Effective: April 23, 2026Last updated: April 23, 2026
ROCA Technologies Inc. ("SAVX", "we", "us", "our") operates the SAVX mobile application and the getsavx.ca website (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding that information.
We operate under the Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada. If you use SAVX from outside Canada, your information may be transferred to and processed in Canada.
1. Information We Collect
1.1 Information You Provide
Account information — Email address, phone number (for verification), password hash (handled by Supabase Auth), and optionally a display name.
Grocery and shopping data — Items you add to your grocery lists, recipes you share or import, preferences (budget/luxe mode, preferred stores), and any notes you attach to items.
Voice recordings — Audio clips you record when using voice suggestion features. These are transmitted to OpenAI Whisper for transcription, then discarded. We do not permanently store voice recordings.
Subscription information — RevenueCat handles subscription status, trial dates, and payment receipts. We do not store your credit card or banking information.
Communications — If you contact us, we keep a record of the exchange.
1.2 Information Collected Automatically
Device information — Device model, OS version, app version, language settings, and timezone, to ensure SAVX works correctly on your device.
Location information — If you grant permission, approximate location (city-level) to show flyers and gas prices relevant to your area, and more precise location only when actively using the trip routing feature. You can revoke location access at any time in your device settings.
Usage data — Features you use, frequency of use, error reports (via Sentry), and performance metrics. This helps us improve the app.
IP address — Recorded with each API request for security and rate limiting purposes.
1.3 Information from Third Parties
Flyer and coupon data — We aggregate publicly-available grocery flyer and coupon information from Canadian retailers. This data is about products and prices, not about you.
Referrals — If you sign up via a referral code, we record the referring user (for reward tracking) and your relationship to that user.
1.4 What We Do NOT Collect
We do not collect government identification numbers (SIN, driver's license, passport).
We do not collect financial account numbers beyond what RevenueCat processes for subscription billing.
We do not access your contacts, photos, calendar, or other device data beyond what the app explicitly requires and you permit.
We do not scan the contents of your device or other installed apps.
2. How We Use Your Information
We use your information to:
Operate the Service — Create and maintain your account, deliver the core features (grocery list management, flyer matching, trip routing, voice suggestions), and respond to your requests.
Personalize your experience — Show you deals from stores near you, recommend recipes matching your saved preferences, and surface your shopping history.
Verify your identity — Phone verification via SMS (one-time codes) prevents fraud and abuse.
Process subscriptions — Through RevenueCat, to charge for Saver and Pro tiers, apply trials, and handle refunds.
Communicate with you — Send transactional messages (verification codes, subscription receipts, critical account notices) and, with your consent, marketing or product updates.
Enforce our Terms — Prevent abuse, detect fraud (especially for referral programs), and uphold the integrity of the Service.
Comply with law — Respond to lawful requests from authorities when legally required.
3. How We Share Your Information
3.1 Service Providers
Trusted third parties that help us operate SAVX:
Supabase (supabase.com) — Authentication, database, and real-time infrastructure.
RevenueCat (revenuecat.com) — Subscription management and billing.
Anthropic (anthropic.com) — Claude AI processes recipe content and voice transcripts to extract ingredients and match deals. Anthropic does not retain content from our API calls.
OpenAI (openai.com) — Whisper transcribes voice recordings. OpenAI does not train on content from our API calls.
Google (google.com) — Google Maps provides routing and location services.
Each of these providers operates under their own privacy policy and is bound by contractual data-handling obligations.
3.2 Legal Compliance
We may disclose information when required by law, court order, or lawful request from a Canadian or applicable foreign authority. We will not disclose more than is legally required.
3.3 Business Transfers
If ROCA Technologies Inc. is acquired, merged, or reorganized, your information may be transferred as part of that transaction, subject to the acquirer honoring this Privacy Policy or providing equivalent protection.
3.4 With Your Consent
For anything not covered above, we will ask for your explicit consent before sharing.
3.5 What We Never Do
We never sell your personal information to advertisers or data brokers.
We never share individual grocery lists, recipes, or shopping patterns with retailers, brands, or marketers.
We never use your voice recordings or personal content to train AI models for other customers.
4. Data Retention
Account data is retained while your account is active and for a reasonable period after closure (typically 30 days) for dispute resolution and legal compliance.
Voice recordings are transcribed and discarded immediately; we do not retain the audio.
Grocery and recipe data is retained while your account is active and deleted within 30 days of account closure.
Error logs and usage analytics are retained in aggregate form for up to 2 years for service improvement purposes.
Legal and financial records (subscription receipts, dispute records) are retained as long as required by Canadian tax and financial regulations, typically 7 years.
5. Your Rights (PIPEDA)
As a user, you have the right to:
Access — Request a copy of the personal information we hold about you.
Correct — Request that we fix inaccurate or incomplete information.
Delete — Request deletion of your account and associated data, subject to legal retention requirements.
Withdraw consent — At any time, for any optional data use (such as marketing communications).
Complain — File a complaint with us or, if unresolved, with the Office of the Privacy Commissioner of Canada (priv.gc.ca).
To exercise any of these rights, email privacy@getsavx.ca. We will respond within 30 days.
6. Security
We implement reasonable technical and organizational safeguards:
All data is transmitted over HTTPS.
Passwords are never stored in plaintext (Supabase handles hashing).
Access to production data is restricted to essential personnel.
We use Sentry for security event monitoring.
Known vulnerabilities are addressed promptly.
No system is perfectly secure. You are responsible for maintaining the secrecy of your account credentials.
7. Children's Privacy
SAVX is not directed to children under 13. We do not knowingly collect information from children under 13. If you believe we have inadvertently collected such information, contact us immediately and we will delete it.
8. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be communicated via in-app notification or email at least 30 days before taking effect. Your continued use of SAVX after changes take effect constitutes acceptance.
9. Contact Us
▸ ROCA Technologies Inc.
11 Oliver Court
Kitchener, Ontario, N2N 3E7
Canada