Privacy Policy

Effective date: June 5, 2026 Last updated: June 5, 2026 Version: 1.1

NOTE: This document is a developer-prepared draft. Legal counsel review before launch is recommended.

🇹🇷 Türkçe versiyon: Türkçe

1. Service Owner

Savelion ("the App", "we", "our") is a portfolio tracking service offered through this application.

Contact: support@savelion.app

2. Data We Collect

2.1 Account Information

Email address (when you register)
Display name (optional — you provide it)
Profile photo URL (if you sign in with Google)
Anonymous user ID (when you use the app without registering)
Whether your account is anonymous or registered

2.2 Investment Data

Data you provide while using the app — entirely entered by you:

Portfolio names and currencies
Position details (asset type, ticker, quantity, average entry price, opening date, optional notes and broker)
Transaction history (buy/sell trades, prices, dates)
Closed-trade realized P&L data
Preferences (display language, theme, display currency)
Onboarding answers (investment experience, asset class interests)

2.3 Automatically Collected Data

Anonymous usage stats (app launches, lifetime position count)
Crash reports and error logs (via Firebase Crashlytics — debugging only)
Device info (OS, app version)

We do NOT collect: location, contacts, photos (automatically from the gallery), microphone, health data, advertising identifiers (IDFA/AAID), browser history.

3. Device Permissions

3.1 Camera and Photo Library (AI Position Import)

The AI Import feature requests camera and photo library access in order to automatically read position details from screenshots you take from your broker apps. Access is requested only when you press "Pick from gallery" or "Take a photo"; no background scanning is performed.

The image you select or capture:

Is temporarily sent to the Anthropic Claude AI service over a secure HTTPS channel
The extracted position details (symbol, quantity, price) are pre-filled in the AddPosition form
The image itself is not stored on our servers; it is deleted after the analysis completes
Per Anthropic's usage policy, the image is also not retained by Anthropic for the purpose of training models

You can revoke the camera/photo library permission at any time from your device settings; the rest of the app continues to work without this feature.

3.2 Age-Signal Access

Savelion does not request a discrete user-facing permission for age signals; the signals are provided by Google Play (Android) and Apple (iOS) at the platform layer where required by law. You can manage your age status directly in your Google account or Apple ID settings.

4. Third-Party Services

We share data with the following providers:

Service	Provider	Purpose	Data shared
Auth + database	Google Firebase	Authentication, data storage	Account info, investment data
Cloud Functions	Google Firebase	Price fetch, snapshots, subscription webhook	User ID, portfolio ID
Subscription mgmt	RevenueCat	Pro subscription status	User ID, purchase receipt
Stock prices (US, EU, BIST)	Yahoo Finance (unofficial API)	Price data	Symbol only (no user ID)
Stock prices (US fallback)	Alpha Vantage	Price data	Symbol only
Crypto prices	CoinGecko	Price data	Symbol only
FX rates	Frankfurter (ECB)	Currency conversion	No user data shared
Crash reporting	Google Firebase Crashlytics	Error tracking	Anonymous device ID, crash stack trace

Yahoo Finance data is fetched via an unofficial API and may be delayed (up to 15-30 minutes). It must not be relied on for investment decisions — it is provided for informational purposes only.

5. Data Retention

Active users: Your data is retained as long as your account remains active.
Anonymous users: Anonymous accounts inactive for 30+ days with zero positions are automatically deleted (cleanupAnonUsersScheduled cron job).
Account deletion request: You can request full deletion via Settings → "Delete my account" in-app, or by emailing support@savelion.app. Requests are processed within 30 days.
Backups: Firebase automatic backups are deleted after 30 days.

6. Your Rights (KVKK + GDPR)

If you reside in Turkey (KVKK) or the EU (GDPR), you have the following rights:

Access: Learn what data we hold about you
Rectification: Correct inaccurate information
Erasure: Request full deletion ("right to be forgotten")
Portability: Receive your data in a machine-readable format (CSV/JSON)
Objection: Object to specific processing activities

For requests: support@savelion.app

7. Security Measures

All data transmission is encrypted via HTTPS/TLS
Passwords are never stored on our servers — Firebase Auth uses Google's bcrypt-based infrastructure
Firestore Security Rules ensure that only the account owner can read their own data
Webhook calls use secret-based authentication
Subscription status (isPro) can only be written by the server-side webhook; clients cannot manipulate it

8. Children's Privacy and Age Verification

The app is intended for users aged 13 and over. Where required by applicable law, we use the Google Play Age Signals API (Android) and Apple's Declared Age Range API (iOS) at runtime to receive a non-identifying age category for your account and, if applicable, your parent or legal guardian's consent status.

These signals are received from the mobile app store and used solely to (i) determine your eligibility for paid features, (ii) tailor the experience to your age category, and (iii) comply with applicable laws including Texas Senate Bill 2420, Utah Senate Bill 142, and equivalent laws.

The raw age-signal payload (age range, install identifier, parental approval timestamp) is processed on your device and is not retained after we have completed the verification, as required by Texas Business & Commerce Code §121.055(b). We store on our servers only a coarse decision tag (e.g. "allow", "restrict paid features") and a jurisdiction code so we can apply the same rules across your devices; we do not store your age range or any identifier returned by the age-signal APIs.

We do not share the age-signal payload with third parties. We do not use it for advertising, profiling, or analytics.

If we discover that a child under 13 has provided personal data, we will delete the account and, where required, notify the parent.

The Play Age Signals client library itself does not collect data on our behalf; Google Play Store handles the underlying data processing under Google's own terms (Google Play Terms of Service and the Age Signals API and User Data policy). See Google's data-safety information at developer.android.com/google/play/age-signals/overview. On iOS, Apple's Declared Age Range API is governed by the Apple Media Services Terms and the Apple Privacy Policy.

9. International Data Transfer

Your data is stored on Google Firebase infrastructure in the European Union region (europe-west1). Backups may be stored encrypted on Google's global infrastructure. All transfers are subject to GDPR Standard Contractual Clauses.

10. Cookies and Tracking

We do not use cookies in the mobile app. We do not use advertising identifiers (IDFA/AAID). We are not integrated with any third-party advertising network.

11. Policy Changes

When this policy is updated, we will display a notice in the app and update the "Last updated" date. For material changes, we may also notify you via email.

12. Contact

For questions about this privacy policy:

Email: support@savelion.app

This policy is in effect from June 5, 2026.