This policy describes how we collect, use, share, and safeguard information when you use our mobile application and related services. If you do not agree, please do not use the app.
1. Contact
Questions or requests about this policy or your data: support@savyit.app (use the same address you publish in Google Play Console).
2. What the app does
Savyit helps you track spending by reading bank and UPI alerts (SMS and bank-app notifications) where you grant permission, logging manual entries, and presenting budgets, plans, card bills and insights. All of this works without an account. Signing in is optional and only needed for splits with friends, promo codes, and syncing preferences across devices.
3. Information we process
- Account & authentication. If you sign up or sign in, Firebase Authentication processes identifiers such as email address (email/password accounts) or Google account tokens (Google Sign-In). Firebase assigns your account a stable user ID (UID).
- Profile preferences. With your account, onboarding and profile fields (for example display name, username, currency, income bands, theme, mascot preferences) may be stored locally and synchronized to Firebase Cloud Firestore (for example under users/<uid>/data/profile) so you can restore settings on another device signed into the same account.
- Entitlements & usage. Pro status and SMS scan usage counters may be stored in Firestore (for example users/<uid>/data/entitlements) and cached on your device so limits apply consistently when signed in.
- Spending streak. If you enable a streak, settings such as daily limit, enabled flag, start date, and best streak may be stored in a private Firestore document (for example users/<uid>/data/streak). Current and best streak counts and whether the streak is enabled may also appear on your public user profile document (users/<uid>) so friends can see aggregate streak status-not your daily spend amounts or transaction details.
- Social & splits. Friend relationships, invite codes, usernames, split groups, shared expenses, settlements, and related notifications may be stored in Firestore collections such as friendships, splitGroups, usernameIndex, inviteCodeIndex, and users/<uid>/notifications. Other group members can see information you add to a split (names, amounts, notes you choose to share).
- Messages. Bank SMS and bank-notification parsing happens on this phone, including unfamiliar formats. Personal messages and OTPs are filtered locally. Unresolved bank messages stay in a local review queue until you confirm or dismiss them. Savyit remembers formats and category corrections on this phone; it does not continuously retrain a personal model. Message text is never sent to Savyit, to any server, or to any AI service. Buddy answers, monthly plans, categorisation and insights are all computed on this phone.
- Transaction records. Parsed transactions are stored on your device. They are not uploaded to Firestore as part of the standard transaction storage path.
- Payments. In India, Pro is processed through Razorpay. Outside India, Pro is processed through Dodo Payments. We receive and store limited subscription lifecycle metadata (for example plan ID, subscription ID, status, renewal period end, and payment confirmation IDs) to grant or revoke Pro entitlements. If you buy Pro without an account, we issue a signed Pro key that contains only a random ID, the plan, the subscription ID and an expiry date. It contains no name, email or phone number. The app checks this key offline. Card/UPI credentials are handled by Razorpay or Dodo under their policies and are not stored by Savyit.
- Technical & security. Network requests inherently produce metadata such as timestamps, rough IP-derived information at infrastructure providers (e.g., Google, payment providers), standard HTTP logs, and error diagnostics where enabled.
- Notifications. The app schedules local reminders on your phone. To send occasional product announcements, the app registers a push token with Firebase Cloud Messaging and with our push service, Notifyme (notifyme-pwa.vercel.app), together with a random install ID, app version, platform and time zone. If you are signed in, your account ID is included. Your email and name are not sent. You can turn notifications off in Android Settings. Cloud-stored notifications may also relate to friend or split activity when you use social features.
- Usage analytics. Firebase Analytics records which screens are opened and a few events (for example "SMS scan opened" with whether you are on Pro, or how many entries a quick add saved). Analytics never includes message text, amounts, merchants or transactions. You can turn usage stats off at any time in Profile > Usage stats; collection stops on this phone straight away.
4. Permissions (Android)
Depending on OS version and your choices, the app may request permissions including:
- SMS (read/receive). To read banking and UPI messages on your phone. Message text is not uploaded.
- Notification access. Optional. To read new bank-app payment notifications on your phone. Other notifications are ignored and nothing is uploaded.
- Internet. For payments, Pro key checks, analytics, push notifications, and optional sign-in and splits. Not used to parse messages.
- Notifications. To show reminders and social activity you opt into.
- Microphone. Optional. To log expenses by voice. Speech is converted to text on your device; audio is not stored or sent to Savyit servers.
You can revoke permissions from Android Settings; limited or revoked SMS access may impair core features.
5. Local vs cloud summary
On your phone only: SMS and notification text, transaction history, budgets, plans, card bills, Buddy conversations and app preferences.
In the cloud, only if you sign in: account profile, entitlements, streak settings and public streak aggregates, and friend and split data. Your transaction ledger is never uploaded.
6. On-device processing
SMS parsing, bank-notification parsing, categorisation, Buddy answers, "Why this month" insights and monthly-plan calculations all run on this phone. Savyit does not use OpenAI or any other AI service, and no message or transaction text is sent to Savyit or any third party for processing.
Monthly plans and Buddy status are private local records. Their colours reflect your confirmed limits and recorded transactions, not a financial-health score. Investment contributions are separate from cash left over. Review bank messages offers undo and forgetting learned formats. Clear local data deletes stored messages, patterns and plans, including unfinished native ingestion queues. Sensitive SMS queues, learned formats, plans and preferences are excluded from Android cloud backup and device transfer.
7. Third-party services
- Google Firebase & Google Sign-In. Authentication, Firestore sync, configuration, ID tokens.
- Razorpay. In-app Pro payments in India.
- Dodo Payments. Pro subscriptions outside India (hosted checkout).
- Notifyme. Push-notification delivery (see Notifications above).
- Firebase Analytics. Screen and event counts (see Usage analytics above).
- Analytics & device vendors. Standard platform vendors (Google Mobile Services/Firebase stack, device OEM) may process crash or telemetry data consistent with Firebase SDK defaults and Play policy, disclose what you enable in Play Console Data safety.
These providers process data pursuant to their own privacy policies.
8. Legal bases / purposes
We process data to provide core functionality (parse and display finances), authenticate you, operate social and streak features, process purchases, secure endpoints, troubleshoot issues, comply with legal duties, and improve reliability.
9. Sharing
We do not sell your personal information. Sharing is limited to service providers assisting operation (Firebase, Razorpay, Dodo Payments, Notifyme), other users you choose to interact with via social features, legal requirements, fraud prevention aligned with proportionate lawful requests, and business transfers structured with compatible protections.
10. Retention
- Device data. Cleared when you uninstall the app or erase app storage (subject to Android backup behavior).
- Cloud account data. Persists while your Firebase account exists and documents remain until deleted or overwritten; request deletion help via the contact email.
- Logs. Short-lived operational logs at infrastructure vendors per their defaults.
11. Security
We use industry-standard transport encryption (HTTPS) and the Android app sandbox. Because messages and transactions stay on your phone, a breach of our servers cannot expose them. No method is perfect; protect your device and account credentials.
12. Children
Savyit is not directed at children under 13 (or the age required in your region). Do not provide child data to the service.
13. International transfers
Firebase, Razorpay, Dodo Payments and Notifyme may process data in the United States, India, and other regions. By using cloud features you acknowledge such transfers where permitted by law.
14. Your choices & rights
Depending on jurisdiction you may have rights to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Email us to exercise these; we may verify your request. You may also manage Google account controls through Google. You can disable streak sharing, leave split groups, and sign out to limit further cloud sync.
15. Changes
We may update this policy. Material changes will be reflected by updating the effective date and, where appropriate, in-app or store listing notices.
16. California & other US state notices
If applicable, you may have additional rights under state privacy laws (access, deletion, opt-out of sale/sharing). We do not sell personal information for money; contact us for requests.