details. You can ask us to delete support correspondence, subject to records we need to keep for legal or security reasons.

You can disconnect your media server in the app and revoke its app access through the provider or server administrator. Clearing the TV app’s storage in device settings removes local SurfRewind data and requires linking again. Uninstalling Windows SurfRewind preserves its local data so reinstalling or upgrading does not erase your setup. To remove that data too, close SurfRewind and remove the SurfRewind Desktop folder under your Windows account’s AppData\Roaming folder. This does not delete an Amazon, Google, Plex, Jellyfin or Emby account, or the provider’s records; use that provider’s account controls for those requests. Contact us if you need help.

Questions or privacy requests: info@rightek.ca.