Privacy

Last updated 22 September 2026

So Annoying! removes ads, cookie banners and other pop ups in Safari on your iPhone, iPad and Mac. This page says what stays on your device, what the app sends, why, and what you can do about it.

Who is responsible

I am Mikail Yenigün, a private person in Sweden, and I make and sell So Annoying! on my own. That makes me the controller for the personal data described here. You can reach me at support@soannoying.app.

The short version

• The blocking runs on your device. No page you visit is sent to me to do it.
• The app fetches block rules from my server. That request carries no account and no identifier.
• With the LEARNING switch on, the app sends short reports about what it removed or missed, so a fix can reach everyone. They carry a site name and a description of an element, never a page address, page text, your name or your email.
• Reports you send yourself can carry a note, a page path and an email address if you choose to leave one.
• Every report is deleted from my server 90 days after it arrived.
• No tracking, no advertising, no analytics kit, no third party code in the app.

What stays on your device

The block lists, the counts of what was removed, the names of the sites it happened on, the sites where you paused the app, your settings, and the rules the app learned from you. Safari applies the lists on your device and reports nothing to me for that.

If SYNC WITH ICLOUD is on, the app also keeps these in your own iCloud account through Apple's key value store, so your iPhone, iPad and Mac share them. Sync is on when you install the app. That is Apple's service under your Apple Account, not mine, and I cannot read it. You can turn it off in the app under Settings, then iCloud. The free plan's daily count is kept per device and never synced.

What the app sends

1. Rule updates. The app and its Safari extensions fetch block rules from soannoying.app, usually about once a day and whenever you open the app. The request carries no identifier, no account and nothing about you. If your device's languages match a regional list, the request names that list by its code. Our server runs on Cloudflare, which sees your IP address the way every web server does and keeps technical logs for a few days to run the service. I keep no record of who fetched the rules.

2. Learning reports. The LEARNING switch in the app, under Settings, then Learning, reads LEARN FROM WHAT I CLOSE. While it is on, the app learns from what you close and sends me short reports so the fix can reach every other user. The switch is on when you install the app, and you can turn it off at any time. A report can contain:

• the site name, for example example.com, and never the full address of the page
• what kind of thing it was, such as a cookie banner, an overlay or an ad
• a description of the element: its HTML tag, its id, up to three of its class names, its role, its label cut to 80 characters, and a selector that points at it
• what happened: you closed it, it got through, you put something back, or a rule of mine stopped matching
• when a rule of mine stopped matching: which of my own rules were active on that site, which version of the rules your device ran, and on how many days and how many times the same thing was seen
• the address of an advertising server, when an ad came from one
• a random identifier the app made when it was installed

The identifier lets me count how many devices saw the same thing, so one device cannot outvote everyone else. It is a random string. It is not tied to your Apple ID, your name, your email, your phone number or your advertising identifier. Deleting the app deletes it, and a reinstall makes a new one.

A report never contains the text of the page, what you typed, cookies, passwords, page HTML, or the address of the page beyond the site name. Our server checks every report and refuses anything that does not fit this shape. It does not store your IP address with the report.

Turning the switch off withdraws your consent. The app then sends no new learning reports. What it learned stays on your device and keeps working there.

3. Reports you send yourself. You can report a site from the So Annoying! button in Safari's toolbar, from the share sheet, or from REPORT in the app. These go when you press send, whatever the LEARNING switch says, because you are the one asking. A report you send contains the site name, whether something got through or the site broke, and what the app saw on the page in the shape described above. It can also contain, if you choose:

• the path of the page, for example /news/today. The toolbar button and the share sheet include it unless you remove it. A query string or anything after a hash never leaves your device, because that is where a session or a search lives.
• a note you write, up to 1000 characters
• an email address you leave in the share sheet, if you want a reply
• the app's own status lines: app version, system version, rules version, which switches are off, and whether the plan is free or Unlimited

A report with a note or an email address is also mailed to me, so I can fix the site and reply if more is needed. You are only contacted if more is needed to fix it. The email address is never used for anything else.

4. Counters. For every report the server adds one to a counter per site and per kind. The counters carry no identifier.

5. Purchases. Apple handles every purchase. I never see your payment details, and Apple gives me no name and no email address. Apple tells the app whether Unlimited is active. The app sends nothing about your purchase to my server.

What I do with reports

I use reports to build and rank blocking rules. A rule that enough devices agree on goes into the lists every device fetches. A rule made this way keeps the site name and the selector and nothing else. I do not sell reports, share them with anyone, or use them for advertising.

Legal basis

Learning reports are sent with your consent, given by leaving the LEARNING switch on. Reports you send yourself are sent with your consent, given when you press send. Fetching the rules is needed to provide the app you asked for. Where any of this is personal data at all, that is the basis for it.

How long I keep it

Every report is deleted from my server 90 days after it arrived. A rule built from reports has no identifier and stays as long as it is useful. The mail with your note and email address is deleted once the fix has shipped. Cloudflare's technical logs of the connection are kept for a few days.

Who processes it

Cloudflare, Inc. hosts the server, the database, the queue and the mail relay. Data is processed on Cloudflare's network, which may include locations outside the EU, under Cloudflare's data processing terms, which include the EU standard contractual clauses. Apple handles purchases and iCloud under your own agreement with Apple. Nobody else receives anything. The app contains no analytics kit, no advertising kit and no third party code.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its use, and to receive it in a portable form. Write to support@soannoying.app.

One thing to know first. Learning reports carry only the random identifier, and I do not know which identifier is yours. I cannot pick out one person's reports, even when asked. Deleting the app deletes the identifier, and every report is gone within 90 days in any case. If you left an email address in a report, I can find and delete the reports that carry it. Ask, and I will.

You can also complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten, at imy.se.

Children

The app is not directed at children and collects nothing that identifies a person.

Changes

When this page changes, the new text appears here with a new date at the top. The app's own screens say the same thing as this page, and if one changes, the other does too.