This Privacy Policy explains how Maksym Duchenko, a sole proprietor (Einzelunternehmer) established in Austria and operating under the name "STAYER" ("we", "us", "our"), the developer of the mobile application Any Icon (the "App"), handles information in connection with your use of the App. This Policy provides the information required by Articles 13 and 14 GDPR; it is not a contract and does not require your agreement.
Data Controller: Maksym Duchenko (sole proprietor / Einzelunternehmer), trading as "STAYER", Neustiftgasse 16/3/D8, 1070 Wien, Austria. Contact: support@stayerofficial.com. We are not required to appoint a Data Protection Officer under Article 37 GDPR and have not appointed one; please direct all data-protection enquiries to the address above.
We practice data minimization. The following describes the maximum that may be processed depending on your choices.
2.1. Data stored locally on your device (not transmitted to us). Your widget configuration — the package names of the apps you choose for a widget, the selected icon shape and style, the "themed icon" preference, the icon pack you select, any text label you type into a text widget, and generated icon image files — together with securely stored license, purchase and trial status, your consent choices, and a local diagnostic log (see 2.4). Depending on the features you use, this local data also includes the websites you add (address, page title, brand colour and logo, see 2.7), web search terms you save as a shortcut, and — for shortcuts you create through another app’s shortcut picker, for example “Direct dial” in a contacts app — the name, the link or phone number and the picture that this app hands over; for a contact these can be the contact’s name, number and photo. Icons are enhanced by a machine-learning model that runs entirely on your device; no image is uploaded. The configuration and generated image files for a particular widget are removed when that widget is deleted. Pictures received from another app’s shortcut are deleted once no widget uses them any more. Other locally stored App data, including consent choices, the diagnostic log, and the license, purchase and trial status, remains until you clear the App's data or uninstall the App. If Android device backup is enabled, eligible App settings and files may be backed up by Android/Google according to your device backup settings; we do not access or manage those backups. If you bought Any Icon while it was a paid app, the App also keeps a note of this in the Block Store of Google Play services on your device; if your Google device backup is on and your device supports end-to-end encrypted backups, Google also keeps this note, end-to-end encrypted, in your backup. This lets you keep the full version when you reinstall the App or set up a new phone from that backup. The note contains only the fact of the purchase and no identifier of you or your device; we do not receive it. Unlike the other data described here, it may remain after you clear the App’s data or uninstall the App; it is deleted at the latest when your device is reset and, in your backup, when the backup is deleted.
2.2. Installed-applications information (processed on-device). To let you choose which application a widget displays or opens, and to offer any icon packs you have installed, the App reads the list of launchable applications and installed icon packs on your device, their icons, and the app shortcuts those applications declare (their labels and icons). This happens on your device only and is not transmitted to us. To show the right icon for a website or web-search shortcut, the App also checks which browser or search app on your device will open it.
2.3. License verification (Google Play Integrity, Firebase App Check). To confirm the App is a genuine, licensed copy, the App requests an integrity token from Google Play Integrity and sends it to our secure backend (a Google Firebase Cloud Function). The token is generated and decoded by Google and may contain signals about the integrity of the device, the app binary, and whether the associated Google account is licensed. Our backend uses the result to return a "licensed / not licensed" decision and, while Any Icon is a paid app, to keep the note described in 2.10; it does not store the token or its contents. In addition, the App uses Firebase App Check: it obtains a further Play Integrity verdict, exchanges it with Google for a short-lived App Check token and attaches that token to its calls to our backend, so that the backend answers only genuine copies of the App and cannot be flooded by others. With each call, Google, as our service provider, also processes your IP address and identifiers of this app installation that the Firebase software creates automatically (a Firebase installation ID and a Firebase Cloud Messaging token, which is attached to each call; we do not use them and send no messages). Our backend does not record your IP address. Legal basis: performance of our contract with you and our legitimate interests in preventing fraud and piracy and in protecting our backend against abuse (Art. 6(1)(b) and (f) GDPR).
2.4. Support communications. If you use "Get support" in the App, it opens your own email application to send a message to support@stayerofficial.com. When you send that email, we receive your email address, the message you write, and — only if you choose to attach the diagnostic report — technical information about your device and the App. The diagnostic report may contain: app version and build, package name, approximate app/data/cache sizes, available device storage, total and available memory, device manufacturer, model, brand and board, supported ABIs, Android version, build number and security-patch level, system language, screen resolution, density and orientation, tablet status, battery, low-memory and power-save status, the name, package name and version of your default home-screen app (launcher) and whether it supports adding widgets from apps, the identifiers and on-screen sizes of your Any Icon widgets, the current license, purchase and trial status, and recent in-app events or crash details. It does not contain your name, the contents of other apps, files, or messages. We use this information solely to respond to and resolve your support request. Legal basis: performance of our contract with you or steps taken at your request (Art. 6(1)(b) GDPR) and our legitimate interest in providing support (Art. 6(1)(f) GDPR).
2.5. Analytics and crash data (only if you opt in). Only if you enable it, the App uses Google Firebase Analytics and Firebase Crashlytics. When enabled, Google may process on our behalf: app-instance identifiers, device and operating-system information, app usage events, performance and crash data (including stack traces and device state at the time of a crash), and IP address (from which Google derives an approximate location, such as country, region and city, and which it then discards per its policies). This data is pseudonymous — it is not linked to your name or to an account, and we cannot use it to identify you. These features are disabled by default, advertising-related data (ad storage, ad personalization, ad user data) is always denied, and you can turn them on or off at any time in About → Privacy. Legal basis: your consent (Art. 6(1)(a) GDPR). We use no advertising networks and no third-party analytics other than the Google services described here.
2.6. Purchase and licensing. Any Icon and its one-time in-app purchase “Full version” are sold through Google Play. Google Play handles your purchase, payment, invoicing, and any refund under its own terms, and we never receive or process your payment card or bank details. For an in-app purchase, Google Play gives the App a purchase token, which the App keeps on your device. To confirm the purchase, the App sends this token to our backend, which asks Google Play for the status of the purchase; our backend does not store the token or the answer. In addition, Google Play provides us with sales and earnings reports and order records in the Play Console. For each purchase, they contain in particular the order number, date, product, price, taxes and currency, the device model, and the buyer’s country and, where available, region, city and postal code; they do not contain your payment card or bank details. We use them for our accounting and tax records and, if you contact us about a purchase, to look up your order there by its order number or your email address. Legal basis: performance of our contract with you and our legitimate interest in preventing fraud (Art. 6(1)(b) and (f) GDPR); for the reports, our legal obligation to keep accounting records (Art. 6(1)(c) GDPR).
2.7. Website logos (only for websites you add). When you add a website to a widget, the App loads that site’s logo so that the widget can show it. For this, your device contacts the website directly: it requests the site’s start page and the icon files and web-app manifest named there, which the site may deliver from other servers (for example a content-delivery network) or via redirects. If the site provides no logo of at least 180 pixels on its shorter side (many sites publish only small icons), the App then asks Google’s favicon service (t1.gstatic.com) for that site’s icon and sends it the site’s host name (for example example.com). With each of these requests the answering server necessarily receives your IP address and the time of the request; the App identifies itself only as “AnyIcon (Android; widget icon fetch)” and sends no cookies, no identifier of you or your device and nothing about your other websites. The website operators and Google process these data as independent controllers under their own privacy policies; we operate no server in between and receive nothing. These requests are made only when you add a site (a download that has begun may finish after you leave that screen); the App never fetches logos on its own. If neither source yields a logo of at least 32 pixels, the widget shows the site’s address as text, and nothing further is requested. The site’s address, page title, brand colour and logo are stored on your device only; they are deleted when you remove the site from your list, unless a widget on your home screen still uses that site — then they are kept for that widget and deleted once the last such widget is removed. Legal basis: performance of the feature you requested (Art. 6(1)(b) GDPR) and, for the enquiry to Google’s favicon service, our legitimate interest in showing a recognisable icon also for sites that publish only small ones (Art. 6(1)(f) GDPR). Websites and Google may be located outside the EU/EEA (see section 5).
2.8. Example widgets on the main screen. The App’s main screen shows example widgets so that you can see what they look like. For these examples the App uses the icons and names of applications installed on your device and of their app shortcuts, and the websites you have added yourself together with their stored logos (see 2.2 and 2.7); a website you remove from your list no longer appears in the examples. The text-widget example can also show the address of a well-known website from a fixed list built into the App (for example stackoverflow.com); only the address is shown as text, and the App does not contact these websites. All of this is processed on your device only; to show the examples, the App does not connect to the internet. On Android 15 and later, the App also hands one current example per widget type to Android so that the system’s widget picker can display it; these images remain on your device.
2.9. Free trial. To offer the free trial once per device, the App sends a pseudonymous identifier of your device to our backend together with a Play Integrity token (see 2.3). Our backend stores this identifier together with the start date of your trial for two years. Legal basis: performance of our contract with you and our legitimate interest in offering the free trial only once per device (Art. 6(1)(b) and (f) GDPR). Reading this identifier on your device and storing the purchase note described in 2.1 are strictly necessary to provide the free trial and the full version (§ 165(3) TKG 2021).
2.10. Buyers of the paid version. If you bought Any Icon while it was a paid app, you keep the full version after Any Icon becomes free. So that it also comes back after you reinstall the App on the same device, our backend stores, while Any Icon is a paid app, under the pseudonymous device identifier described in 2.9, a note with its date that this device belongs to a buyer; a first, provisional note is deleted after 30 days, the final note five years after it was made. After a reinstall, the App sends this identifier together with a Play Integrity token (see 2.3), and our backend answers whether such a note exists. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
2.11. Whether you have to provide data. You are not obliged by law or contract to provide data. However, the data described in 2.3, 2.6, 2.9 and 2.10 are needed for the free trial and the full version: without them, creating and changing shortcuts is not available. Contacting support (2.4) and analytics and crash reporting (2.5) are voluntary.
We use information only to: provide and operate the App's core features (including logos for websites you add); verify that your copy is genuine and licensed and protect our backend against abuse; provide the free trial and the full version; respond to and resolve your support requests; keep the accounting and tax records required by law; and, if you opt in, understand aggregate usage and improve stability and quality. We do not use your information for advertising or profiling, and we do not sell or rent it.
We share information only with Google LLC / Google Ireland Ltd., acting as our service provider for Play Integrity, Firebase Cloud Functions, Firebase App Check, Cloud Firestore (trial and buyer records), Google Workspace (our support mailbox) and (if you opt in) Firebase Analytics and Crashlytics — see Google's Privacy Policy and Firebase data practices — and with Google Play as the app store handling your purchases and licensing (see 2.6). In addition, when you add a website, the App itself connects to recipients that are not our service providers and that receive the connection data (in particular your IP address) as independent controllers: the website and the servers it uses, and Google’s favicon service (see 2.7). Your support emails are delivered through your own email provider to our mailbox. We may also disclose information where required by law or to protect our rights, safety, or property, or in connection with a merger or asset transfer subject to this Policy. We do not share your data with any other third parties.
Google may process data in the United States and other countries. Our backend and the trial and buyer records are hosted by Google in the United States. Transfers of data from the EEA, the UK or Switzerland to Google LLC in the United States are based on the adequacy decisions for the EU–U.S. Data Privacy Framework, its UK Extension and the Swiss–U.S. Data Privacy Framework, under which Google LLC is certified; in addition, Google’s data-processing terms include the European Commission’s Standard Contractual Clauses. You can request a copy of these safeguards from us. The websites you add (2.7), and the servers they use, may be located anywhere in the world, including in countries for which the European Commission has not recognised an adequate level of data protection. Unless the respective operator is covered by an adequacy decision (for US companies: certification under the EU–U.S. Data Privacy Framework), there are no safeguards under Article 46 GDPR for these connections, and your data there may not enjoy a level of protection equivalent to that in the EU.
Any Icon is designed to be privacy-friendly: it has no user accounts, and apart from support requests we do not ask for your name or contact details.
Under the GDPR you have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object (Art. 21), and you can withdraw a consent at any time with effect for the future (Art. 7(3)). Depending on where you live, local laws (for example the UK GDPR or the CCPA/CPRA) may give you further rights. How this works in practice for Any Icon:
Right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests (sections 2.3, 2.4, 2.6, 2.7 and 2.9), you have the right to object at any time on grounds relating to your particular situation, by writing to support@stayerofficial.com. We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms (for example protection against piracy, 2.3), or the processing serves the establishment, exercise or defence of legal claims.
If we cannot identify you from the data we hold, we may ask you for additional information; where identification remains impossible, we may be unable to fulfil a request. You also have the right to lodge a complaint with a data-protection authority — in Austria, the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at. We do not sell or share your personal information for advertising and do not engage in cross-context behavioral advertising.
The license, purchase, trial and buyer checks described in sections 2.3, 2.6, 2.9 and 2.10 are automated, including the App Check verification described in 2.3. They determine whether you can create and change shortcuts. They are technical measures; they do not profile you and produce no legal or similarly significant effect within the meaning of Article 22 GDPR. If you believe a check has wrongly failed, write to support@stayerofficial.com and a human being will review it and help you. We carry out no other automated decision-making and no profiling.
We use reasonable technical and organizational measures to protect information, including encrypted storage of sensitive data on your device and secure (HTTPS/TLS) communication with Google services and websites (the App loads website logos over HTTPS only). No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
The App is not directed to children under the age of 14 (the digital-consent age in Austria), under 13 in the United States, or under the age required in your jurisdiction, whichever is higher. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will take appropriate action.
The App relies on Google Play (including its billing service), Google Play Integrity, Firebase (including App Check) and Google Cloud, which are governed by Google's own terms and privacy policy. The websites and Google’s favicon service that the App contacts for logos (2.7) process the connection data under their own privacy policies. We are not responsible for the privacy practices of third-party sites or services. Icon packs and other applications you choose to use alongside Any Icon are provided by their own developers under their own terms.
We may update this Privacy Policy from time to time. The "Last updated" date reflects the latest version, posted at https://stayerofficial.com/privacy-anyicon.html. If a change materially affects how we handle your personal data, we will tell you in the App, at the latest the next time you open it; where the law requires your consent, we will ask for it before the change applies to you.
If you have questions or requests regarding this Privacy Policy or your data, contact Maksym Duchenko (STAYER), Neustiftgasse 16/3/D8, 1070 Wien, Austria, email support@stayerofficial.com. See also our Impressum and the Terms of Use.