Privacy policy

1. Responsible entity and contact

Savoli is presented under the public developer name Brm Studios. The responsible entity is Brm Agency LLC, at Sharjah Media City, Sharjah, United Arab Emirates, 00000. For privacy questions or rights requests: superdev@brmagency.co.

2. Data and purposes

• Account: name and email supplied through Sign in with Apple, Firebase account ID and authentication information, to create and protect your session.
• Recipes: the public link you submit, source metadata, extracted recipe, edits, personal notes, translated versions, recipe photos, folders, meal plans, grocery lists and preferences, to provide the features you request.
• Subscription: account ID, product, purchase status and Premium entitlement, to display offers, restore purchases and control access.
• Sharing: local handoff state and a snapshot of the recipe you choose to share, its source and available photo. Personal library notes are excluded from that snapshot.
• Import notifications: installation ID, Apple push token, account, language, delivery state and import association, to notify you when an import is ready if you enable this feature. These device identifiers are linked to your account for notification functionality. The share extension uses the shared installation ID; the app registers the Apple push token.
• Support: your contact details and information you choose to send, to answer your request.
• Operation and security: technical logs, metrics and service events to operate the service, diagnose failures and avoid processing the same event repeatedly.

Savoli does not use these identifiers for advertising or cross-app tracking. Link import does not need access to contacts, location, your microphone or your iPhone photo library. Processing media from a public source is separate from accessing your device’s photo library.

3. Sources of information

Information comes from you, Sign in with Apple, the App Store and the public pages you choose to import. Savoli receives the link you submit; it does not inspect your general browsing activity.

4. Services involved

• Apple: sign-in, App Store purchases and push notification delivery.
• Firebase and Google Cloud: authentication, API, processing queues, database and storage; Google Vision reads text from source images, and Gemini extracts, structures and translates recipe text.
• RevenueCat: offers, subscription status, restoration and Premium access.
• The source site and Apify: accessing the public page or media you requested; Apify is used when the initial source-retrieval method does not provide the needed evidence.
• OpenAI: transcription of source audio when needed to understand the recipe, and text recognition from source images if the primary OCR service fails and this fallback is configured. These uses are separate from Gemini recipe extraction and translation.

Our main recipe database and file storage are hosted in Belgium. Gemini recipe processing uses Google’s European Vertex endpoint. Other services may process data outside your country: Firebase Authentication and RevenueCat operate in the United States, and OpenAI, Apify and their subprocessors may process data internationally.

Providers processing data on our behalf are subject to contractual limits on use, confidentiality and security, including protection of the data by their subprocessors. Where required for international transfers, their data-processing terms provide safeguards such as standard contractual clauses. Details are available in the Google Cloud, OpenAI, Apify and RevenueCat data-processing terms. Contact us for information about safeguards applicable to your data.

Automated processing, translation and sharing

Extraction may process text, images, video frames and audio from the public source. An eligible extraction may be reused when several people request the same source. It is separate from your personal organization.

When you open a saved recipe, its text may be sent to Gemini for English or French display, including edits to titles, ingredients and steps. Personal notes are excluded from translation. The original remains available for editing and when translation fails. Translations of verified public source content may be reused; translations of private content remain associated with your account.

Sharing creates a snapshot of the original or your edited version, retaining the source links. Preview requires sign-in. A person with the link can save a separate copy, including an independent photo copy when available. Share only public links and content you have the right to share. A source link can itself contain identifying information.

5. Basis for use

Account, library and subscription information is used to provide the service you request. Fraud, abuse and reliability protections support service security. Some information may need to be retained under applicable law, including billing information held by Apple.

6. Retention

Your account and personal library data are kept while your account is active to provide your saved recipes and account features. You can delete your account as explained below. Sharing links associated with your account are deactivated when you delete that account. Public extraction and translation caches and copies already saved by recipients remain available independently of your account.

Temporary import-processing files are removed when processing ends. A cleanup failure can delay removal. Deleted database versions remain recoverable for up to seven days; deleted stored files have a seven-day recovery period. These recovery copies are separate from the active library.

Routine service logs are retained for 30 days. Required cloud audit logs are retained for 400 days. Minimal subscription-event records are kept separately to prevent duplicate or out-of-order processing and are not removed by account deletion; they contain the event identifier, type and timestamps, not your recipe library. They do not have a configured automatic expiry. Support correspondence is kept for handling your request and any related follow-up, dispute or legal obligation; you can request its deletion through the contact above.

Provider retention depends on the service and purpose. Firebase states that authentication data is removed from live and backup systems within 180 days after user deletion, and that logged IP addresses remain for a few weeks. OpenAI lists no retained application state or abuse-monitoring content for the transcription endpoint used here; image OCR requests can be retained for abuse monitoring for up to 30 days, with safety or legal exceptions. Google may retain AI processing data for abuse monitoring and short-lived caching. Apify source-processing records follow its account/storage retention rules. RevenueCat and Apple may retain records for billing, legal obligations or disputes. These provider records are not all erased by deleting your Savoli account. See Firebase retention, OpenAI data controls, Apify storage retention and RevenueCat privacy.

On your device, sharing sessions expire logically after 24 hours and handoffs after seven days; stored values can remain until replaced, cleared or uninstalled. Contact us to request deletion of retained personal data or shared content; we assess the request against the affected data, other users’ independent copies and applicable obligations.

7. Account deletion

Open More → Account → Delete my account and reauthenticate with Apple. Savoli deletes account-owned active server data, including imports, personal recipes, private translations, folders, plans, groceries, preferences, notification registrations and relevant intermediate files. It requests deletion of the RevenueCat customer and removes the Firebase account.

Sharing links associated with your account are deactivated and their hosted publications and photos are deleted. Copies that recipients have already saved in their own libraries remain available. Reusable public extractions and public translations are also not erased solely because you delete your account; your extraction membership is removed. Contact us about shared-content requests.

Account deletion does not cancel an App Store subscription. Manage it separately in Apple subscription settings. Apple billing records, minimal technical events, backups and provider-held information remain subject to the retention limits above.

After account deletion and RevenueCat logout succeed, Savoli disables the weekly reminder and clears account preferences, its response cache and local App Group session/handoff values. Copies managed by iOS or providers may remain subject to their retention limits.

8. Choices and rights

Depending on applicable law, you may request access, correction, erasure, restriction or portability and object to certain processing. You may contact the competent data-protection authority. Identity verification may be needed to protect your account.

The optional weekly reminder is local. Import-ready notifications use Apple push notifications and server registration. You can disable notifications in Savoli or iOS settings.

9. Security and updates

Savoli uses Apple/Firebase authentication, account-based authorization and protected operational services. No system can guarantee absolute security. Material policy changes will be published with an updated effective date. Visit Savoli support for questions.