The platform
Not a clone. A stack incumbents cannot retrofit.
Surf is not a feed with a few extra features. It is a full-stack social platform that ships, in one app, what the incumbents ship one of at a time.
Nine product categories. One graph.
Each of these is its own market. Incumbents ship one of them well. Surf ships all of them, wired together.
A feed you control
An auditable ranking engine with no ad slot, driven by user-facing sliders and plain English.
On-device AI
20-plus wired features, with privacy-sensitive inference running locally at zero server cost.
A creator studio
An in-browser multi-track editor, AR camera, and a 47-tool editing agent.
Encrypted messaging
A hand-built Signal-protocol stack, end-to-end encrypted on every DM by default.
Peer-to-peer calls
1:1 calls over DTLS-SRTP where Surf servers cannot access the media.
Live streaming
Browser-to-edge go-live with sub-second latency and Super Chats.
Owned communities
Spaces with their own ranked feed, roles, and audit-logged moderation.
Family safety
Teen defaults enforced in Postgres, and an encryption-preserving on-device risk scanner.
Three payment rails
Platform subscriptions, creator fan subs, and brand-deal escrow, all live.
The barrier to entry is engineering depth
Depth you can count.
lines of code
Postgres tables
database functions
migrations
passing tests
locales
Row-level security on every table, a 603-migration history that reads like a security-hardening changelog, pgvector semantic search shared across feed and search, and an 84 of 100 platform-health audit with a 90 on security.
An auditable ranker with no ad slot.
The complete production ranking function ships as readable, committed SQL, single-sourced with the client and guarded by parity tests. A user-controllable, inspectable ranker is very hard to retrofit onto an ad-funded engagement model, and the plain-English control can only emit the same bounded knobs a user could set by hand.
Signal-grade encryption, hand-built.
X3DH, Double Ratchet, and Sender Keys across 20 crypto modules over audited primitives, with correct multi-device fan-out and fail-closed sends, backed by 60 crypto tests. 1:1 calls are peer-to-peer, so the media never touches a Surf server. This is a class of engineering no feed-based social app matches.
Hybrid AI at zero billed cost.
Three quantized models run in the browser to keep private work on the device, while a server brain handles heavy synthesis. A token-and-cent usage ledger and a priority budget governor shed background work near free-tier ceilings, which is why more than 20 AI features run at nothing billed on free plans.
Trust enforced in the database.
Row-level security on roughly 180 tables, 306 fail-closed security-definer functions, teen-safety policies that unsafe rows cannot bypass on any query path, and an on-device DM risk scanner that can alert a guardian without the platform or the parent ever reading the message. The audit scored security 90 of 100.
Three revenue rails, already live.
The model does not depend on advertising at all. An ad model would break the product.
Platform subscriptions
$10 / $20 / $40
Three tiers on one Stripe customer, with webhook multiplexing and trial-farming defense.
Creator fan subs
20% fee
Creators price their own tiers, paid out through Stripe Connect.
Brand-deal escrow
8% take
Below the 10 to 20% market, capturing spend that incumbents leak off-platform.
The two things Surf leads with are the two things an ad-funded incumbent cannot copy without breaking its own business model.
A feed the viewer controls, and encryption by default. They are also the exact things regulators keep demanding. Surf ships them as the default, not under pressure.
What is not done yet.
Honesty is part of the thesis. A selective forwarding unit for larger group calls is built but not yet on the call path. Annual billing is configured in code and waiting on payment setup. The business tier is live and still maturing. We would rather tell you than let you find out.