Saved Privacy Policy

The party responsible for the app and this policy — the “data controller” under the GDPR and the “veri sorumlusu” under Türkiye's KVKK (Law No. 6698) — is:

• Controller: FGY Limited Şirketi (trading as “FGY Software”)
• Address: Söğütözü Mah. Söğütözü Cad. No: 2C/17 Çankaya/Ankara, Türkiye
• Contact for privacy matters: hasan@fgysoftware.com
• App bundle identifier: com.fgysoftware.savedapp
• EU/UK representative (Art. 27 GDPR): We have not appointed an EU/UK representative at this time.

If you have any question about this policy or wish to exercise your rights, write to us at the address above and we will respond within the periods required by applicable law.

Understanding the pipeline makes the rest of this policy easier to read. When you save something:

• You add content from inside the app or through the iOS Share Extension — a link, up to ten images, or plain text. Screenshots and photos you pick are downsampled on your iPhone and uploaded to our image storage.
• For links, our backend fetches the public page and reads its metadata (title, description, author, embedded preview, page text). We identify ourselves as “SavedBot/1.0”.
• That material — page text, your own note, and, for screenshots and photos, the image itself — is sent to a third-party AI provider, which classifies it into a card type and extracts structured fields (for example ingredients and steps for a recipe, or an address and opening hours for a place).
• For some card types the result is enriched from public catalogues: film and series data from TMDB, book data from Google Books.
• The finished card is written to your private area of our database and appears in the app.

Saving never fails because of the AI step. If your monthly rich-card allowance is used up or the AI step errors, the item is still stored as a basic card.

This is the section most people want, so we are explicit about it.

What is sent

• For a saved link: the source URL, the page's title, description, author, embedded preview markup and page text (each truncated), plus any note you wrote.
• For a saved screenshot or photo: the image itself, made available to the provider through a signed link that expires after 15 minutes. Whatever is visible in that image is processed.
• For the Decide feature: the card titles and a one-line derived summary of up to 50 of your saved items. Your notes, the source URLs and your images are not sent to Decide.

Who it is sent to

We route AI requests through OpenRouter, which forwards them to an underlying model provider. The model we use is configurable on our side and may change as better models become available; at the time of writing the default model is served by MiniMax. Because OpenRouter selects among providers, the request may be handled by a provider outside your country.

Retention and model training

We do not use your content to train any model of our own, and we do not sell it. What happens to a request once it reaches the model provider is governed by OpenRouter's policies and the policies of the provider that handles it — we cannot make a stronger promise than the one we can keep. Treat anything you save as content that has been processed by a third party.

We do not send your account identifier, name or email address to OpenRouter or to the model provider. Requests carry the content, not your identity.

Protections we do apply

• Content pulled from third-party pages is passed to the model inside an explicit “untrusted content” boundary, with instructions never to follow commands found inside it. This is a defence against prompt-injection attacks embedded in web pages.
• The amount of text sent is capped per field, and the model's output is validated against a strict schema before it is stored.
• Image links given to the provider expire after 15 minutes and cannot be reused afterwards.

AI output is not guaranteed to be correct

Ingredients, opening hours, addresses, event dates and summaries are produced by a language model and can be wrong or incomplete. Where a recipe source shows only a finished dish, the model may infer a plausible ingredient list rather than report the real one. Always open the original source before relying on a card — and see the AI disclaimer in the Terms of Service, which applies in full.

We measure how the app is used, and which advertising campaigns bring people to Saved. This is a separate purpose from running the app, so we describe it separately.

What is measured

The app emits a fixed set of 22 event types — for example that a save was started, that a card of a given type was opened, that a paywall step was shown, that a trial started, that a search was performed, that onboarding finished. Each event carries only fixed labels, booleans and counts.

Who receives it

• Firebase Analytics (Google) — product analytics, always active.
• Amplitude — product analytics.
• Adjust — install attribution and SKAdNetwork postbacks.
• Meta — advertising measurement for campaigns run on Meta platforms.
• TikTok — advertising measurement for campaigns run on TikTok. This integration is controlled by a remote setting and is off unless we enable it.

Purchase amounts are not sent to any of these providers from the app; subscription state reaches us through RevenueCat instead.

App Tracking Transparency (ATT)

Because Adjust, Meta and TikTok are used for advertising measurement, iOS asks for your permission to track you across apps and websites owned by other companies. If you decline, no advertising identifier (IDFA) is made available and cross-app tracking does not take place; the app works exactly the same, and — as the prompt says — your saves stay private either way. Product analytics that do not rely on the advertising identifier continue in both cases.

You can change this at any time in iOS Settings → Privacy & Security → Tracking, and you can limit Apple's own ad personalisation in Settings → Privacy & Security → Apple Advertising.

We do not sell your personal data and we do not share it with anyone except the providers below, each acting for us or as an independent controller for the stated purpose.

We may also disclose data where we are legally required to do so, or where it is necessary to establish, exercise or defend legal claims.

Our Firestore database and our Cloud Functions run in Google Cloud's us-central1 region in the United States. Uploaded images are stored with Cloudflare R2. AI requests are processed by OpenRouter and the provider it routes to. Several of the providers in section 6 are also established outside Türkiye and the EEA.

This means that if you are in Türkiye, the European Economic Area, the United Kingdom or Switzerland, your personal data is transferred outside your country.

For users in the EEA, the UK and Switzerland

Transfers to countries without an adequacy decision are made under Article 46 GDPR on the basis of the European Commission's Standard Contractual Clauses concluded with the relevant providers, together with the supplementary measures described in section 10 (encryption in transit, access controls, per-account isolation of stored objects). You may request further information about the safeguards in place by writing to us.

For users in Türkiye

Transfers abroad are made in accordance with Article 9 of the KVKK. Where the destination country has not been declared adequate by the Personal Data Protection Board and no appropriate safeguard mechanism recognised under Article 9 applies, we rely on your explicit consent, which you give when you create an account and accept this Policy. You may withdraw that consent at any time by deleting your account; note that Saved cannot produce cards without transferring content abroad, so withdrawal means the service can no longer be provided to you.

Where the GDPR applies, we rely on the following legal bases (Art. 6(1) GDPR):

Under the KVKK, the corresponding grounds are Art. 5/2(c) (necessary for the performance of a contract), Art. 5/2(f) (legitimate interests), Art. 5/2(ç) (legal obligation) and, where indicated above, your explicit consent under Art. 5/1.

Saved asks for four iOS permissions. Each is optional, each is asked for in context, and none of them is required to keep using the parts of the app that do not depend on it.

Photos

Prompt text: “Saved reads the screenshots and photos you pick to turn them into cards.” The app requests access to your photo library so you can pick screenshots to save. Only the images you actually select are read and uploaded — Saved does not scan or index your library. You may grant access to selected photos only. If you decline, you can still save links and notes, and you can still share images into Saved from other apps.

Location (while using the app)

Prompt text: “Saved shows your saved places near you on the map.” Your location is used to centre the map, sort your saved places by distance and display “400 m” style labels. Your location is processed on your device only: it is never written to our database, never attached to a search we send to a mapping provider, and never included in an analytics event. If you decline, the map still works — it simply does not know where you are.

Notifications

Used to tell you that a card is ready, to deliver reminders you set, the weekly digest, trial reminders and a warning when your monthly allowance is nearly used. You can turn each category off individually in the app's settings, or all of them in iOS Settings. Please note that some notifications include the title of a saved card in their text, which means the title can appear on your lock screen and passes through Apple's push service.

Tracking (App Tracking Transparency)

Prompt text: “This lets Saved measure which ads bring people to the app. Your saves stay private either way.” See section 5.

• All traffic between the app, our backend and our providers is encrypted in transit with TLS.
• Your saves, collections and digests live under your own account path in the database, and access rules prevent one account from reading another's.
• Uploaded images are private. They are not published on any public URL: they are written to and read from a per-account path, and every read requires a signed link that expires after 15 minutes. The storage bucket is shared with another FGY project, and Saved's objects are confined to a dedicated prefix that our backend enforces on every read, write and delete.
• Requests to fetch a page you saved are checked to prevent them being redirected at internal network addresses, and are subject to size and time limits.
• Content taken from third-party pages is neutralised before it reaches the AI model, as described in section 4.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the competent supervisory authority where the law requires it.

Depending on where you live, you have some or all of the following rights: access to your data, correction, erasure, restriction of processing, objection to processing based on legitimate interests, data portability, withdrawal of consent, and the right not to be subject to solely automated decisions with legal or similarly significant effects (Saved makes no such decisions). Under the KVKK you additionally have the rights listed in Article 11, including the right to learn whether your data has been processed and to request that third parties be notified of any correction or erasure.

Two of these you can exercise yourself, immediately

• Export your data — Settings → Export data. This produces a file containing your profile record, all of your saves, your collections and your digests. Note that it contains the storage references for your images, not the image files themselves; you can save those from your device or ask us for a copy.
• Delete your account — Settings → Delete account. This deletes your saves, collections, digests and the internal duplicate index, the images you uploaded, and your account with our authentication provider.

For everything else

Write to hasan@fgysoftware.com. We will respond within 30 days (KVKK) or one month (GDPR), extendable where the law permits. There is no charge unless a request is manifestly unfounded or excessive.

If you believe we have not handled your data properly, you may complain to your local supervisory authority — in Türkiye, the Personal Data Protection Authority (KVKK Kurumu); in the EEA, the authority of your habitual residence; in the UK, the Information Commissioner's Office.

We keep your account data for as long as your account exists. Individual saves are kept until you delete them. Your monthly allowance counter resets each calendar month.

When you delete your account, the following are removed:

• Your saves, collections and weekly digests
• Your profile record, including your onboarding answers, notification preferences and subscription state
• The internal index we use to detect duplicate links
• The screenshots and photos you uploaded
• Your account with our authentication provider (Clerk), which holds your email address and name

In the interest of accuracy, the following may remain after deletion:

• Technical logs held in Google Cloud Logging, which may contain your account identifier, storage keys and lookup queries, until they age out under our project's log retention setting
• Encrypted database backups, which are retained for 7 days on a rolling basis before being overwritten
• Your subscription record at RevenueCat and your purchase record at Apple, which are governed by those providers' own policies and by our accounting obligations
• Analytics events already collected, which are not linked to your account identifier and cannot be individually retrieved by us
• In the rare case that the deletion of your images or of your authentication account fails, that step is retried; if you want confirmation that it completed, write to us

Saved is not directed at children. You must be at least 16 years old to use Saved if you are in the European Economic Area or the United Kingdom, and at least 13 years old elsewhere; where your country sets a higher digital-consent age, that age applies. We do not knowingly collect personal data from anyone below that age.

If you believe a child has provided us with personal data, write to hasan@fgysoftware.com and we will delete the account and its data.

We may update this Policy as the app changes. The date at the top of this page always reflects the current version. If a change materially affects how we process your data — a new category of data, a new purpose, a new class of recipient — we will tell you in the app before it takes effect, and where the law requires it we will ask for your consent again.

• FGY Limited Şirketi
• Address: Söğütözü Mah. Söğütözü Cad. No: 2C/17 Çankaya/Ankara, Türkiye
• Email: hasan@fgysoftware.com