Privacy Policy

1. Introduction

Savyng ("we", "us") is a personal asset tracker. This policy explains what we collect, why, who processes it for us, how long we keep it, and how you can download or delete it.

2. Information We Collect

We collect the following:

• Account: your email address, display name and password. The password is stored only as a BCrypt hash, never in plain text.
• Google sign-in: if you continue with Google, Google gives us your email address and a stable, opaque account identifier. We never receive your Google password.
• Transactions: the asset symbols, quantities, prices, currencies, dates and notes you enter.
• Preferences: your preferred currency, the asset groups you track and your language.
• Country you live in: If you choose the country you live in (Profile), we store it only to pick the consumer-price index for your real return. We never set it from your connection. You can change it, or choose 'Prefer not to say', at any time.
• Portfolios: the names you give your portfolios, which one is the default, and which are archived.
• Savings goals: goal names, target amounts and progress.
• Portfolio history: a daily record of your portfolio's total value, for the history chart.
• Feature requests: if you tell us on your dashboard that you want a feature we haven't built, that request and your answer to its optional question (for multiple portfolios: how many places your assets are kept in). It is part of your account: you can download it, and deleting your account deletes it.
• Waitlist and pricing survey: if you join the beta waitlist or answer the pricing survey, the email address you give and your answers.
• Usage data: server logs with your IP address, browser type and the pages you visit.

3. How We Use Your Information

We use your information to:

• Provide the service: portfolio values, returns and prices for your assets
• Sign you in and keep your account secure
• Send transactional emails: address confirmation, password reset and account-deletion confirmation. We send no marketing email.
• Improve the service with anonymous, aggregate statistics (section 5)

4. Where Your Data Is Stored

Your account data is stored on servers run by Hetzner Online in Helsinki, Finland, in the European Union. Passwords are hashed with BCrypt, all traffic uses HTTPS, and sign-in sessions and API tokens expire automatically.

5. Service Providers Who Process Your Data

We do not sell or rent your personal data. These providers process it on our behalf, only to provide their service to us:

• Hetzner Online (hosting, Finland): stores all of the account data listed in section 2.
• Cloudflare (network and security): every request to savyng.app passes through Cloudflare, which processes your IP address and the traffic between your browser and us, including what you enter, to deliver it and protect the site from attacks.
• Resend (email delivery): receives your email address, your display name and the content of every email we send you.
• Google (sign-in, only if you choose it): sends us your email address and account identifier, and learns that you signed in to Savyng.
• Grafana Labs (server monitoring, EU region): receives our server's technical measurements (response times, error counts, memory and disk use, and totals such as the number of accounts) and its logs, so we can see when something breaks. It is set up to receive nothing that identifies you: the measurements are counts and timings, and email addresses, IP addresses, account numbers, Google account identifiers, passwords and access tokens are removed from the logs on our server before they are sent. The logs can still say what was done, such as which asset a trade was for, without the account it belongs to. Grafana Labs is a US company; we use its European Union region.

Cloudflare, Resend and Google are US companies, so some of your data (your IP address and traffic, your email address and name, your Google sign-in) can be processed outside Türkiye and the European Union.

To show prices and inflation figures, our server asks market-data and statistics providers (such as CoinGecko, Binance, Kraken, Finnhub, İş Yatırım, the European Central Bank via Frankfurter, Eurostat and precious-metal price services) for asset symbols and series codes. They receive nothing that identifies you.

We also use one analytics service:

• Plausible Analytics: anonymous, aggregate usage statistics.

Plausible records, for each page view: the page address, the referring site, your browser and operating system, your country, a screen-size category, whether your viewport is narrower or wider than 768 pixels, and whether you opened the app from your home screen or in a browser tab. It sets no cookies and stores no persistent or cross-site identifier, so page views cannot be linked to you or followed across other websites. Your IP address and browser string are processed momentarily to generate a daily-rotating, non-reversible hash that counts unique visits, and are not stored. Plausible is an EU company and this data is processed on servers in the European Union. We do not use it for advertising and we do not sell or share it.

6. Cookies

We set only the cookies the service needs:

• A session cookie that keeps you signed in during a visit. It ends when you sign out, when you close your browser, or after 2 hours without activity.
• A remember-me cookie that keeps you signed in for up to 30 days. Signing out deletes it.
• To end every session and remember-me cookie on all your devices at once, use Sign out of all devices on your Profile page. Changing your password signs out every other device; resetting it signs out all of them.
• A language cookie (one year), if you switch the language.
• A country cookie (one year), if you pick a country on the home page.

We use no tracking or advertising cookies. Our analytics service is cookieless and stores nothing on your device.

7. Data Sharing

Apart from the service providers in section 5, we do not share your transactions, portfolio or savings goals with anyone. We would disclose data only if the law required it.

8. How Long We Keep Your Data

We keep your data for as long as your account exists. Email confirmation links expire after 24 hours and password reset links after 30 minutes. We back up the database every day and keep each backup for 7 days; our hosting provider also keeps daily backups of the server for 7 days.

9. Download or Delete Your Data

• Download your data: on your Profile page, "Download all my data" gives you a JSON file with everything stored about your account: profile and settings (including your preferred currency and country), portfolios, transactions, savings goals, watchlist, portfolio history, and any waitlist signup or survey answers made with your email address. You can also download your transactions as a CSV file.
• Delete your account: on your Profile page, "Delete account" deletes your account at once and permanently. You confirm by typing your email address and your password, or, if you sign in with Google, by signing in with Google again. We delete your profile, portfolios, transactions, savings goals, watchlist, portfolio history, emailed links and any waitlist signup with your address. Pricing-survey answers are kept without your email address or any link to you. We then send you one confirmation email. A deletion cannot be undone.
• Backups: copies of deleted data can remain in our backups until they are overwritten: database backups are kept for 7 days, and our hosting provider's daily server backups, which include them, for another 7. Within 15 days of a deletion, no backup holds your data any more. We use backups only to recover from a failure.

10. Your Rights

Depending on where you live (for example under KVKK in Türkiye or the GDPR in the European Union), you have the right to:

• Access your data and get a copy of it (section 9)
• Correct it in your profile settings
• Delete your account and data (section 9)
• Object to or restrict processing, and complain to your data protection authority

For anything you cannot do yourself on your Profile page, write to [email protected].

11. Changes to This Policy

We may update this policy. We will post the new version on this page with a new date.

12. Contact Us

Questions about this policy or your data: [email protected]