🌟 SaveFix

1. Data Collection Principle

SaveFix collects notification metadata (sender, timestamp, category) to power passive financial and habit intelligence. Message body content is never read or stored unless you explicitly enable it in Settings → Advanced.

2. Local-First Architecture

All data is processed on-device by default. Nothing is transmitted to any server unless you explicitly enable "Cloud AI" in Settings → AI Features. This opt-in is off by default and requires a separate consent step.

3. Authentication Credentials

• Passwords are never stored as plain text.
• Passwords are hashed using PBKDF2-HMAC-SHA256 with a unique per-account salt (min 16 bytes).
• Email and phone numbers are encrypted at rest using Android Keystore (AES-256-GCM).
• Session tokens are stored in EncryptedSharedPreferences backed by the Android Keystore.

4. Permission Transparency

Every Android permission is explained before it is requested:

No permission is requested in the background or silently.

5. Data Retention

• Working memory: 72 hours (auto-purged)
• Episodic / Semantic memory: decays via exponential forgetting curve; you can purge manually
• Finance & Habit logs: retained until you delete them
• Auth credentials: deleted immediately on account deletion

6. Third Parties

SaveFix contains no third-party SDKs that collect analytics, crash reports, or advertising identifiers by default. Firebase Crashlytics is included solely for crash reporting and is disabled in debug builds. Google AdMob is used for non-personalised ads only.

7. Your Rights

• Export: all your data as JSON via Settings → Export My Data
• Delete: Settings → Delete All Data (irreversible)
• Revoke: any permission can be revoked at any time via Android Settings

8. Contact

For privacy inquiries: mohamedelsayedarmy95@gmail.com