THE SAVELO APP FOR IPHONE

App privacy, in plain language.

Effective October 31, 2026. This page describes the Savelo iPhone app (bundle com.justin.savelo) from Elo AI. The web beta has its own page.

What stays on your device

Your goals, spending, receipts, budgets and profile are stored on your iPhone. Sensitive records are encrypted with keys kept in the iOS Keychain, and receipt photos are read on the device with Apple’s Vision framework. Savelo Coach runs the Gemma 4 E2B language model on your device; your questions and records are not sent to a cloud AI service. The model file (about 2.6 GB) is downloaded once from Hugging Face, only when you choose to set up Private AI in the app, and it needs a compatible iPhone with enough free storage.

What leaves your device, and why

• Bank connections (Plus and Pro). If you link a bank, Plaid’s Link screen collects your bank credentials directly; Savelo never sees them. Savelo’s server (a Cloudflare Worker) relays requests to Plaid using credentials held only on the server and returns balances, transactions, liabilities and investment holdings to your phone. The server does not store them. It keeps only short-lived rate-limit counters (they expire within about a day). Your Plaid access token is stored in the iOS Keychain on your device and passed through the server with each request; the server does not keep it. Plaid receives a one-way hash derived from your Apple sign-in as your user reference. Plaid’s own terms apply to data it handles: Plaid end-user privacy policy.
• Subscription check. When you have a subscription, the app attaches the App Store’s signed proof of it to requests to Savelo’s server, and the server checks it before handling bank requests. It contains no spending or bank data.
• A random device identifier. The app’s vendor identifier is sent to the server for rate limiting. It is not used for advertising or tracking.
• Barcode lookups. If you scan a barcode, the number is sent to Open Food Facts and UPCitemdb to find the product.
• Market prices. If you track holdings in Portfolio, the ticker or coin symbols are sent through Savelo’s server to CoinGecko and Yahoo Finance to get prices. Amounts and account details are not part of these requests. These requests carry no device identifier, so Savelo’s server (on Cloudflare) counts them against your IP address in a short-lived rate-limit counter that expires within about a day.
• Optional iCloud. If you turn on iCloud copies, goals and tagged transactions are encrypted on your device before they are stored in your private iCloud container. Separately, some lists you create (bills, credit score log, scenarios, savings plans, coach notes and partners) and files you import (such as PDF and CSV) are saved as files that sync through your iCloud account when iCloud is on; Savelo does not encrypt those files. A saved receipt image is kept in the app’s file storage on your device, may sync through iCloud when it is enabled, and is never uploaded to Savelo’s servers.
• Sign in with Apple. Apple provides an identifier and, if you choose, your name and email. They are kept in the iOS Keychain on your device.

What we do not do

No advertising, no data sales, no tracking across other companies’ apps or sites, and no third-party analytics SDKs.

Deleting your data

In the app, open Profile and choose Delete Account & Data. This asks Plaid to revoke your bank connections (it needs a network connection), deletes your encrypted iCloud copies and your synced iCloud files where reachable, signs you out, and erases the app’s files, settings and keychain items on your device. The downloaded Gemma model file is kept so you do not have to download it again; it contains no personal data. Deleting the app alone removes only its local files. To ask about data Plaid holds, see plaid.com/legal. Subscriptions are managed in Settings > Apple ID > Subscriptions. For help, write to support@eloai.co.

Limits

Savelo shows information from the records you provide and your linked accounts. It is not investment, tax, credit or legal advice. Encryption protects stored records; it does not prove balances or eligibility.