Privacy Policy
This policy explains what personal data the Ask Big Sarge app and this website use, why, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).
The short version. You don’t need an account. Your notes, favourites, recent cards and exam progress stay on your phone. When you use Describe the job, personal details are stripped on your phone before anything is sent, and we don’t store what you send. We don’t show ads. We don’t track you. This website sets no cookies.
1. Who we are
The data controller for Ask Big Sarge is Aaron Parry, trading as Ask Big Sarge, based in England. Ask Big Sarge is made by ARX Algorithms. Contact us about privacy at privacy@askbigsarge.co.uk.
Ask Big Sarge is independent. It is not affiliated with the College of Policing, the Home Office or any police force. Your force does not get any data from the app.
2. What stays on your phone
Most of the app works fully offline. The following is stored only on your phone. We never receive it.
- My notes. Notes you write on cards are encrypted on your phone with XChaCha20-Poly1305. The key is kept in your phone’s secure keychain (iPhone) or keystore (Android). Notes are never sent anywhere, and there is no cloud backup.
- Your notes code. We never store the code itself. Only a salted, slow hash of it is kept, in the keychain or keystore.
- Face ID or fingerprint. If you turn this on, your phone checks it. The app only learns “yes” or “no”. Your face or fingerprint data never reaches the app or us.
- Favourites and recently viewed cards. You can clear recent cards in Settings.
- Exam prep progress. Answers, scores, mock results and your review schedule.
- Keyword search. Searching cards by keyword runs on your phone. Nothing is sent.
- Voice. Voice input uses your phone’s on-device speech recognition only. The audio is never sent anywhere. If your phone can’t do this on the device, the app doesn’t offer voice.
- Home screen widget and shortcuts. The law of the day widget reads a small file the app writes to shared storage on your phone. It needs no network and no account.
- An anonymous install ID. A random code, made on your phone. It isn’t linked to your name or any account. It is only sent when you use Describe the job (see below).
- Search allowance count. A count of how many Describe the job searches you have used this month or day.
If you delete the app, this data is deleted with it. We can’t recover it for you.
3. Describe the job
Describe the job lets you type or speak what happened and suggests the cards that fit. To do this, a short text has to be sent to our server.
Before anything is sent
- Your phone strips personal data from the text first. This includes names, addresses, postcodes, number plates, phone numbers, email addresses, National Insurance numbers, PNC IDs, dates of birth and other dates and numbers. They are replaced with placeholders such as [NAME].
- You see exactly what will be sent. You can edit it or cancel.
- Text is cut to 600 characters.
Please don’t type anything that could identify a person. The stripping is careful, but no automatic tool is perfect.
What is sent
- The stripped text.
- Your anonymous install ID, so we can count your free searches.
- The anonymous ID our purchase provider RevenueCat gives your app, and whether the app says you have Pro. This is used only to check your Pro allowance.
What happens to it
- Our server masks anything obvious that slipped through, as a second check.
- The text is turned into a search vector and matched against our cards. An AI model then picks the best cards and writes a one-line reason for each. We use Google’s Gemini for this. If Gemini can’t answer, Anthropic’s Claude is used as a fallback.
- We send back card names, a rank and a reason. Everything else you read comes from the cards on your phone.
What we keep
- We don’t store your description. It is not saved to our database and not written to our logs. It is held in memory only while your answer is made.
- A salted hash of your install ID with a counter, so the free allowance works. We can’t turn the hash back into your install ID.
- Daily totals, such as how many searches were made that day. These are counts only and contain no personal data.
Google and Anthropic process the stripped text for us as processors, under their terms for business API customers. See Who processes data for us.
4. Purchases
Payments are handled by Apple (App Store) or Google (Google Play). We never see your name, email address or card details.
We use RevenueCat to check which purchases you have and to restore them. RevenueCat receives an anonymous app user ID, your purchase receipts and basic device details such as platform and app version. It does not receive your name from us. Apple, Google and RevenueCat each have their own privacy policies.
5. Law updates to the app
When the law changes, updated cards reach your phone without a new app version. The app downloads these updates from Expo, the service we use to deliver them. To do this, Expo receives the technical details any download needs, such as your IP address, the app version and whether you use iPhone or Android. No personal content from the app is sent.
Links in cards to sources such as legislation.gov.uk open in your browser. Those sites have their own privacy policies.
6. This website
This website sets no cookies and runs no analytics, ads or tracking scripts. Our host, Cloudflare, handles the network traffic, so it briefly processes your IP address to deliver the pages.
7. Our law-update tool
We use a private web tool to approve changes to the law cards. Only the owner of Ask Big Sarge uses it. It holds no data about app users and never receives any.
8. Lawful bases
| What we do | Lawful basis |
|---|---|
| Answering a Describe the job search you ask for | Contract: it is needed to give you the feature you asked for (UK GDPR Article 6(1)(b)). |
| Counting searches against your allowance with a hashed install ID | Legitimate interests: running fair free and paid tiers and preventing abuse (Article 6(1)(f)). |
| Checking and restoring purchases through RevenueCat | Contract: giving you what you paid for (Article 6(1)(b)). |
| Delivering law updates through Expo | Legitimate interests: keeping the law in the app accurate and current (Article 6(1)(f)). |
| Daily search totals | These contain no personal data. |
| Keeping records of sales for tax | Legal obligation (Article 6(1)(c)). Apple and Google hold the sales records. |
We don’t want any information about crimes, suspects or victims. The app is designed to strip this out before it leaves your phone, and we don’t store the text that is sent.
9. Who processes data for us
| Provider | What for | What they get |
|---|---|---|
| Supabase | Hosts the Describe the job server and database | Stripped text in transit, install ID hash, anonymous RevenueCat ID, IP address |
| Google (Gemini API) | Search vectors and picking cards | Stripped text and card summaries |
| Anthropic (Claude API) | Fallback when Gemini can’t answer | Stripped text and card summaries |
| RevenueCat | Checking and restoring purchases | Anonymous app user ID, receipts, device details |
| Expo | Delivering law updates to the app | IP address, app version, platform |
| Cloudflare | Hosting this website | IP address, in transit |
Apple and Google take payments and run their app stores as separate controllers under their own privacy policies.
10. International transfers
Some of these providers are based in, or use servers in, the United States or elsewhere outside the UK. This includes Google, Anthropic, RevenueCat, Expo and Cloudflare. When personal data leaves the UK, we rely on the safeguards UK law requires. These are the UK–US data bridge where the provider is certified, or the UK International Data Transfer Agreement or Addendum to standard contractual clauses. You can ask us for details at privacy@askbigsarge.co.uk.
11. How long we keep data
| Data | How long |
|---|---|
| Notes, favourites, recent cards, exam progress, install ID | On your phone until you delete them or the app. We never have them. |
| Describe the job text | Not stored by us. Held in memory only while your answer is made. |
| Hashed install ID with search counter | Deleted automatically about 40 days after it was last used. |
| Daily search totals | Kept, as they contain no personal data. |
| Purchase records | Held by Apple, Google and RevenueCat under their own policies. |
| Support emails | Deleted within 24 months. |
12. Your rights
Under UK data protection law you have the right to ask for a copy of your personal data, have wrong data corrected, have your data deleted, restrict how we use it, object where we rely on legitimate interests, and get your data in a portable format where this applies.
We hold very little that can identify you. We don’t know your name, and we can’t link the hashed install ID back to you. Usually the quickest way to use these rights is in the app: clear recent cards in Settings, delete notes, or delete the app. See how to delete your data.
To use any right, email privacy@askbigsarge.co.uk. We will reply within one month. For purchase data, you can also contact Apple or Google directly.
13. Complaints
Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
14. Children
Ask Big Sarge is made for adults: police officers and staff, and people preparing for police exams. It is not aimed at children, and we don’t knowingly process data about anyone under 18.
15. No ads, no tracking
The app has no adverts, no advertising IDs, no analytics and no tracking across other apps or websites. We don’t sell or share your data for marketing.
16. Security
Notes are encrypted on your phone. The notes code is protected by a slow, salted hash and a lockout after repeated wrong tries. Data sent to our server is encrypted in transit (HTTPS). Our database can only be reached by our server, not by the public app.
17. Changes to this policy
If we change how we use data, we will update this page and the date at the top. If a change is significant, we will also tell you in the app.