Privacy policy
This policy explains what data the Say It app (iOS and Android) processes, why, for how long and what rights you have, under Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003.
1. Data controller
Orkida Mancini Mesi, private individual, Italy. Contact: kida.mancinimesi@gmail.com. No data protection officer (DPO) has been appointed, as it is not required.
2. What data we process
| Category | Data | Source |
|---|---|---|
| Anonymous profile | Random technical account ID; nickname; year of birth; country; gender; posting preference (with nickname or anonymous); language; notification preferences | You, when you start the app |
| Recovery code | Stored only as a non-reversible hash: not even we can read it | Generated by the app |
| Content | Posts and updates (text, recipient, topic, duration, sharing choices), their automatic translation, reactions and support messages you send, stories you follow, users you hide, reports (reason and optional details) | You |
| Moderation outcome | Post status (published, under review, removed), category and short note from the automatic check, reason for any removal | Generated by the service |
| Reads | Which posts you opened, only to count them once in "Most read" | Generated by the app |
| Notifications | In-app notifications; device token for push notifications (only if you enable them) | The app and the operating system |
| Anonymous statistics | Usage events (e.g. "post published", "story read"), app version, operating system, language, random installation ID. Never texts, nicknames or post IDs; for searches only their length | Generated by the app |
| Advertising | Consent choices; the device advertising ID (on iPhone only if you allow tracking); technical data needed to show and measure ads | Google AdMob, from the device |
Special category data. A post may contain information about your health, sex life, religious beliefs or other "special category" data (Art. 9 GDPR). We don't ask for this data: you decide what to write. Please don't include information that could identify you or others. Phone numbers, emails and full names are blocked automatically.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service: anonymous profile, posting, reading, reactions, follows, in-app notifications, profile recovery, automatic translation | Performance of the contract (Art. 6(1)(b)) — the Terms of use. For posts containing special category data: data manifestly made public by you by posting (Art. 9(2)(e)) and your explicit consent expressed by posting (Art. 9(2)(a)) |
| Content moderation, security, abuse and spam prevention, handling reports | Legal obligations (Regulation (EU) 2022/2065 "DSA", Art. 6(1)(c)) and legitimate interest in a safe environment (Art. 6(1)(f)) |
| Showing help resources when a post suggests danger | Vital interest (Art. 6(1)(d)) and legitimate interest |
| Push notifications | Your consent, given through the operating system (revocable in settings) |
| Anonymous statistics to improve the app | Legitimate interest (Art. 6(1)(f)); the data is not linked to your identity |
| Personalised advertising | Your consent (Art. 6(1)(a)), collected with Google's form; without consent you only see non-personalised ads |
| Sharing posts you authorise on Say It's social pages | Your consent, given post by post (revocable) |
| Security backups | Legitimate interest in service continuity |
We don't take decisions based solely on automated processing that produce legal effects on you: the automatic check may block a post or put it under review, but you can always rephrase it, delete it or appeal a removal by writing to us (see Community rules).
4. Who sees it
- Other users see your published posts with nickname, age and country, or with no data at all if you post anonymously. They never see who reacted, who follows a story or who reported.
- The moderator (the controller) sees posts under review or reported, with the author's nickname, to decide whether to publish or remove them.
- The providers listed below, processing data on our behalf (processors) or, for advertising, as independent controllers.
| Provider | Service | Where |
|---|---|---|
| Supabase Inc. | Database, anonymous accounts, server functions | European Union (Ireland) |
| OpenAI, L.L.C. | Automatic check and translation of posts (text and recipient, no profile data); data sent via the API is not used to train models | United States |
| Google Ireland Ltd / Google LLC | AdMob (advertising) and consent form; Android notification service | EU and United States |
| Apple Inc. | iPhone notification service | United States |
| 650 Industries (Expo) | Push notification delivery | United States |
| PostHog Inc. | Anonymous statistics | European Union |
| GitHub Inc. | Storage of encrypted backups | United States |
| Cloudflare Inc. | This website and the moderation panel | EU and United States |
| Meta Platforms Ireland Ltd | Say It's Instagram and Facebook pages, only for posts you authorise to share | EU and United States |
Transfers outside the EU. Transfers to the United States are based on the EU-U.S. Data Privacy Framework for certified providers, or on the Standard Contractual Clauses approved by the European Commission (Arts. 45 and 46 GDPR).
We do not sell or give your data to third parties for their own purposes. We may disclose it to authorities only where required by law.
5. How long
| Data | Retention |
|---|---|
| Profile and content | Until you delete your profile from the app. Deletion is immediate and permanent |
| Posts with an expiry | Until the chosen expiry (10 days, 20 days, 1 month, 1 year or never); afterwards they stay visible only to you for 30 days, then they are deleted |
| Reads | 30 days |
| In-app notifications | 90 days |
| Decided reports | 12 months |
| Log of automatic checks (no texts) | 13 months |
| Encrypted backups | 30 days: deleted data also disappears from backups within this period |
| Anonymous statistics | According to PostHog's settings (up to 7 years), not linked to you |
| Posts on Say It's social pages | Until you withdraw permission or delete the post: we remove them within a few hours |
6. Advertising and tracking
Say It is free thanks to Google AdMob ads, shown only in the list of posts and below the detail view, never while writing and never next to posts suggesting danger. If you are in the European Union, the EEA or the United Kingdom, on first launch Google asks whether you accept personalised ads; you can change your choice in Profile → Privacy → Ad preferences. On iPhone, personalised ads also require your permission to track, which you can withdraw in Settings → Privacy → Tracking. Without consent you see non-personalised, contextual ads only. How Google uses data: policies.google.com/technologies/partner-sites.
The app doesn't use cookies. This website uses no cookies and no analytics.
7. Your rights
At any time you can ask to access, rectify or erase your data, restrict its processing, receive it in a readable format (portability), object to processing based on legitimate interest and withdraw your consents, without affecting prior processing (Arts. 15–22 GDPR).
- Copy of your data: Profile → Privacy → Download a copy of your data.
- Edit: Profile → Edit profile; posts can be edited within 24 hours and deleted at any time.
- Erasure: Profile → Delete profile and content (see how to delete your account).
- For anything else write to kida.mancinimesi@gmail.com. Since profiles are anonymous, we may ask you to prove from the app that the profile is yours; we will never ask for your recovery code. We reply within 30 days.
You also have the right to lodge a complaint with the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it) or with the authority of the country where you live.
8. Minimum age
Say It is only for people aged 18 or over. If we find that a profile belongs to a minor, we delete it.
9. Security
Communications are encrypted (HTTPS). The database lets each user read only their own private data and public posts; other users cannot link anonymous posts to a profile; the recovery code is stored only as a hash; backups are encrypted. No system is 100% secure: in case of a data breach that may put you at risk, we will inform you as required by law.
10. Changes
We may update this policy. For important changes we will notify you in the app. The date of the last update is shown at the top.