Privacy Policy

1. Overview

SavedHub is a smart bookmark and link-management platform. When you create an account, save links, or collaborate in workspaces, we necessarily handle certain personal data to provide and improve the Service. We collect only what we need, store it securely, and never sell your personal information to third parties.

This policy applies to all users worldwide, with additional disclosures for users in the European Economic Area (EEA), the United Kingdom (UK), India, and the state of California (USA).

2. Information We Collect

2.1 Information You Provide Directly

• Account credentials — email address and encrypted password when you register.
• Profile information — display name, username/handle, phone number (optional), profile photo/avatar (optional).
• Workspace content — URLs, titles, tags, notes, and categories you save.
• Preferences — time zone, language/locale settings.
• Communications — any messages you send to our support team.

2.2 Information Collected Automatically

• Log data — IP address, browser type and version, operating system, referring URL, pages visited, and timestamps.
• Usage data — link click counts, search queries within the app, feature interactions.
• Device identifiers — browser fingerprint components used for fraud prevention.
• Cookies and similar technologies — see the Cookies section below.

2.3 Information from Third Parties

• OAuth providers — if you sign in with Google or another OAuth provider in the future, we receive your name, email, and profile picture from that provider.
• URL metadata — we fetch the title, description, and Open Graph image of URLs you save in order to display a rich preview. This fetch is made server-side by SavedHub, not by your browser, to avoid leaking your IP to every site you save.

3. How We Use Your Information

4. AI-Powered Link Analysis

When you save a URL, SavedHub sends the URL and scraped page text to an AI language-model API to generate a concise summary, suggest relevant tags, and classify the link into a category. This processing happens server-side on our infrastructure.

The following applies to AI processing:

• Only the URL and the publicly accessible text content of that page are sent — no personal profile data is included.
• AI-generated outputs (summaries, tags, categories) are stored in your workspace and are visible only to you and your workspace members.
• We do not use your saved content to train AI models without your explicit consent.
• You can edit or delete any AI-generated tag, summary, or category at any time.

5. Data Storage & Security

SavedHub uses Supabase (PostgreSQL, hosted on AWS) as its primary database and Supabase Storage (S3-compatible) for file assets such as profile avatars. Supabase is SOC 2 Type II compliant and encrypts data at rest (AES-256) and in transit (TLS 1.2+).

• Authentication is handled by Supabase Auth, which uses PKCE flow and stores only hashed passwords.
• Avatar images are stored in a private Supabase Storage bucket with per-user Row Level Security (RLS) policies, accessible only to you.
• Row Level Security is enforced at the database layer so that users can read and write only their own data.
• We maintain regular automated backups and conduct periodic security reviews.

Despite our best efforts, no system is completely secure. If you discover a security vulnerability, please report it responsibly to security@savedhub.io.

6. Cookies & Tracking Technologies

We use cookies and similar technologies for authentication, preferences, and advertising. For a full breakdown of every cookie we set, see our Cookie Policy.

Summary of cookie categories

• Strictly necessary — session and CSRF tokens required for you to be logged in. Cannot be disabled.
• Functional — remembers your UI preferences (e.g., sort order, last workspace visited).
• Analytics — anonymised page-view and feature-usage metrics to help us improve the Service.
• Advertising — set by Google AdSense to serve relevant ads. Requires your consent where required by law.

You can manage or withdraw consent for non-essential cookies via the cookie preference banner or your browser settings. Note that disabling strictly-necessary cookies will log you out.

7. Advertising & Third-Party Partners

SavedHub displays advertisements served by Google AdSense. Google may use cookies and device identifiers to serve ads based on your prior visits to savedhub.io and other sites. Google’s use of advertising cookies enables it and its partners to serve ads based on your visit to our site and/or other sites on the Internet.

You may opt out of personalised advertising by visiting Google’s Ads Settings or optout.aboutads.info. Where required by law (e.g., GDPR), personalised ads will only be served after you have given consent via our cookie banner.

Other third-party integrations

• Supabase — database, auth, and file storage. Data processor under GDPR.
• Vercel / hosting provider — edge network and serverless runtime. Processes request logs.
• AI API provider — receives URL content for link analysis (no personal data). Subject to their privacy policy and data processing agreement.

We enter into data processing agreements (DPAs) with all third-party processors that handle personal data on our behalf.

8. Data Sharing & Disclosure

We do not sell your personal data. We share data only in these circumstances:

• Service providers — processors listed in Section 7, bound by DPAs.
• Workspace members — within a shared workspace, members can see each other’s saved links and display names (not emails or passwords).
• Business transfers — if SavedHub is acquired or merged, your data may be transferred to the successor entity. You will be notified beforehand.
• Legal requirements — if required by law, court order, or to protect the rights, property, or safety of SavedHub, our users, or the public.
• With your consent — in any other case, only with your explicit consent.

9. Data Retention

• Account data — retained for as long as your account is active, plus 30 days after deletion to allow account recovery.
• Saved links — deleted immediately upon your request or account deletion.
• Server logs — retained for 90 days for security and debugging, then automatically purged.
• Backups — retained for 30 days in encrypted storage.
• Legal hold — data subject to ongoing legal proceedings may be retained longer.

10. Your Rights

Regardless of where you are located, you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — update inaccurate or incomplete data via your Profile settings or by contacting us.
• Deletion — request deletion of your account and all associated data.
• Portability — receive your saved links and profile data in a machine-readable format (JSON/CSV).
• Restriction — ask us to restrict processing of your data in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any right, email privacy@savedhub.io with the subject line “Privacy Request”. We will respond within 30 days (or 72 hours for urgent erasure requests under GDPR).

11. GDPR – EEA & UK Users

For users in the European Economic Area (EEA) or the United Kingdom (UK), SavedHub acts as the data controller for your personal data. Our processing is governed by the EU General Data Protection Regulation (GDPR 2016/679) and the UK GDPR.

• The legal bases for processing are set out in the table in Section 3.
• Where we transfer personal data outside the EEA/UK (e.g., to AWS/Supabase servers in the US), we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms.
• You have the right to lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, CNIL in France).

12. India – IT Act 2000 & DPDPA 2023

For users in India, this Privacy Policy is compliant with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, as well as the Digital Personal Data Protection Act, 2023 (DPDPA).

• Sensitive Personal Data (passwords, biometric data if any) is collected, stored, and processed with reasonable security practices as mandated by the IT Rules, 2011.
• By registering and using SavedHub, you give your free, informed, and unambiguous consent to the collection and processing of your personal data as described in this policy, in accordance with Section 7 of the DPDPA.
• You have the right to withdraw consent at any time by deleting your account. Withdrawal does not affect the legality of processing carried out before withdrawal.
• Cross-border transfer of personal data to countries designated by the Government of India as adequate destinations is permitted. We will comply with any restrictions notified under the DPDPA.
• Grievances may be directed to our Grievance Officer at privacy@savedhub.io. We will acknowledge receipt within 48 hours and resolve the grievance within 30 days.

13. California – CCPA / CPRA

California residents have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Know — what personal information we collect, use, disclose, or sell.
• Delete — request deletion of personal information we have collected.
• Correct — request correction of inaccurate personal information.
• Opt-out of sale / sharing — we do not sell personal information. We do share identifiers with Google AdSense for advertising; you can opt out via Google’s Ads Settings.
• Non-discrimination — we will not discriminate against you for exercising your rights.

To submit a verifiable consumer request, email privacy@savedhub.io with subject line “CCPA Request”. We will respond within 45 days.

14. Children’s Privacy

The Service is not directed to children under the age of 13 (or 16 in the EEA/UK). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact privacy@savedhub.io and we will delete it promptly.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (to the address associated with your account) and/or by displaying a prominent notice on the Service at least 14 days before the changes take effect. The “Last updated” date at the top of this page always reflects when the policy was last revised. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us: