IN APPS

Draft · 17 October 2026

IN APPS is a paid addition to So Annoying! that removes ads inside your other apps. It works differently from the Safari part, so it gets its own page. The main privacy policy still covers everything else.

The short version

• The filtering runs on your iPhone, in an extension of the app. Nothing is routed through my servers.
• The tunnel sees the connections your apps make while it is on. It has to, to filter them. It keeps none of them.
• The certificate belongs to your phone. The key is made on your phone, stays in its keychain, and I never have a copy.
• Name lookups the tunnel does not answer itself go to Cloudflare's public resolver, not to me.
• It is not a privacy VPN. It hides nothing from your network, your carrier or the sites your apps talk to.

How it works, in one paragraph

iOS only lets an app touch other apps' traffic through a VPN, so IN APPS registers one. That is why iOS shows the VPN badge and why no other VPN can run at the same time. The tunnel does not go anywhere: both ends are on your phone. It answers name lookups from the same block list the Safari part uses, and for the apps that do not pin their connections it opens the traffic with a certificate your phone made, drops the ad requests, and sends the rest on untouched.

What the tunnel sees

While it is on, the tunnel sees what every app on your phone connects to: the names they look up, the addresses they reach, and for the apps that do not pin, the requests and responses inside those connections. That is the whole point of it, and there is no gentler way to say it.

What it does with all of that is match it against a list and throw it away. The code that reads it runs on your phone, in the app's own extension. None of it is written to a file, none of it is logged, none of it is counted anywhere I can read, and none of it is sent to me. When the tunnel stops, there is nothing left of it.

The counts you see in the app are counts: how many things were removed, and in which app. They stay on your phone like the Safari counts do.

The certificate

To read inside an app's HTTPS connection, something has to hold a certificate the phone trusts. Your phone makes that certificate itself, the first time you set IN APPS up. The private key is generated on the device, kept in the device's keychain, never synced to iCloud, and never sent anywhere. I do not have it and cannot get it.

This matters more than it sounds. Because the key is only yours, I could not sign anything for you even if I wanted to, and a copy of the app on another phone cannot read your traffic. It also means trusting that certificate is a thing you do in Settings, by hand, and can undo in Settings, by hand. Remove the profile and the tunnel can no longer open anything.

Name lookups

The tunnel answers lookups for blocked hosts itself, on the phone, with a dead address. Everything else has to be answered by a real resolver, and the tunnel forwards those to Cloudflare's public resolver over an encrypted connection. Cloudflare sees those lookups the way any resolver would, under their own privacy terms. They do not come to me, and they carry nothing about you beyond the name being looked up.

What it cannot do

• Apps that pin their certificates are left alone. Instagram, Facebook, Threads, Messenger, Snapchat and TikTok all pin. Their traffic passes through untouched rather than breaking.
• It is not a privacy VPN and does not pretend to be one. Your IP address does not change, your network and your carrier see what they always saw, and nothing is anonymised.
• It does not route your traffic through anyone's server, mine included.
• Only one VPN can be active on iOS at a time, so turning IN APPS on turns your other VPN off.

What leaves your phone

The rules. The same list fetch the rest of the app already does, with no account and no identifier, described under rule updates in the main policy. The add-on adds nothing to it.

Purchases go through Apple, which tells the app whether IN APPS is paid for and tells me nothing about you. The free day is recorded on your phone, in its keychain, so a reinstall does not hand out a second one. That record never leaves the device.

Changes

When this page changes, the new text appears here with a new date at the top.

Questions go to support@soannoying.app.