Privacy Policy — Saving

Effective date: 2026-09-25

App: Saving (com.buildwisedigital.saving)

Published by: BUILDWISE DIGITAL, a registered business in Ontario, Canada ("BUILDWISE DIGITAL", "we", "us")

Privacy Officer: Privacy Officer, BUILDWISE DIGITAL — [email protected] — postal address available on request

Cette politique est aussi offerte en français.

The short version

Saving is a local-first personal spending tracker. Your financial data — transactions, balances, budgets, goals, receipts — stays on your device, encrypted. There are no user accounts, no cloud copy, no advertising, no usage analytics and no tracking, and we never sell your information. We cannot see your financial data, because it is never sent to us.

A few things do involve the internet, and we list every one:

• Three things that happen without a setting, none of which carries your financial data:
• Receipt scanning reads photos on your device with Google's ML Kit text recognition. The photo and its text never leave your device, but ML Kit itself sends Google diagnostic information (device and app details, performance metrics and a per-installation identifier). Because the component is built into the app, this can happen even if you never scan a receipt.
• Subscriptions. On the plans screen of the first-run tour, and when you open the subscription screen, subscribe or restore a purchase, the app contacts RevenueCat, our subscription service, to show current prices and record purchases, with a random identifier (never your name or email). If you have subscribed, the app also checks your subscription status when it starts.
• Rating the app. After you finish an import (never your first), the app may ask Google Play to show its own rating card. Google Play decides whether to show it, and the app learns nothing back — not whether you rated, nor what you wrote. If you do rate or review, that goes to Google Play under Google's terms and may be published as a public review; it never reaches us through the app.
• Three optional features, all OFF until you turn them on: email sync (to your own email provider), nearby stores and fuel (an approximate location to public OpenStreetMap servers), and the community price network (grocery prices to our server). Each is described below.

Information the app stores on your device

• Transactions you import or enter (date, amount, description, merchant, category, notes).
• Budgets, savings goals, categorization rules, debts, refunds and accounts you create.
• Settings (theme, display currency, language and the features you enable).

All of it is stored in an encrypted database (SQLCipher, AES-256). The encryption key is held in the device's secure keystore (hardware-backed where the device supports it) and is never stored in plain text. The app opts out of Android's automatic cloud backup, so no copy of the app's data is sent to your Google account; the only backups are the encrypted files you create yourself (see "Backups and exports").

What we collect, and why

We collect no name, email address, phone number or account (there are no accounts), no advertising identifier, no usage analytics and no crash reports. We never receive your transactions, balances, budgets, goals, receipts or backups.

The personal information that can reach us or our service providers is limited to:

Your network (IP) address is visible to any server your device connects to, as with any internet request; where we or our providers keep it, we say so below.

Optional features (all OFF by default)

Each of these stays off until you turn it on, and you can turn it off at any time in Settings.

1. Email sync

The app connects directly to your email provider over an encrypted (TLS) connection to look for receipts. Your email address and app-specific password are stored only in your device's secure keystore, are used only to reach your provider, and are never sent to us or anyone else. Turning the feature off deletes them from your device.

2. Nearby stores & fuel

With your permission, the app sends your approximate location (rounded to about one kilometre) over HTTPS to public OpenStreetMap map servers run by independent operators in Europe (overpass-api.de, overpass.kumi.systems, overpass.openstreetmap.fr) to find stores and fuel stations near you. Like any internet request, those servers also see your network address; they operate under their own policies. Only the coarse location is sent — never your transactions, balances or name. The app uses foreground location only and asks only for approximate location. Map and store data is © OpenStreetMap contributors (ODbL), credited in the app.

3. Community price network

This answers "which store near me is cheapest for this item?" using what other shoppers have paid.

What is sent. After you scan a receipt, your device sends price observations to our server (prices.buildwise-digital.com, hosted by Cloudflare in the United States): the item, its per-unit price, the currency, the store chain (a brand such as "No Frills" — never a store number, address or specific outlet), the week of purchase and an approximate area rounded to about three kilometres. Health, sexual-health and pharmacy items are never sent. If the device does not recognize the store as a known chain, no store is sent.

What we keep, and what it means. Like any website, our server sees your network address. It does not store it. It stores a one-way, salted code derived from your network address and the week, which groups your contributions within that week so one person can't flood a price. The code is not linked to your name, device or transactions. This data is pseudonymous, not anonymous: someone who held the secret salt and already knew your network address for that week could recompute the code, and in an area with only one location of a chain, a price could indicate which store it came from.

Who sees prices. A price is shown only once at least five contributors have reported it. Asking "where is this cheapest?" sends only the item, the currency and the same approximate area.

Retention and your control. Observations are deleted automatically after 90 days. Turning the feature off stops contributions immediately. Because we store no identifier of you, we cannot find one person's past observations to delete on request; every observation expires within 90 days.

4. The money guide and coach

The savings coach and the money guide run entirely on your device. Nothing you type is sent to any AI provider, and the app contains no connection to one. (An optional bring-your-own-AI integration in earlier test versions was removed on 2026-07-30; any key it stored is erased by "Delete all data".)

5. Backups and exports

You can create an encrypted backup protected by a passphrase you choose, or export a plain (unencrypted) CSV. The app hands the file to your device's save/share dialog; where it goes is your choice. We receive none of these files.

Receipt scanning and Google ML Kit

Receipt text is read on your device by Google's ML Kit text-recognition component; the photo and the text read from it never leave your device. Google states that ML Kit's Android SDKs send Google device information, app information, performance metrics and a per-installation identifier for diagnostics and usage analytics, to maintain and improve ML Kit (https://developers.google.com/ml-kit/android-data-disclosure). We do not receive this information. It does not include your photos, the text read from them or any financial data.

Subscriptions and purchases

Premium (the per-goal "Coach me" plan and the money-guide chat) requires a paid subscription after the free period the app grants on first install. Viewing, importing, exporting, backing up and deleting your own data never require a subscription.

• Google Play Billing processes the payment. Your payment details go to Google under Google's terms and privacy policy; we never receive them. Google may give us purchase-level information about your order (for example the product, price, date and region) as the seller.
• RevenueCat (RevenueCat, Inc., United States) is our subscription-management service provider. The app contacts it only when you open the subscription screen, subscribe or restore a purchase — and, once you have subscribed, when the app starts, so renewals, cancellations and payment problems are reflected. It receives a random identifier generated by the app (not your Google account, not a hardware or advertising identifier), the purchase and subscription status Google Play reports, the app version, platform and OS version, locale and currency, and your network address. It never receives your name, email, transactions, budgets, goals, receipts, backups or location.
• Retention. RevenueCat keeps the purchase record for as long as needed to manage the subscription and to meet legal obligations. Your identifier is shown in Settings as a "Billing support ID"; email it to us and we will have that record deleted, subject to Google Play's own records of the purchase.
• Reminders. If you have a yearly plan, the app schedules a local reminder about three weeks before it renews.

RevenueCat's privacy policy: https://www.revenuecat.com/privacy.

Where your information is processed

Our service providers and the other services described above are located outside Canada: RevenueCat and Cloudflare in the United States, Google globally, and the OpenStreetMap servers in Europe. Information they process may be accessible to the courts, law-enforcement and national-security authorities of those countries. We choose providers that protect information to a standard comparable to Canadian law and use contractual protections with our service providers.

Permissions the app requests

• Approximate location (while using the app) — only if you turn on Nearby stores & fuel or the community price network. The app never asks for precise or background location.
• Camera — only when you choose to photograph a receipt. The photo is read on your device.
• Notifications — for local reminders and nudges created on your device. No notification content is sent anywhere.
• Photos (system photo picker) — only the single image you pick; no broad media or storage access.

The app does not request access to your microphone, contacts, SMS or call logs.

How your data is protected

• The on-device database is encrypted with AES-256 (SQLCipher); keys and credentials are kept in the device's secure keystore.
• An optional app lock requires your biometrics or device passcode.
• Screenshots and screen recording of the app's screens are blocked.
• Every connection the app makes uses encryption (TLS/HTTPS).

If a breach of security safeguards involving personal information under our control creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada (and, for Quebec residents, the Commission d'accès à l'information du Québec) as the law requires, and we keep a record of any such breach.

Your rights and choices

• Your on-device data is yours to view, export or erase at any time. "Delete all data" in Settings erases every transaction, budget, goal, setting and stored credential; uninstalling removes it too.
• Withdrawing consent: turn any optional feature off in Settings; it stops immediately.
• Access and correction: you may ask us what personal information we hold about you and have it corrected or deleted. Because we hold no account or profile, this usually concerns only a subscription record at RevenueCat (identified by your Billing support ID) or an email you sent us.
• Complaints: contact our Privacy Officer first. You may also complain to the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca) or, in Quebec, the Commission d'accès à l'information (https://www.cai.gouv.qc.ca).
• Residents of U.S. states with privacy laws: we do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. You may exercise any access, correction or deletion rights your state provides by emailing us.
• Do Not Track: the app does not track you across other apps or websites, and no third party collects information about your activity over time through it, so there is nothing for a Do Not Track signal to change.

Children

Saving is a personal-finance tool for adults: it is intended for people who are 18 or older (or the age of majority where they live) and is not directed to children. We do not knowingly collect personal information from children.

Trademarks

Names of banks, payment providers, merchants and services that appear in your data or in the app's categories belong to their owners and are used only to describe or categorize your transactions. Their appearance does not imply any affiliation or endorsement.

Changes to this policy

If this policy changes, we will post the new version at this address with a new effective date, and tell you in the app before a material change takes effect.

Contact

Privacy Officer, BUILDWISE DIGITAL — [email protected] — postal address available on request