Privacy Policy

Last updated: August 27, 2026

1. Introduction

Savvx LLC ("SavvX," "we," "us," or "our") operates the SavvX credit card rewards optimization platform at savvx.com. This Privacy Policy describes how we collect, use, and protect your personal information when you use our service.

We take your privacy seriously. We do not sell your data. We do not display ads. We have no card partnerships. Our only revenue is your subscription fee.

2. Information We Collect

Account Information

  • Name, email address, and phone number (provided during registration)
  • Password (stored as a one-way hash — we cannot read your password)

Financial Information (via Plaid)

  • Bank account names and types
  • Credit card account details (name, issuer, APR, network)
  • Transaction history (merchant, amount, date, category)
  • Account balances

We connect to your financial institutions through Plaid Inc., a regulated financial data provider. We never see or store your bank login credentials — Plaid handles authentication directly. Our access is read-only; we cannot move money or make changes to your accounts.

Payment Information

Subscription payments are processed by Stripe Inc. We do not store your credit card number. Stripe handles all payment processing in compliance with PCI-DSS standards.

Usage Information

  • Server logs (IP address, request timestamps, pages visited)
  • Device and browser information (via standard HTTP headers)

3. How We Use Your Information

  • Rewards optimization: Analyzing your transactions to recommend the best credit cards for your spending patterns
  • Authentication: Sending SMS verification codes for account security
  • Coaching alerts: Sending optional spending coaching messages via SMS (opt-in only)
  • Service improvement: Understanding usage patterns to improve the product
  • Account management: Processing subscriptions, communicating about your account

4. What We Never Do

  • We never sell your personal or financial data to anyone
  • We never share your financial information (transactions, balances, card details) with advertisers. We share limited marketing event data (such as the fact that a signup occurred) with our advertising platforms — see Section 10.
  • We never use affiliate links or earn commissions from card issuers
  • We never display ads on the SavvX platform
  • We never access your bank login credentials

5. Data Sharing

We share data only with the following service providers, to operate SavvX and measure the effectiveness of our marketing:

  • Plaid Inc. — Financial data aggregation (bank connections, transactions)
  • Stripe Inc. — Payment processing
  • Twilio Inc. — SMS delivery (verification codes, coaching alerts)
  • ActiveCampaign, Inc. — Email delivery and mailing list management for SavvX's own messages (your email address and name only; no financial data is sent)
  • Railway Inc. — Cloud hosting infrastructure
  • Anthropic — AI processing for card data extraction (no personal data is sent)
  • PostHog Inc. — Product analytics (page views, signup and onboarding funnel events, session replays with all input values masked; no financial data is sent)
  • Google LLC — Tag management via Google Tag Manager (loads analytics scripts; does not itself collect user data)
  • Reddit Inc. — Advertising conversion attribution (signup and trial-start events only; no financial data is sent)
  • Meta Platforms, Inc. — Advertising measurement via the Meta Pixel (page view events on savvx.com; no financial data is sent)

We do not share your personal or financial information with any other third parties.

6. Data Security

  • All data is encrypted in transit (TLS/HTTPS)
  • Sensitive tokens (Plaid access tokens) are encrypted at rest using AES-256
  • Passwords are hashed using bcrypt (one-way, irreversible)
  • Two-factor authentication via SMS is required for all accounts
  • Account lockout after 5 failed login attempts
  • Security headers enforced (HSTS, CSP, XSS protection)

7. Data Retention and Deletion

We retain your financial data for as long as your account is active. You can delete your data at any time:

  • Delete Financial Data: Settings → Delete My Data — removes all transactions, accounts, and Plaid connections while keeping your account active
  • Delete Account: Settings → Delete Account — permanently deletes your entire account, cancels your subscription, revokes all Plaid access tokens, and expunges all data

When you delete data, it is permanently removed from our database. We do not retain backups of deleted user data.

8. SMS Communications

We send SMS messages for:

  • Verification codes — Required for login and registration security
  • Coaching alerts — Optional spending optimization tips (opt-in via Settings)

You can opt out of coaching alerts at any time via your account settings or by replying STOP to any message. Verification codes cannot be disabled as they are required for account security. Standard SMS rates may apply.

9. Your Rights

You have the right to:

  • Access your personal data (visible in your account dashboard)
  • Correct inaccurate data (contact us at support@savvx.com)
  • Delete your data (self-service via Settings)
  • Export your data (contact us at support@savvx.com)
  • Opt out of non-essential communications

10. Cookies and Analytics

SavvX uses the following analytics and advertising services:

  • Google Tag Manager (container GTM-WSLNTKPJ): Manages the loading of our analytics scripts. Does not itself collect user data.
  • PostHog: Product analytics. Captures page views, button clicks, form interactions, signup and onboarding funnel events (such as signup_complete, plaid_link_completed, checkout_started), and session replays for usability analysis. All input field values are masked in session replays — we cannot see what you type into form fields. No financial data (transactions, balances, card details, points balances) is sent to PostHog. Uses cookies and browser storage to function.
  • Reddit Conversion Pixel: Measures the effectiveness of our advertising on Reddit. Fires on signup and trial-start events only. Sends the event name and a hashed identifier to Reddit so we can attribute new signups to specific ad campaigns. No financial data is sent. Sets cookies to function.
  • Meta Pixel: Measures the effectiveness of our advertising on Facebook and Instagram. Fires a page view event on each page you visit on savvx.com, plus signup and trial-start conversion events, which Meta may associate with your Facebook or Instagram account. No financial data is sent. Sets cookies to function.

These services may set cookies or use browser storage. We do not serve ads on the SavvX platform itself. You can opt out of all third-party tracking by using a browser ad blocker (such as uBlock Origin) or by enabling tracking protection in browsers like Brave or Firefox — these will block PostHog, the Reddit pixel, and the Meta Pixel.

We also use essential browser storage (localStorage) to maintain your login session. This cannot be disabled while using the service.

11. Do Not Track

The Reddit conversion pixel and the Meta Pixel described in Section 10 involve limited cross-site tracking. Reddit can associate the signup and trial-start events we send with your Reddit account or prior visits to Reddit, and Meta can associate page view events with your Facebook or Instagram account. Our other analytics services (Google Tag Manager and PostHog) do not engage in cross-site tracking.

Because there is no industry-standard implementation of the Do Not Track (DNT) browser signal, we do not currently respond to it. We do, however, honor the Global Privacy Control (GPC) browser signal: when your browser sends it, the Reddit pixel and the Meta Pixel are not loaded at all. You can also opt out of both pixels directly on our Your Privacy Choices page, or use a browser ad blocker (such as uBlock Origin) or tracking protection in browsers like Brave or Firefox.

12. California Privacy Rights (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

  • Right to Know: You may request what personal information we have collected about you, the sources, purposes, and the categories of third parties with whom we share it.
  • Right to Delete: You may request deletion of your personal information. You can do this self-service via Settings → Delete Account, or by emailing support@savvx.com.
  • Right to Opt Out of Sale or Sharing: We do not sell your personal information. We have never sold personal information and have no plans to do so. However, California law treats sending events to advertising platforms (the Reddit and Meta measurement pixels described in Section 10) as "sharing" personal information. You can opt out of this sharing at any time on our Do Not Sell or Share My Personal Information page. We also honor the Global Privacy Control browser signal automatically.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, email support@savvx.com or use the self-service options in your account settings.

13. Plaid Privacy

Our financial data connections are powered by Plaid Inc. When you connect a bank account, Plaid's own privacy policy also applies to the data they process on your behalf. You can review Plaid's privacy policy at plaid.com/legal.

14. Business Transfers

If Savvx LLC is acquired by or merged with another company, your personal information may be transferred to the new owner. The new owner will assume responsibility for your personal information as described in this Privacy Policy. We will notify you via email of any such change in ownership.

15. Children's Privacy

SavvX is not intended for users under 18 years of age. We do not knowingly collect information from children.

16. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes to the way we process your personal information, we will notify registered users via email. The "Last updated" date at the top reflects the most recent revision.

17. Contact Us

If you have questions about this Privacy Policy or your data: