Privacy Policy

With notification access, SaveFix reads your notifications on your device to track your money and habits:

• From every app: the app's name, the time, a category and the first 50 characters of the title. These are deleted after 30 days.
• From bank and payment apps: the full notification text, up to 500 characters, to find the amount and record the transaction. That text is kept on your device with the transaction so you can review it. A bank notification that could not be read as a transaction is kept for up to 90 days so it can be tried again.
• Verification codes (OTPs) are recognised and discarded without being stored.
• Notification text never leaves your device. Cloud backup (below) contains the transactions recorded from it (amount, date, category, merchant and bank), not the notifications themselves.

SaveFix works fully offline and stores everything on your device first. Two things leave the device:

• Cloud backup. While you are signed in, your app data (habits, finance entries, journal, goals and related records) is backed up to our servers so it returns when you sign in on a new device. It is encrypted in transit and at rest. This backup does not run for guest users. It holds your whole history, not a recent window.
  Kept on this device only, never backed up: Focus session history, Time Wallet balances, Your Time Cost settings (work hours and monthly income), your accountability partner, and the coach conversation itself (short summaries of coach sessions are backed up). These do not return on a new device or after reinstalling.
• Cloud AI. Off by default and requires a separate consent step. When enabled, the text of your question and the context needed to answer it are sent to our server and on to Google's Gemini API — or, if Gemini cannot answer, to OpenAI's API. If you supply your own API key instead, the request goes from your device directly to the provider you chose.

If you would rather none of this leaves the device, leave Cloud AI off: the on-device coach answers from the same data without sending it anywhere.

• SaveFix has no passwords. You sign in with a one-time code sent to your email, or with Google or Apple.
• On our server, sign-in codes and session refresh tokens are stored only as SHA-256 hashes, never as plain text.
• On your device, session tokens are encrypted with AES-256-GCM using a key held in the Android Keystore.
• Your email address and name are kept in the app's private storage on your device. They are not separately encrypted.

Every Android permission is explained before it is requested:

No permission is requested in the background or silently.

Connecting SaveFix to Health Connect is optional. If you connect it:

• What is read: your steps, sleep sessions and heart rate from the last 7 days, each time the app refreshes them.
• What is written: nothing. SaveFix only reads from Health Connect.
• Why: to show your daily health summary, and to relate your activity and sleep to your habits and spending inside the app (Life Score, patterns, Digital Twin).
• Where it is kept: in the app's storage on your device only. Health records are not part of the cloud backup, are never sent to our servers, and are never included in what Cloud AI receives.
• How long: copied health data is deleted from your device after 90 days, when you use Settings → Delete All Data, or when you uninstall the app.
• Your control: you can revoke SaveFix's access at any time in Health Connect; the app then stops reading.

One aggregate does leave the device when you use Cloud AI: your overall Life Score, a single number from 0 to 100 that combines several areas of your life, activity and sleep among them. No health record is sent with it.

• Working memory: 72 hours (auto-purged)
• Episodic / Semantic memory: decays via exponential forgetting curve; you can purge manually
• Finance & Habit logs: retained until you delete them
• Notifications: app, time and title snippet deleted after 30 days; bank notification text kept with its transaction until you delete it; unread bank notifications deleted after 90 days
• Health Connect data: 90 days on your device (see Health Connect above)
• Auth credentials: deleted immediately on account deletion

These services receive data from SaveFix, each only for the purpose stated, and no others do:

• Firebase Crashlytics — crash reports only, to diagnose failures. Enabled in released builds, disabled in development builds.
• Google AdMob — advertising. AdMob reads your device's advertising identifier. Where consent is legally required, ads are personalised only if you grant it in the consent dialog shown on first launch; if you decline, ads are non-personalised. You can reset or clear the advertising identifier at any time in your device settings.
• AppsFlyer — measures which of our own advertising campaigns led to an install of SaveFix, so we can tell whether the ads work. It receives your device's advertising identifier, an identifier it creates for this installation, your IP address, the install source reported by Google Play, basic details of the phone and the app (such as model, Android version, app version and language), and when the app is opened. It receives nothing you enter in SaveFix: no notifications, finances, habits, health data or account details. It runs in released builds only, and starts once the consent check described under AdMob has finished; where consent is legally required and you do not give it, it does not start, and if you withdraw it later it stops. Installs are reported, together with the advertising identifier, to the advertising network we run campaigns on (currently Snapchat), which matches them against its own ad views and clicks; this can include installs that did not come from an ad. You can reset or clear the advertising identifier at any time in your device settings.
• Google Gemini, with OpenAI as a fallback — only when you turn Cloud AI on, as described above.
• Email delivery: Brevo, with Resend or an SMTP mail relay as fallbacks — to send your sign-in code. They receive your email address and the code, nothing else.
• Google and Apple — only if you choose to sign in with them, to confirm who you are.
• Google Play — to confirm a purchase with the store that made it.
• Our hosting providers — Hugging Face runs our server and Cloudflare runs the relay that carries Cloud AI requests. They handle what reaches our server — your account, the encrypted backup, Cloud AI requests — only so the service can run.

• Export: all your data as JSON via Settings → Export My Data
• Delete: Settings → Delete All Data (irreversible)
• Revoke: any permission can be revoked at any time via Android Settings

For privacy inquiries: mohamedelsayedarmy95@gmail.com