Privacy Policy

This Privacy Policy explains how Surely collects, uses, stores, and protects your information when you use the app. By using Surely, you agree to the collection and use of information in accordance with this policy.

We collect the following categories of information to operate, secure, and improve the app:

We use collected information exclusively to:

Operate and maintain core app functionality  ·  Authenticate users and manage account sessions  ·  Enforce device binding limits and protect accounts against unauthorised access  ·  Send relevant push notifications  ·  Manage subscription status and unlock Pro features  ·  Improve app performance and user experience  ·  Serve and measure third-party advertisements (free tier users only)

We do not use your information for automated profiling, scoring, or any purpose beyond those described above.

To protect your account and prevent unauthorised sharing of credentials, Surely implements a device binding system. This section describes how it works and what data it involves.

Data collected for device binding:

For each registered device we store: the device identifier, the platform (iOS or Android), the app version at the time of registration, the timestamp of first registration, and the timestamp of the most recent authenticated request from that device.

Device limit: Each account may have a maximum of two simultaneously bound devices. If you attempt to bind a third device, you will be prompted to remove an existing device from the Manage Devices screen before proceeding.

Behaviour on logout: When you log out, your local authentication token is cleared. Your device identifier and its binding to your account are intentionally retained on our servers. This means that when you log back in on the same device, the existing binding is recognised and no new device slot is consumed. If you wish to permanently remove a device binding, you may do so from the Manage Devices screen in your account settings.

Device removal cooldown: To prevent abuse, a seven-day cooldown period applies after removing a device. During this period, no further devices may be removed from your account. The date on which the cooldown expires is stored locally on your device solely to display the correct date in the app interface; it is not transmitted to third parties.

Local persistence: Your device identifier and the cooldown expiry timestamp (when applicable) are stored in your device's local secure preferences. This data is not cleared when you log out, as it is required for device recognition upon your next login. It is cleared only when you uninstall the application or explicitly delete your account.

Subscription purchases are processed entirely by Apple. We do not store or have access to your payment card details.

For subscription pricing, billing frequency, and auto-renewal details, please refer to our Terms of Service.

Surely uses the following third-party services for advertising and analytics. These services operate under their own privacy policies and data processing agreements.

Subscribing to Surely Pro disables all third-party advertising. Advertising identifiers are not collected from Pro subscribers.

You may opt out of personalised ads at any time through your device settings (iOS: Settings → Privacy & Security → Tracking).

Data is shared only with service providers that are strictly necessary for app functionality, analytics, or advertising. All third-party providers are contractually required to handle data in compliance with applicable privacy laws and are prohibited from using your data for their own independent purposes.

Device binding data (device identifier and metadata) is stored exclusively on our own servers and is not shared with any third-party advertising or analytics services.

We may disclose information if required by law or in response to valid legal requests from public authorities, to the extent required and permitted by applicable law.

We retain your personal data for as long as your account remains active or as necessary to provide the services. Specific retention periods by data type:

Upon account deletion, all personal data associated with your account is permanently removed from our servers within 30 days, except where retention is required by applicable law.

We implement reasonable technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These measures include:

Encrypted data transmission via HTTPS/TLS for all client-server communication  ·  Authenticated API requests requiring both a valid bearer token and a verified device identifier  ·  Secure server infrastructure with access controls and monitoring  ·  Local storage of device identifiers in platform-native secure preferences (Android EncryptedSharedPreferences / iOS Keychain-backed storage)

No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

To exercise any of these rights, contact us at help@mertscript.com. We will respond within 30 days.

If we become aware that we have inadvertently collected personal information from a minor, we will take immediate steps to delete that information from our records and terminate the associated account.

We may update this Privacy Policy periodically to reflect changes in our practices or for operational, legal, or regulatory reasons. The "Last updated" date at the top of this page will always reflect the most recent revision.

For material changes — particularly those affecting how device data is collected or used — we will make reasonable efforts to notify you via in-app notification prior to the change taking effect. Continued use of the app following any update constitutes acceptance of the revised policy.

If you have questions, concerns, or requests related to this Privacy Policy or the handling of your personal data, please contact us: