Privacy Policy

1. Who we are

SavedThat is a service operated by Polev Digital FZ-LLC, a Free Zone Limited Liability Company registered in Ras Al Khaimah Economic Zone (RAKEZ), United Arab Emirates, with registered office at VUPR1563, Compass Building - Al Hulaila, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates. Licence No. 47034173. Registration No. 0000004091437. References to "we", "us", and "our" in this policy mean Polev Digital FZ-LLC trading as SavedThat. The service is available at savedthat.app and as a mobile application. This policy describes how we handle your data when you use our services.

2. What we collect

We collect the minimum data necessary to provide our service:

Account information — email address, name (optional), and avatar (optional) provided during registration via email or OAuth (Google, Apple).

Video data — URLs you save, video titles, thumbnails, and transcripts generated from public video content. We do not store the video files themselves (see section 4 for how Instagram and TikTok videos are processed).

Search data — your search queries and result counts, used to improve search quality and provide your analytics dashboard.

Usage data — privacy-focused product analytics (PostHog) such as feature usage and pageviews, and error logs (Sentry). In the mobile apps this covers the screens you open, taps on key actions (for example opening a moment from search), failed actions, app version, device model and OS, and an identifier generated by the app; it is linked to your account once you sign in. It never includes your saved videos, links or the text of your searches. On the website we may record how the pages of a new account are used during its first day (clicks, scrolling and navigation) to find where people get stuck; in these recordings everything you type and all text and images from your library are hidden. We may also show different versions of a page to different visitors to see which works better. In the EEA, UK, and Switzerland, analytics is enabled only after you consent via the analytics banner on the website or the prompt in the app; declining does not affect the service. Everywhere else you can switch it off at any time in the app under Settings → Usage analytics. Separately from that setting, our servers record that an action happened (for example, an account was created or a video was saved or searched) together with your account ID and the kind of app used, to operate and measure the service; this uses no cookies or device identifiers. We do not sell your data, and we do not use advertising pixels without consent where consent is required.

When you are signed in, our analytics profile (PostHog) is linked to your account ID and holds your email address, plan and app language as profile properties (not inside individual events), so we can understand how the product is used and answer support requests. Your email, name and location are removed from that profile when you delete your account (section 7).

Crash and error reports — when the website or an app crashes or an error occurs, Sentry receives a technical report: the error and stack trace, app version, device model and OS, and in the apps your account ID. It does not include the content of your library or your searches. On the website, a small sample of sessions may be recorded to diagnose errors; in those recordings all text, inputs and images are masked.

Questions you ask the AI — when you use AI features (answers on top of your search results, asking a question about a video, summaries, step-by-step instructions, and answers from creator libraries), we send your question and the relevant transcript excerpts to OpenAI to generate the answer. We may keep your question and the generated answer to show them to you again, to enforce usage limits and to fix quality problems; they are deleted with your account. If you report an answer as wrong or inappropriate, we keep the report (the kind of answer, your question and an excerpt of the answer) to review it; reports are deleted with your account.

Push notifications — if you allow notifications, we store the push token of your device or browser (and the device name and platform) to tell you when a saved video is ready or to send the notifications you enabled. Mobile notifications are delivered through Expo's push service and Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android). You can turn notifications off in Settings or in your device settings; tokens are deleted with your account.

Payment information — we never see or store your card details. Purchases on the website are processed by Stripe; we store your Stripe customer ID to manage your subscription. Purchases in the iOS app are processed by Apple through the App Store, and purchases in the Android app by Google through Google Play, under their own terms and privacy policies. We use RevenueCat to manage in-app subscriptions: it receives an app user ID (your SavedThat account ID), the purchase receipts and transactions from the store (product, price, currency, purchase and renewal dates, trial and cancellation status) and basic device information (such as platform and app version), and tells our servers which plan is active. We store the resulting plan, its expiry date and the store transaction IDs.

3. How we use your data

We use your data to: provide and maintain the service (saving videos, transcription, semantic search, AI answers and summaries), communicate with you about your account or service changes, monitor and fix technical issues via error tracking (Sentry), and process payments via Stripe, the App Store or Google Play.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Third-party services

We use the following services to operate:

Supabase — database and authentication (hosted in US-West). OpenAI — text embeddings for semantic search (your search queries and video transcripts are sent for embedding generation) and generation of AI answers, summaries and step-by-step instructions (your question and the relevant transcript excerpts are sent to generate the answer). Under OpenAI's API terms, by default data sent through the API is not used to train OpenAI's models. In the iOS and Android apps we ask for your permission before your first question is sent to OpenAI, and you can use the rest of the app without it. Stripe — payment processing on the website. Apple (App Store) and Google (Google Play) — payment processing for in-app purchases. RevenueCat — management of in-app subscriptions (app user ID, purchase receipts and transactions). Sentry — error monitoring (may receive technical error details, never personal content). Vercel — hosting. PostHog — product analytics (consent-gated in the EEA/UK/Switzerland; linked to your account ID and email when you are signed in). Expo, Apple Push Notification service and Firebase Cloud Messaging — delivery of mobile push notifications (push token and the notification text). Resend — delivery of account and service emails (your email address and the email content).

Processing the videos you save — to transcribe and describe a video you save, we send the public link of that video (never your name, email or account details) to these providers: Google (Gemini API) receives the YouTube link, or still frames of Instagram/TikTok videos, to describe what is shown; Google (YouTube Data API) receives the YouTube video ID to read public channel details; Supadata receives the video link to return its transcript, public metadata (title, author, thumbnail, duration) and, for Instagram and TikTok, a visual description; ScrapeCreators receives Instagram and YouTube links to return public metadata, a temporary media link or captions. For Instagram and TikTok we also use our own processing server, hosted by Fly.io, which fetches the public video only to transcribe its speech and sample frames, without keeping it in your library or our database; it may use the OpenAI and Gemini APIs described above for that. We never download YouTube video or audio.

These third-party services act as independent data processors under GDPR Article 28. They are not affiliated or related entities of Polev Digital FZ-LLC. Data Processing Agreements (DPAs) are in place with each processor handling personal data.

Connecting AI assistants (MCP) — you may connect a third-party AI client (such as Claude or ChatGPT) to SavedThat using OAuth ("Sign in with SavedThat"). When you do, you explicitly authorise that client to read your saved videos and their transcripts on your behalf so you can search them inside that assistant. Any prompts, results, or transcript excerpts you then use are processed by that assistant's own provider under their privacy policy — not ours. Access is read-only, granted only after a consent screen, and you can revoke any connected app at any time from Settings → Connected apps.

5. Google user data

YouTube import — if you choose to import from YouTube, SavedThat requests read-only access to your YouTube account through the scope https://www.googleapis.com/auth/youtube.readonly. This step is optional: you start the import yourself, and the rest of SavedThat works without it.

What we access — only the video lists you ask us to import (your Liked videos and your Watch Later list) and the public metadata of the videos in them: title, author, duration, thumbnail and video id.

How we use it — solely to add those videos to your own SavedThat library so that you can search them by what is said in them. We do not use this data for any other purpose.

What we store — the video identifiers and public metadata described above, inside your library. We never store your Google or YouTube credentials. The OAuth token is kept only for as long as it is needed to run the import, and it is revoked when you disconnect the integration or delete your account.

What we never do — we do not sell this data, do not use it for advertising or credit decisions, do not transfer it to third parties except as needed to operate the service as described in this policy, and do not use it to develop, improve or train generalised artificial intelligence or machine learning models.

SavedThat's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Creator libraries

Some public YouTube channels are indexed as creator libraries, so people can search what was said and open the exact moment on YouTube. Sources: public videos and their captions, and the channel's public name and avatar from the YouTube Data API (YouTube API Services; see the YouTube Terms of Service and the Google Privacy Policy). We never download video or audio, and we do not use these transcripts to train AI models.

Legal basis for the creators' data: legitimate interest (GDPR Art. 6(1)(f)), helping people find and revisit public videos with links back to the source. A channel owner can object and have the channel removed at savedthat.app/creators/opt-out; we reply within 24 hours.

Questions asked of creator libraries and the answers we generate are kept for up to 12 months to run the feature, prevent abuse and measure quality. When you ask without an account, we keep a random identifier stored in a cookie and your country, not your name or email.

7. Data retention

Your data is retained as long as your account is active. When you delete your account, all your personal data (profile, saved videos, search history) is permanently deleted within 30 days. Shared video content (transcripts, embeddings) may be retained if other users have also saved the same video. Your email, name and location details are also removed from our product-analytics profile at the moment of deletion; the usage events that remain are tied only to a random identifier that no longer maps to any account.

8. Your rights

You can: access and export your data at any time, correct your profile information in Settings, delete your account and all associated data from Settings (GDPR-compliant cascade deletion), and opt out of non-essential communications.

To exercise any rights not available through the app, contact us at the address below.

SavedThat is operated from the United Arab Emirates and processes personal data in accordance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45/2021). If you are in the EU/EEA or the UK, we process your personal data in accordance with the GDPR / UK GDPR: in addition to the rights above, you may object to or restrict processing, request data portability, and lodge a complaint with your local supervisory authority.

Video creators: public transcript pages may include publicly available information about the creator of a video (such as the channel or account name). If you are a creator and want your transcript or associated information removed, see our DMCA & Content Removal page — we honor removal requests.

9. Security

We use industry-standard security measures including encrypted connections (TLS), row-level security policies on our database, secure API authentication with tokens, and no storage of payment credentials. However, no system is 100% secure — use the service at your own discretion.

10. Children

SavedThat is not intended for children under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. If we make significant changes, we will notify you via email or an in-app notice. Continued use after changes constitutes acceptance of the updated policy.

12. Contact

Questions about this policy or your data? Reach us at support@savedthat.app