Privacy Policy

Last updated: September 1, 2026

1. Introduction

Savvx LLC ("SavvX," "we," "us," or "our") operates the SavvX credit card rewards optimization platform at savvx.com. This Privacy Policy describes how we collect, use, and protect your personal information when you use our service.

We take your privacy seriously. We do not sell your data. We do not display ads. We have no card partnerships. Our only revenue is your subscription fee.

2. Information We Collect

Account Information

  • Name, email address, and phone number (provided during registration)
  • Password (stored as a one-way hash — we cannot read your password)

Financial Information (via Plaid)

  • Bank account names and types
  • Credit card account details (name, issuer, APR, network)
  • Transaction history (merchant, amount, date, category)
  • Account balances

We connect to your financial institutions through Plaid Inc., a regulated financial data provider. We never see or store your bank login credentials — Plaid handles authentication directly. Our access is read-only; we cannot move money or make changes to your accounts.

Payment Information

Subscription payments are processed by Stripe Inc. We do not store your credit card number. Stripe handles all payment processing in compliance with PCI-DSS standards.

Usage Information

  • Server logs (IP address, request timestamps, pages visited)
  • Device and browser information (via standard HTTP headers)

3. How We Use Your Information

  • Rewards optimization: Analyzing your transactions to recommend the best credit cards for your spending patterns
  • Authentication: Sending SMS verification codes for account security
  • Coaching alerts: Sending optional spending coaching messages via SMS (opt-in only)
  • Service improvement: Understanding usage patterns to improve the product
  • Account management: Processing subscriptions, communicating about your account

4. What We Never Do

  • We never sell your personal or financial data to anyone
  • We never share your financial information (transactions, balances, card details) with advertisers. We share limited marketing event data with our advertising platforms: that a page was visited, that a signup or trial start occurred, and the amount of a subscription payment. See Section 10.
  • We never use affiliate links or earn commissions from card issuers
  • We never display ads on the SavvX platform
  • We never access your bank login credentials

5. Data Sharing

We share data only with the following service providers, to operate SavvX and measure the effectiveness of our marketing:

  • Plaid Inc. — Financial data aggregation (bank connections, transactions)
  • Stripe Inc. — Payment processing
  • Twilio Inc. — SMS delivery (verification codes, coaching alerts)
  • ActiveCampaign, Inc. — Email delivery and mailing list management for SavvX's own messages (your email address and name only; no financial data is sent)
  • Railway Inc. — Cloud hosting infrastructure
  • Anthropic — AI processing for card data extraction (no personal data is sent)
  • PostHog Inc. — Product analytics (page views, signup and onboarding funnel events, session replays with all input values masked; no financial data is sent)
  • Google LLC — Tag management via Google Tag Manager (loads analytics scripts; does not itself collect user data)
  • Reddit Inc. — Advertising conversion attribution (page visit, signup, and trial-start events from your browser, plus a purchase event sent by our servers that includes the subscription payment amount; see Section 10)
  • Meta Platforms, Inc. — Advertising measurement via the Meta Pixel (page view, signup, and trial-start events on savvx.com; no financial data is sent)

We do not share your personal or financial information with any other third parties.

6. Data Security

  • All data is encrypted in transit (TLS/HTTPS)
  • Sensitive tokens (Plaid access tokens) are encrypted at rest using AES-256
  • Passwords are hashed using bcrypt (one-way, irreversible)
  • Two-factor authentication via SMS is required for all accounts
  • Account lockout after 5 failed login attempts
  • Security headers enforced (HSTS, CSP, XSS protection)

7. Data Retention and Deletion

We retain your financial data for as long as your account is active. You can delete your data at any time:

  • Delete Financial Data: Settings → Delete My Data — removes all transactions, accounts, and Plaid connections while keeping your account active
  • Delete Account: Settings → Delete Account — permanently deletes your entire account, cancels your subscription, revokes all Plaid access tokens, and expunges all data

When you delete data, it is permanently removed from our database. We do not retain backups of deleted user data.

8. SMS Communications

We send SMS messages for:

  • Verification codes — Required for login and registration security
  • Coaching alerts — Optional spending optimization tips (opt-in via Settings)

You can opt out of coaching alerts at any time via your account settings or by replying STOP to any message. Verification codes cannot be disabled as they are required for account security. Standard SMS rates may apply.

9. Your Rights

You have the right to:

  • Access your personal data (visible in your account dashboard)
  • Correct inaccurate data (contact us at support@savvx.com)
  • Delete your data (self-service via Settings)
  • Export your data (contact us at support@savvx.com)
  • Opt out of non-essential communications

10. Cookies and Analytics

SavvX uses the following analytics and advertising services:

  • Google Tag Manager (container GTM-WSLNTKPJ): Manages the loading of our analytics scripts. Does not itself collect user data.
  • PostHog: Product analytics. Captures page views, button clicks, form interactions, signup and onboarding funnel events (such as signup_complete, plaid_link_completed, checkout_started), and session replays for usability analysis. All input field values are masked in session replays — we cannot see what you type into form fields. No financial data (transactions, balances, card details, points balances) is sent to PostHog. Uses cookies and browser storage to function.
  • Reddit Conversion Pixel: Measures the effectiveness of our advertising on Reddit. Fires a page visit event on each page you visit on savvx.com, plus signup and trial-start conversion events. Sends the event name and a hashed identifier to Reddit so we can attribute new signups to specific ad campaigns. No financial data is sent. Sets cookies to function.
  • Reddit Conversions API (sent by our servers): Separate from the pixel above. When a subscription payment succeeds, our servers send Reddit a purchase event containing the payment amount, a hashed form of your email address, your account identifier, and the advertising click identifier recorded when you first arrived. Because it is sent by our servers and not by your browser, browser ad blockers and tracking protection cannot block it. Your card number and financial account details are never included. You can stop this event on our Your Privacy Choices page.
  • Meta Pixel: Measures the effectiveness of our advertising on Facebook and Instagram. Fires a page view event on each page you visit on savvx.com, plus signup and trial-start conversion events, which Meta may associate with your Facebook or Instagram account. No financial data is sent. Sets cookies to function.

These services may set cookies or use browser storage. We do not serve ads on the SavvX platform itself. A browser ad blocker (such as uBlock Origin) or tracking protection in browsers like Brave or Firefox will block PostHog, the Reddit pixel, and the Meta Pixel. It will not block the Reddit Conversions API events described above, because those are sent by our servers; to stop those, use our Your Privacy Choices page.

We also use essential browser storage (localStorage) to maintain your login session. This cannot be disabled while using the service.

11. Do Not Track

The Reddit conversion pixel, the Reddit Conversions API, and the Meta Pixel described in Section 10 involve limited cross-site tracking. Reddit can associate the page visit, signup, trial-start, and purchase events we send with your Reddit account or prior visits to Reddit, and Meta can associate the page view, signup, and trial-start events we send with your Facebook or Instagram account. Our other analytics services (Google Tag Manager and PostHog) do not engage in cross-site tracking.

Because there is no industry-standard implementation of the Do Not Track (DNT) browser signal, we do not currently respond to it. We do, however, honor the Global Privacy Control (GPC) browser signal: when your browser sends it, the Reddit pixel and the Meta Pixel are not loaded at all, and if you are signed in we also suppress the server-side Reddit purchase event. You can make the same choice directly on our Your Privacy Choices page, which covers both the pixels and the server-side event. A browser ad blocker or tracking protection will stop the pixels but cannot stop the server-side event.

12. California Privacy Rights (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

  • Right to Know: You may request what personal information we have collected about you, the sources, purposes, and the categories of third parties with whom we share it.
  • Right to Delete: You may request deletion of your personal information. You can do this self-service via Settings → Delete Account, or by emailing support@savvx.com.
  • Right to Opt Out of Sale or Sharing: We do not sell your personal information. We have never sold personal information and have no plans to do so. However, California law treats sending events to advertising platforms (the Reddit and Meta measurement pixels described in Section 10) as "sharing" personal information. You can opt out of this sharing at any time on our Do Not Sell or Share My Personal Information page. We also honor the Global Privacy Control browser signal automatically.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, email support@savvx.com or use the self-service options in your account settings.

13. Plaid Privacy

Our financial data connections are powered by Plaid Inc. When you connect a bank account, Plaid's own privacy policy also applies to the data they process on your behalf. You can review Plaid's privacy policy at plaid.com/legal.

14. Business Transfers

If Savvx LLC is acquired by or merged with another company, your personal information may be transferred to the new owner. The new owner will assume responsibility for your personal information as described in this Privacy Policy. We will notify you via email of any such change in ownership.

15. Children's Privacy

SavvX is not intended for users under 18 years of age. We do not knowingly collect information from children.

16. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes to the way we process your personal information, we will notify registered users via email. The "Last updated" date at the top reflects the most recent revision.

17. Contact Us

If you have questions about this Privacy Policy or your data: