Privacy
Say It Big is built by bypop as a tool that works entirely on your device. The short version: the app has no account, no analytics and no server of its own, so nothing you type or draw ever leaves your phone.
This website is a separate matter, and the honest answer is shorter than the section below. It uses Google Analytics to count page views - but only if you accept the cookie banner. Decline it, or ignore it, and the analytics script is never loaded, no cookie is set and Google is never contacted.
- App: Say It Big, for iOS and Android.
- Website: sayitbig.bypop.dev
- Contact: hello@bypop.dev
Who is responsible
The data controller, within the meaning of Article 4(7) GDPR, is Kamil Popczyk, an independent developer operating as bypop (działalność nierejestrowana), based in Poland. Contact: hello@bypop.dev.
There is no Data Protection Officer, because no personal data is processed on a large or systematic scale. This policy covers both the app and this website.
The app
- There is no account, no sign-up and no profile.
- There is no analytics SDK in the app and no telemetry of any kind. The website analytics described below runs on the website only, and never in the app.
- Say It Big has no server, and the app makes no network requests of its own. The single exception is the store purchase described below: unlocking or restoring Pro talks to Apple or Google about the purchase, and nothing else. What you type or draw is never part of that exchange.
- Your banner text, your drawings and your settings are written to your device's own storage. They are not sent anywhere, and deleting the app removes them.
- The app asks for no location, camera, microphone, contacts, photos or files - ever. On Android it declares four permissions, none of which you are prompted for: internet access and the billing permission, both used solely for the Pro purchase, a check for whether you currently have a connection, and vibration for the small taps you feel when you press a control. Android adds one more of its own accord, which exists only to stop other apps reading this app's internal messages.
- On iOS there is a single prompt, and only when you first put a sign up full-screen: permission to read device motion. It works out which way up the phone is, so the sign turns the right way round even with rotation lock on - which is the normal state of a phone being held over someone's head. The readings drive that and nothing else. They are not recorded, not stored and not sent anywhere.
- Keeping the screen awake and raising the screen brightness while a sign is up need no permission on either platform. Brightness is changed for the app's own window and is handed back when the sign is closed.
Backups on Android
Android's own Auto Backup is switched on for this app, which is how your saved banners can reappear when you set up a new phone. That backup is made by the operating system into your personal Google Drive, under your Google account. We never see it, and it is not sent to us or to anyone else. You can switch it off for this app in Android Settings, under Google and then Backup. iOS device backups behave the same way and belong to your Apple account.
Purchases
The Pro unlock is a one-time purchase handled by Apple and Google. The payment runs entirely inside the App Store or Google Play. We never see your payment details, and the app only ever learns whether the purchase exists so it can unlock the paid features and restore them on your other devices.
Apple and Google process that transaction under their own privacy policies, and the aggregate sales and install figures they show us in App Store Connect and Play Console cannot identify an individual person.
This website
- The site is served by Cloudflare, which processes standard request data such as IP address and user agent in order to deliver the page and protect it from abuse. That is infrastructure logging, not something we collect for our own use. Legal basis: legitimate interests, Article 6(1)(f) GDPR.
- The fonts are served from this domain rather than from a font CDN, so no font provider learns which pages you read.
- There are no forms, so there is nothing to submit.
- Google Analytics is the only third-party script on the site, and it is off until you accept it. See Cookies and analytics below.
Cookies and analytics
This website uses Google Analytics 4 to count page views and see which pages people actually read. It is the only third-party script here and the only thing on this site that sets a cookie.
Nothing analytics-related runs until you accept it. On a first visit the consent banner appears with Google Consent Mode set to denied. If you decline, or simply leave the banner alone, the Google Analytics script is never downloaded, no analytics cookie is set, and no request is made to Google.
If you accept, the script loads and sets two cookies to tell one visit from the next: _ga, which distinguishes visitors, and _ga_ZQCB8Q3C43, which holds the session state. Both last up to two years. They are set by Google Analytics in your browser and are not read by us for any other purpose.
Advertising storage, ad personalisation and ad user data stay denied permanently, whichever way you answer. There is no advertising on this site and no ad profile is built from your visit.
If you accept, Google Analytics receives the page you viewed, the page that referred you, an approximate location derived from your IP address, and your device and browser type. Google Analytics 4 does not store your full IP address. It never receives your name, your email, or anything you typed - there is nothing on this site to type into.
Two legal bases apply, because two different things are happening. Storing and reading anything on your device is governed by Article 399 of the Polish Prawo komunikacji elektronicznej (in force since 10 November 2024, replacing Article 173 of the former Prawo telekomunikacyjne), which requires your prior consent and covers local storage and device fingerprinting as well as cookies. Processing the resulting data is governed by Article 6(1)(a) GDPR - again, consent. Article 402 of the same Act ties the standard of that consent to Articles 4(11) and 7 GDPR: freely given, specific, informed, unambiguous and withdrawable.
You can withdraw consent at any time using the Cookie settings link in the footer of any page, which reopens the banner so you can decline. Withdrawing is exactly as easy as giving it, as Article 7(3) GDPR requires, and declining stops further collection immediately. Withdrawal does not affect the lawfulness of anything processed before you withdrew.
Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) acts as our processor for this data, so it is transferred to the United States. Google LLC is certified under the EU-US Data Privacy Framework, an adequacy decision under Article 45 GDPR, and additionally relies on Standard Contractual Clauses under Article 46(2)(c) GDPR.
Your answer to the banner is remembered by your own browser in its local storage, under the name sayitbig_consent_v1. It is not a cookie, it is never sent to us, and it never leaves your browser. Writing it does not itself need consent: it falls under the exemption in Article 399 for storage that is necessary to deliver a service you asked for, because a refusal cannot be honoured on your next visit unless it is remembered. Clearing your site data makes the banner ask again.
Third parties
Four, and no others. Apple and Google process the Pro purchase as described above, each under its own privacy policy. Cloudflare hosts this website. Google Analytics receives website usage data, and only from visitors who accepted it. No advertising network and no data broker receives anything from the app or the site.
Your rights
Under the GDPR you have the right to access, correct, erase, restrict and object to the processing of your personal data, the right to data portability, and the right to complain to a supervisory authority.
In Poland that authority is the Prezes Urzędu Ochrony Danych Osobowych: Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, telephone +48 22 531 03 00, kancelaria@uodo.gov.pl. If you live elsewhere in the EEA you may instead contact the supervisory authority where you live; in the United Kingdom it is the Information Commissioner's Office.
Where we rely on your consent for website analytics, you also have the right to withdraw it at any time, without affecting the lawfulness of what happened before you did. Cookie settings, in the footer of any page, is that mechanism.
In practice there is very little else for these rights to reach. We hold no accounts and no database, so we have nothing on file to send you, correct or delete. Anything the app stores is on your own device, under your control, and is deleted when you delete the app. If you want to exercise a right anyway, write to hello@bypop.dev.
If you are in the United States: we do not sell personal information and we run no advertising. Some state laws treat the use of an analytics provider as sharing. If you would rather that did not happen, decline the cookie banner, or use Cookie settings in the footer to withdraw a previous acceptance.
Data retention
We keep no database of our own. Data the app stores stays on your device for as long as you keep the app installed, and we receive none of it. Cloudflare's infrastructure logs are kept on its own schedule as part of serving and protecting the site. If you accepted analytics, Google retains the event-level data for the retention period set on the property, which for a property of this kind is at most 14 months; after that only aggregate reporting remains.
Children
Say It Big is not directed at children under 16, the age Poland has set under Article 8 GDPR for consenting to an information society service, or under 13 in the United States under COPPA. The app collects no personal data from anyone, of any age. This website's analytics is not aimed at children either, and it does not run at all unless it is accepted. If you believe a child has consented to analytics here, write to us and we will deal with it.
Changes
If this policy changes, the date at the top of this page changes with it. The app collects nothing, so a change here will usually concern the website rather than the app.
Contact
Questions about privacy: hello@bypop.dev.