A quieter site should collect less.

Who is responsible

The Surface Today is operated by Aleksander Hurtley, who is the data controller for the processing described on this page. You can contact the operator at hello@surfacetoday.com.

No account or stored reading profile

The site does not require an account. The Surface Today's application code does not set cookies or use browser storage to remember your region or reading progress. Progress is held only in the open page's temporary memory and disappears when that browsing session ends. Your selected region is part of the page URL.

On the first visit after this change, the application deletes the legacy region cookie and reading-progress record created by an earlier version of the site.

Service delivery and security

Our hosting and infrastructure providers may process ordinary request information such as your IP address, browser details, requested URL, timestamps, and security events. This is necessary to deliver the site, prevent abuse, and keep it reliable. The legal basis is our legitimate interest in operating and securing the service.

The Surface Today does not maintain a separate visitor-log database. Provider operational records are retained according to the periods needed for delivery, troubleshooting, security, contractual obligations, and applicable law, then deleted or anonymized under the provider's retention practices. Exact infrastructure-log periods are controlled by the relevant provider rather than The Surface Today.

News generation

The News database contains stored leaderboard rows, source-link evidence, and reader presentations—not visitor accounts or reading profiles. Scheduled collection and optional brief writing are separate from reader visits: browsing information is never included in writing prompts.

Rejected candidate detail is kept for no more than 24 hours, and operational ranking diagnostics for no more than 30 days. Published briefs, their source-link evidence, and the minimum ranking record are kept while they are on the current surface and for up to 90 days after their last appearance. An active correction, privacy, rights, or safety review may place the related record on a limited hold until the review is resolved. The normal deletion period then applies. We do not retain article bodies, writing prompts, or failed generated drafts.

YouTube collection and playback

Scheduled generation uses the YouTube API Services to retrieve public chart and video metadata. It does not use visitor information, YouTube accounts, subscriptions, or viewing histories. The Surface Today stores the resulting public-metadata snapshots for no more than 30 days, then deletes them.

The YouTube player is not loaded when you open a list. If you choose Play here, your browser connects directly to YouTube and Google, which may receive ordinary request and playback information. That choice is also governed by The Surface Today's Terms, the YouTube Terms of Service and the Google Privacy Policy. You can review or revoke connected-account permissions in Google security settings; The Surface Today does not request YouTube account authorization.

Analytics and advertising

The Surface Today uses Cloudflare Web Analytics to measure aggregate visits, page views, loading performance, and broad traffic patterns. Its lightweight measurement beacon does not use cookies or browser storage, and is not used to build individual profiles, personalize the site, or serve advertising.

We use these aggregate measurements to understand whether the site is useful and to improve its reliability and performance. Cloudflare describes Web Analytics as privacy-first and says it does not collect or use visitors' personal data. The Surface Today uses no advertising trackers of its own. The official YouTube player may serve YouTube-controlled advertising after you choose to load it.

Service providers and international transfers

OpenAI provides site hosting, security, database operation, and scheduled brief generation. For hosted site data, OpenAI acts as a processor under the ChatGPT Sites Data Processing Addendum. OpenAI may use listed infrastructure subprocessors, including Cloudflare, to operate the service.

Cloudflare separately provides aggregate Web Analytics. Google and YouTube provide public chart metadata and, only after a deliberate play action, the video player. Site data, operational logs, or provider request data may be processed outside Norway or the EEA. Where required, applicable safeguards include an adequacy decision or standard contractual clauses.

External publisher and platform sites

Source and platform links open third-party websites. Their cookies, analytics, subscriptions, and privacy practices are controlled by them and are covered by their own policies.

Messages and requests

If you email us, we process your address, message, and related correspondence to answer and document the request. We normally delete or anonymize that correspondence within 90 days after the matter is resolved. We may keep it longer when a legal obligation, continuing dispute, or necessary defence of a legal claim requires that.

We aim to acknowledge privacy requests within one business day. Rights requests are answered without undue delay and within the applicable legal deadline; a complex request may require additional verification or time.

Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, or portability of personal data, or object to processing based on legitimate interests. Email hello@surfacetoday.com with the subject Privacy request.

You may also complain to the Norwegian Data Protection Authority.