Privacy Policy

Effective date: October 19, 2026

Surplus is an app that helps adults gain weight by eating enough, coached by an AI assistant in the app and over iMessage. Surplus is operated by Jayden Quaynor (“Surplus”, “we”, “us”). This policy explains what we collect, why, who helps us run the service, how long we keep it, and how to delete it.

1. Who can use Surplus

Surplus is only for adults aged 18 and over. During onboarding we ask your age and do not create a plan for anyone under 18. If we learn that someone under 18 has given us information, we delete it. If you believe this has happened, contact us at Jayden@viralinn.com.

2. What we collect and why

Account and contact details

• Name. Your first name from Sign in with Apple or your sign-in account, so the coach can address you.
• Email address. If you sign in with email, or the address Apple shares when you use Sign in with Apple (which can be a private relay address). Our sign-in provider, Clerk, holds your sign-in email. If you join the website waitlist, we also store that email with your waitlist entry (section 15). An app confirmation may temporarily hold its destination email in our delivery queue; that payload is cleared after the provider accepts it or delivery permanently fails. We share the email used for the app confirmation or requested waitlist messages with Loops, our email provider.
• Phone number. If you sign in with your phone number, and the number you text the coach from when you connect iMessage. We use it to deliver and receive coach texts.

Your profile, body and goals

Your onboarding answers: your goal (and, if you choose, your goal in your own words), current and goal weight, height, age, sex, activity level, training days and experience, your usual day (wake, sleep and training times), kitchen and transport access, eating habits, allergies and dietary restrictions, foods you like and won’t eat, preferred restaurants and grocery stores, budget, and how you want the coach to talk to you. We use these to calculate your calorie and protein targets and to coach you. We treat weight, body measurements, allergies and food intake as health information.

If you pick a school, we store which school it is so the coach and map can show that school’s dining hall menus. Dining hall menus come from the school’s public website and hold nothing about you.

Food log and progress

Meals and foods you log (in the app, by photo or by text), their calories and protein, weigh-ins, and the plan, streaks, missions and weekly reviews we calculate from them.

Purchases, when app billing is enabled

Apple and RevenueCat handle App Store membership purchases and access verification. We receive purchase or renewal status, product and transaction identifiers, and entitlement details so we can manage your access and avoid duplicate confirmations. The payment providers handle payment-account and card details; Surplus does not receive them.

For confirmed paid purchases, our analytics receives only a purchase or renewal category, general plan, billing provider and billing environment under a random analytics identifier. App purchase metrics use the account analytics ID; website purchase metrics use a separate random ID for each purchase. We do not export amounts, currencies, product or transaction identifiers, customer details or receipts to PostHog or Slack. Trials, restored access, a paywall view and a checkout click do not count as confirmed paid purchases.

Photos

When you take or choose a photo of a meal or a menu, we upload it to read what is on the plate or which dish to pick. Photos you take in the app go straight to us; Surplus does not save them to your photo library. A photo that is read is kept with the meal or chat message it belongs to so you can see it in your log. If you photograph what you didn’t finish so Surplus can lower a meal’s totals, that photo is deleted as soon as it has been read; we keep only how much was left. An uploaded photo that never gets read (for example, you closed the app mid-upload) is deleted automatically about 2 hours later. Choosing a photo from your library uses Apple’s photo picker, so Surplus only receives the photo you pick, never your library.

Messages with the coach

What you write to the coach in the app, what you text it over iMessage (including photos you text), and the coach’s replies. We keep the conversation so the coach remembers context and you can scroll back.

Location: your latest spot, kept for a day

Surplus uses your location only if you allow it, and only while you’re using the app. Nearby searches for places with Apple Maps on your phone. Surplus also sends our server your current location when you open the app, every few minutes while it stays open, and with each message you send the coach. The coach uses it to point you to the closest dining hall or food, including when you text it soon after closing the app.

• We keep only your latest location. Each new one replaces the last, and it is deleted a day after it was taken. We never keep a history of where you’ve been.
• If you’re at a campus dining hall during a meal, we count that day there, so the coach learns which hall you like. We keep those counts (the hall and how many days) until you delete your account.
• The AI model that writes the coach’s replies gets walking times to places, never your coordinates.
• To stop, turn location off for Surplus in iOS Settings. The app then asks us to delete your last location.

To suggest what to eat nearby, we send the names and cities of the places found. When you ask Surplus about a place, we also send that restaurant’s public website, so we look up the right menu; that question and the place are kept with your conversation. Apple handles the map search under Apple’s privacy policy.

Device, usage and diagnostic information

• Device identifier. Clerk’s sign-in software sends an app-specific device identifier (Apple’s “identifier for vendor”) and basic device details (model, iOS and app version) with sign-in requests, to keep your session secure.
• Product events. Our own records of key actions, such as creating a Surplus account, finishing onboarding, using meal logging or a message being sent. They are stored in our database under a random analytics ID. When PostHog is enabled, we send only approved action names, times, that analytics ID and limited labels such as whether an action happened in the app or over iMessage. The ID is stored with your Surplus account, so these records are pseudonymous rather than fully anonymous. PostHog receives no name, email address, sign-in identifier or account profile.
• First observed app open. When enabled in your iOS build, PostHog receives a first-open event with a random installation identifier, a random event identifier, time and deployment environment. The installation identifier is separate from your account and is never linked to Clerk, RevenueCat or the account analytics ID. An existing app upgraded to this instrumentation can report its first observed open, so this event is an installation proxy rather than proof of a new App Store download.
• Error records and crash reports. Our server keeps error records to fix problems; these internal records can include request context and may be tied to your account. When Sentry is enabled, it receives a separate, scrubbed report with a generic failure label and technical details such as the app release, time and code location. iPhone crash reports can include app and iOS versions, hardware model, and code addresses needed to find the crash. Reports sent to Sentry do not include a user, account or persistent session identifier.
• Information excluded from analytics and Sentry. We do not send meal contents, calories or macros, body weight or measurements, goals, coach messages, photos, email addresses, authentication credentials or precise location to PostHog or Sentry. An action name can show that you used a feature, but its nutrition values and content stay out of the exported report. Advertising identifiers, session replay, screen recordings and automatic capture of what you type are disabled.
• IP address and connection details. Our providers necessarily receive the network address a connection comes from and may process connection metadata under their own policies. Our analytics requests use a fixed non-user IP placeholder; PostHog is configured to discard IP addresses from analytics events and disable IP-based location enrichment. This does not prevent a service from receiving the source IP while handling a connection, and changing the setting does not automatically remove older records. We do not use those connection details to locate you.

What we don’t collect

• Your contacts. “Add Surplus to your contacts” opens Apple’s own contact card; you save it yourself and Surplus never reads your address book.
• Apple Health (HealthKit) data, your photo library, your microphone, advertising identifiers, or card and payment-account details.
• A push notification token. Reminders are scheduled on your phone by iOS.

3. How we use your information

• To run Surplus: create your plan, log your food, coach you in the app and over iMessage, suggest what to eat nearby, and show your progress.
• To keep it working and safe: sign-in and session security, preventing abuse and runaway AI costs (for example, daily limits on coach replies and photo reads), and fixing errors.
• To improve Surplus: limited product events and scrubbed diagnostics, such as how many people finish onboarding or which release has an error.
• To verify paid access when billing is enabled, count confirmed purchases and manage service activity through restricted operations notices.
• To confirm your account is ready after eligible app onboarding, send the waitlist emails you requested, and keep track of delivery and waitlist unsubscribe preferences.

We do not sell or rent your personal information, use it for advertising, share it for cross-context behavioral advertising, track you across other companies’ apps or websites, or use your health information for marketing. We don’t train our own AI models on your data.

4. How the AI coach works

To reply to you, the coach sends an AI model your message, recent conversation, your first name, the coach tone you chose, your goal and the day’s food and targets. When it needs them, it can also look up your food preferences, allergies and dietary restrictions, schedule, and recent weigh-ins. To read a photo, we send the image itself.

We send these through OpenRouter, a service that forwards each request to an AI model provider, such as OpenAI, Anthropic or Google. Those companies process the request to produce the reply under their own terms for API customers. Avoid including information you do not want processed by these services in your messages or photos.

AI can be wrong. Check calorie estimates that look off, and don’t rely on the coach for medical advice (section 11).

5. Who we share it with

We use the providers below to operate Surplus. They process information under their service terms and privacy policies. Only information needed for the relevant feature is shared.

If we look up a food in a public nutrition database (USDA FoodData Central) or search the web for a food’s nutrition (Perplexity) or a restaurant’s menu (through OpenRouter’s web search), we send only the food, or the restaurant’s name, city and website, never information about you. Restaurant menus we find are saved without any link to who asked and shared with everyone who asks about the same place.

We may also disclose information if the law requires it, to protect the safety of anyone, or as part of a merger or sale of the business (we would tell you first and this policy would continue to apply).

6. iMessage

Connecting iMessage is optional; you can keep everything in the app. If you connect it, you text a short code to the Surplus number from your phone, which links that number to your account and records that you agreed to receive texts. (If you signed in with your phone number, that number is linked automatically.) Surplus never texts you first: only after you have texted the Surplus number does the coach reply and send check-ins, by default at most 3 a day and never during your quiet hours.

• Text STOP to stop all texts. We confirm once and send nothing else.
• Text PAUSE to pause texts for a day, and START to resume.

Texts travel through Apple’s iMessage service and Photon. Message and data rates may apply.

7. How long we keep it

• While your account exists, we keep your profile, food log, weigh-ins, photos, conversation, product events and error records so the service works and your history is there.
• Unread photo uploads are deleted automatically about 2 hours after upload.
• Your latest location is deleted a day after it was taken.
• When you delete your account, we start erasing immediately (section 8). We keep one record that a deletion happened, with nothing that identifies you.
• Backups and provider logs may temporarily retain copies under the providers’ retention schedules. We do not promise immediate removal from every provider backup or log. Contact us for information about a deletion request.
• Our providers may keep request logs for a limited time under their own policies (for example, AI providers’ abuse-monitoring logs and Photon’s message delivery records).
• Analytics, diagnostics and email providers keep exported records under the retention settings and policies for those services. Email preferences or suppression records may remain to prevent messages you have opted out of. We clear temporary queued email payloads after the provider accepts them or delivery permanently fails.
• The local first-open marker stays in the app container when you sign out or delete an account, so those actions do not generate another installation event. Uninstalling removes that container; restoring a backup may preserve it. Its random identifier is independent of your account, including for a pending first-open upload.

8. Deleting your account

In the app, go to You > Delete account and confirm. We immediately sign you out, cut off access to your data and stop all coach texts. The backend erases your profile, plan, food log, weigh-ins, photos, conversation with the coach (including iMessage texts), product events and error records. The app also requests deletion of your Clerk sign-in account. If that request fails, the app tells you; contact support to finish deleting the sign-in record. Copies of messages on your device or recipients’ devices are not removed by account deletion.

Account deletion also removes queued account-linked integration deliveries and stops new exports for that account. Information already sent to PostHog, Sentry, RevenueCat, Loops or Slack is subject to those services’ retention and may require a separate provider-side removal step, including any waitlist contact notice in Slack. Contact us for help with that request. Deleting an app account does not by itself remove a separate website waitlist entry or the account-independent local first-open marker.

You can also contact Jayden@viralinn.com to request deletion. We may need to verify that the account belongs to you before acting on a request.

9. Your choices and rights

• See or correct your information. Most of it is in the app, and you can change your answers, log and plan there. For a copy of everything we hold, email Jayden@viralinn.com.
• Permissions. Camera and location are only used when you use those features. You can turn them off, and turn reminders off, in iOS Settings at any time.
• Texts. Text STOP at any time.
• App confirmation and waitlist emails. The app confirmation is a one-time service email after eligible onboarding; it does not subscribe you to waitlist updates or promotions. Waitlist emails include an unsubscribe link to stop future waitlist messages. For an email or privacy request, contact Jayden@viralinn.com. Unsubscribing from waitlist email does not delete your app account or turn off coach texts.
• Analytics and diagnostics. These service integrations send data only when enabled for Surplus. The app has no separate in-app analytics or crash-reporting switch. Email Jayden@viralinn.com with a privacy request; website analytics respects a browser’s Do Not Track setting.
• Delete. Section 8.

Depending on where you live (for example California, other US states, the UK or the EU), you may have rights to access, correct, delete or receive a copy of your personal information, to object to or restrict some uses, and to withdraw consent. To use any of them, email Jayden@viralinn.com. We will handle requests within the time required by applicable law and won’t treat you differently for asking. You can also complain to your local data protection authority.

10. Security

Data travels over encrypted connections (HTTPS/TLS). Account data is accessed through authenticated server functions. Photos may be served through storage links; treat those links as private. We use access controls to help protect data. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

11. Not medical advice

Surplus gives general nutrition and lifestyle guidance. It is not a medical device and does not diagnose or treat any condition. If you have a medical condition, an eating disorder, are pregnant, or take medication that affects your appetite or weight, talk to a doctor before changing how you eat.

12. Where your data is stored

Surplus is run from the United States, and our providers store and process data in the United States and other countries where they operate. Data may be processed outside the country where you live.

13. Changes to this policy

If we change this policy, we will update the effective date above, and explain significant changes through the app or another available contact method.

14. Contact

Questions, requests or complaints: Jayden@viralinn.com

Operated by Jayden Quaynor, United States.

15. The trysurplus.app website

The website collects a little information of its own, separate from the app:

• Waitlist. Your email address, the name you add if you reserve a spot, the tier you pick, your invite code and the code of whoever invited you, and how you found the page (the page address, campaign tags and the site that linked you). We use it to hold your place in line, count invites and tell you when Surplus is ready for you.
• Payments. If you become a Believer or Super Believer, Stripe takes the payment. Your card or wallet details go to Stripe, never to us. Stripe tells us the amount, whether it went through or was refunded, and the email you paid with, so we can mark your spot as paid.
• Welcome emails. Joining the waitlist requests its confirmation and access updates. Loops receives your email and the limited waitlist context described in section 5. You can unsubscribe using the link in those emails. Repeat submissions do not send another welcome.
• Waitlist operations. When Loops contact notices are connected to Slack, your waitlist email can appear in the Surplus team’s operations channel so we can manage signups. No coaching or nutrition data is included. Contact Jayden@viralinn.com for help removing your waitlist entry and associated provider records.
• Your browser. The page keeps a private token in your browser so you can come back to your own spot. When enabled, PostHog measures a small set of actions such as viewing a page or completing a waitlist signup. The analytics identifier stays in browser memory; we use no analytics cookies or persistent analytics storage and do not attach your waitlist email, invite code, form text or full page address to those events. Browser Do Not Track disables this website analytics.
• Website errors. When enabled, Sentry receives scrubbed technical error reports, such as a generic error type and JavaScript file location, without form contents, full URLs, cookies, request data or account information.

We do not use website advertising, cross-site advertising tracking or session replay.

To leave the waitlist, get a refund or ask what we hold, email Jayden@viralinn.com.