Privacy Policy

Last updated: 20 October 2026

Short version: Your food diary stays on your device, unless you turn on the backup to your own Google Drive. Savor runs without an account and shows no advertising. What leaves your phone: the food name or barcode you look up, the photo or text you hand to the AI analysis, an anonymous purchase identifier, anonymous events about how the app is used, a hashed device identifier for the Studio Bundle and invites, whatever you write to our support, and, so that we can measure our own ads on TikTok, the advertising ID of your phone with a few app events. Each of these is described below.

Savor ("the app") is a calorie and nutrition tracker published by Clearpoint Studios. This policy explains exactly what the app does and does not do with information.

Data we collect

Savor has no user accounts and no login, and we never ask for your name, email address or phone number. Your diary is not collected. If you turn on the Google Drive backup, your data goes to your own Drive and not to us. The app does send the technical data listed in the sections below to services we run or use: an anonymous purchase identifier, a random install identifier with usage events, a hashed device identifier, the inputs you give to the AI features and to food search, and support messages you write. None of it is sold. The only data used for advertising is what the section Advertising measurement (TikTok) describes.

Data stored on your device

Your food diary, weight, water, settings, and statistics are stored locally on your device only. This data never leaves your phone unless you choose to export or share it, or turn on the Google Drive backup described below. Uninstalling the app removes this data from the phone.

Camera and barcode scanning

With your permission, Savor uses the camera to scan barcodes and to capture photos of meals or nutrition labels. Barcode scanning is processed on your device; the resulting barcode is then looked up as described under Food lookups. Photos captured for recognition are covered under AI features below.

AI features

Savor's AI features (photo meal recognition, nutrition-label scanning, and typed or dictated meal descriptions) send the photo or text you submit to Google's Gemini AI for analysis. The request passes through a relay service we operate on Cloudflare. It carries your anonymous purchase identifier and your time zone offset, because the relay checks whether Savor Pro is active and counts how many analyses that identifier has used. The relay keeps no copy of the photo or text. For each completed analysis it stores a usage record: the time, a shortened hash of the purchase identifier, whether it was a Pro or a free analysis, the kind of analysis, the number of foods found, and the amount of AI processing used. Google processes the content under its API terms. See Google's privacy policy.

Microphone

If you dictate a meal description, Savor uses your device's built-in speech recognition to convert speech to text. Audio handling is performed by your device's operating system; Savor itself never records, stores, or uploads any audio. Only the resulting text is sent to the AI service described above.

Health Connect

With your permission, Savor can read activity and body data from Google Health Connect to refine your daily numbers. It reads exactly three data types: steps and active calories burned, used to adjust your remaining calorie budget, and weight, used to keep your weight log in sync. This connection is optional and off by default: Savor only accesses Health Connect after you explicitly turn the sync on in Settings, and you can revoke access at any time from within Health Connect or by turning the sync off. Data read from Health Connect is processed entirely on your device and never leaves it. It is not sent to our servers, not sent to the AI service, never used for advertising, and never shared with third parties. Uninstalling the app or disabling the sync stops all access.

Savor can also write to Health Connect, so other apps you use can see what you log in Savor. There are three separate switches in Settings, all off by default, and each one asks Health Connect for its own permission: meals and nutrients (food name, meal, time, calories, protein, carbohydrates, fat, fiber, sugar, sodium and saturated fat of each diary entry), weight (your weigh-ins) and water (your daily total). Savor keeps the last 30 days in Health Connect up to date: when you edit or delete an entry in Savor, it updates or removes the matching record. Weigh-ins that another app already put into Health Connect are not written back. Writing happens on your device, directly into Health Connect; nothing passes through our servers. What Savor wrote stays in Health Connect until you delete it there, also when you turn a switch off or uninstall Savor, and from there it is governed by Health Connect and the apps you allow to read it.

Cross Link: sharing with other Clearpoint Studios apps on the same phone

Cross Link connects Savor with Stride and Hoist, two other apps by Clearpoint Studios, when they are installed on the same phone. The exchange runs on the phone itself through Android. Nothing goes over the internet for it, and nothing reaches our servers.

Savor reads runs from Stride (start and end time, moving time, distance, grade adjusted distance, elevation gain) and finished workouts from Hoist (start and end time, active minutes, working sets, reps, volume, exercises, average RPE), each with an estimate of the energy used per kilogram of body weight. Savor turns that into calories with the weight from your own weight log for that day and adds them to your day. No GPS track and no position is shared.
Savor hands Hoist your protein per day for the last 90 days: grams of protein, calories, the number of diary entries and your protein goal for that day. No food names, no meals and no photos.

Before anything is exchanged, each app checks that the other one is a genuine Clearpoint Studios app signed by us. Other apps cannot read this data. Each of the three kinds can be switched off in Savor under Settings, Cross Link. Switching runs or workouts off removes what Savor received; switching protein off stops Savor from handing over new days. A run or workout you hide in Savor stays hidden until you bring it back there. Cross Link is free and covers the last 90 days.

Food lookups (Open Food Facts and USDA)

When you search for a food or scan a barcode, Savor sends that search term or barcode to public nutrition databases - Open Food Facts and the U.S. Department of Agriculture's FoodData Central - to retrieve nutrition information. Searches of the USDA database pass through the relay service described under AI features. Only the query is sent, never your diary or personal data. These are independent third parties, each with its own privacy policy (see the Open Food Facts policy).

Notifications

Savor can send local reminders (for example, to log a meal). These are scheduled and delivered entirely on your device. Separately, Savor includes Firebase Cloud Messaging, a Google service, to tell you when we reply to a support request. Firebase starts when the app launches and registers this installation with Google, which issues an installation ID and a push token. The app asks for the notification permission when you send your first support request. Once notifications are allowed, it stores that token together with the app language and the platform on our support backend.

Backup to your Google Drive

In Settings, Data, you can connect a Google account to back up your data. Until you do, nothing in this section happens. The backup is free.

Once connected, Savor saves your food diary, recipes, favorites, your own foods and templates, meal slots, pantry, weight log, calorie and macro goals with their history, water goal, search and scan history, your logged exercise including runs and workouts received over Cross Link, your profile (birth date, sex, height, weight, body fat if you entered it, activity level, goal and weekly rate, diet, units), your Cross Link switches, and the model name of the phone that wrote the backup to the hidden app data folder of your own Google Drive. Meal photos are not part of it and stay on your phone. Savor asks Google only for the drive.appdata permission: it can read and write files in this one folder, which only Savor can see, and it has no access to any other file in your Drive. The data goes straight from your phone to Google. It does not pass through any server of ours, and we cannot read it. Savor shows the email address of the connected Google account in the settings and keeps it on the phone.

The backup updates itself after a change and when you leave the app. On another phone signed in with the same Google account, you can restore it from the same place in Settings. Google stores the file under your account according to its own privacy policy.

You can disconnect at any time, and the backup stays in your Drive. "Delete Drive backup" in the app removes it from your Drive. You can also remove Savor's access in your Google account under Security, Third party apps, and delete its hidden data in Google Drive under Settings, Manage apps.

Savor's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The data is used for the backup and nothing else, it is not used for advertising, and it is not transferred to anyone.

Exporting and sharing

You can export your data and share it using your device's share sheet. This action is initiated by you, and you alone decide where the file goes. We never receive a copy.

Usage events and advertising

Savor shows no advertising and contains no third-party analytics SDK. It does send anonymous usage events to an analytics service we run ourselves on Cloudflare: which onboarding steps and screens were opened, whether the Savor Pro screen was shown, which price option was selected, and whether a purchase succeeded. Each batch carries a random install identifier generated on the device, the anonymous purchase identifier, the app version, the interface language, the platform, whether Pro is active, and the source of the install if it came from an invite or another Clearpoint Studios app. The events contain no diary content, no food names, no name and no contact detail. The service notes the country the request comes from and does not store your IP address. The events tell us where people get stuck in the app.

Advertising measurement (TikTok)

We advertise Savor on TikTok. To see which of our ads lead to an install or a purchase, the app includes the TikTok App Events SDK. It sends data to TikTok when the app starts and at a few points in the app. It sends: the advertising ID of your phone, a random identifier the SDK generates, the Google Play install referrer, your IP address, the device model, Android version, screen size, language and network type, the app version, and these events: app installed, app opened, onboarding finished, Savor Pro screen shown, purchase started, and purchase completed with the product, price and currency. It sends no diary content, no food names, no photos and no health data. If the SDK itself runs into an error, it sends TikTok a report of that error. TikTok uses this data to attribute installs and purchases to our ads and to deliver and measure advertising, under its own privacy policy. You can reset or delete the advertising ID in the Android settings under Google, Ads. After you delete it, the app can only send a row of zeros in its place.

Purchases

Savor Pro is sold through the Google Play Store, which handles the payment. To unlock and restore Pro, the app uses RevenueCat, which issues an anonymous app user ID on first launch and holds the purchase status behind it. The app also attaches two things to this ID: the result of its own integrity check (for example whether it was installed from Google Play and signed with our key) and, if you installed through a link in another Clearpoint Studios app, the source named in that link. It does not receive your diary or your payment details. See the RevenueCat and Google privacy policies.

Studio Bundle and invites

Savor is part of the Studio Bundle, one purchase that unlocks Pro in several Clearpoint Studios apps, and it lets you invite friends. Both run on a service we operate on Cloudflare. The app sends this service the anonymous purchase identifier and a one way hash (SHA-256) of the Android ID of your phone. This happens once after installation on first launch, when you redeem a bundle code, when you open your invite code and when you use an invite link or code. The hash lets the service give Pro back after a reinstall on the same phone, limits how many devices one bundle code can unlock, and stops an invite from being redeemed twice from the same device. The Android ID itself never leaves the device.

Support and feedback

On first launch the app creates an anonymous support account on our support backend (Supabase): a random account ID with no name, no email address and no password. It exists so that a conversation you start, and our reply, belong to your installation. When you write to us from inside the app, your message is stored there together with the app version, the platform, the manufacturer and model of your phone, the app language and whether Pro is active. A copy of the message with the app version, the Android version, the app language and the Pro status goes through a relay we run on Cloudflare to our internal Telegram channel, so that we notice it quickly. The relay keeps your IP address for ten minutes to limit how many messages one connection can send. Messages can be translated with Google's Gemini API, so that we can read yours and you can read our reply in your language. We use all of this only to answer you and to fix the problem you describe.

Children

Savor is a general-audience wellness app and is not directed at children under 13. We do not knowingly collect information from children.

Data retention

Your food diary, weight, water, settings, and statistics are kept on your device for as long as the app is installed. They are removed as soon as you uninstall the app or clear them from within the app. We never receive a copy, so there is nothing for us to retain. A Google Drive backup stays in your own Drive until you delete it in the app or in Google Drive; we hold no copy. Photos and texts sent to the AI analysis are not kept after the analysis; the usage records described under AI features are kept until you ask us to delete them. Food lookups send only the search term or barcode. Usage events and the install identifier are deleted automatically 400 days after they arrive. A resolved or closed support conversation is deleted automatically 30 days after its last activity; the copy in our internal Telegram channel is deleted on request. The anonymous support account and the push token are kept until you ask us to delete them. The hashed device identifier and bundle or invite codes are kept until you ask us to delete them. RevenueCat keeps the anonymous purchase identifier and the purchase status for as long as the purchase exists. The data sent to TikTok for advertising measurement is stored by TikTok and not by us; TikTok keeps it for as long as its privacy policy states, and resetting or deleting your advertising ID ends the link to your phone. Any data read from Health Connect stays on your device and is removed with the app. Records Savor wrote to Health Connect stay there until you delete them in Health Connect. To have server-side data deleted, email [email protected].

Changes to this policy

If this policy changes, the updated version will be posted on this page with a new "last updated" date.

Contact

Questions about this policy? Email [email protected].