Your information.
Your choices.

Who is responsible

ishumilin is responsible for the app processing described in this notice. For privacy questions or requests about your information, contact savili@shumil.in.

Your account

Savili uses its own authentication service and account records, separate from the other Bliss family apps. Email sign-in uses a short-lived code delivered through Amazon Simple Email Service in Ireland. Sign in with Apple sends Apple's identity token and authorisation code to Savili for verification. Password sign-in remains available to earlier beta accounts.

We process your email address, account identifier and authentication information to sign you in, secure your account and associate learning records with you. For Apple sign-in, the server stores an encrypted credential so it can revoke the Apple authorisation when you delete your account. Native sign-in sessions are held in the device's secure storage.

Learning content and AI

When you practise, Savili processes your language preferences, interests or situations you enter, selected tasks, submitted answers and help used. The authenticated backend sends relevant task and conversation context to OpenAI to generate lessons, tutor replies, pictures and feedback.

The service saves your learning profile, conversations, attempts, feedback, generated materials, review dates and progress evidence so you can resume lessons and review your practice. Learning content is encrypted on the server and access is tied to your authenticated account. Account identifiers, usage totals and other operational metadata are also processed to run the service.

Savili does not read other Bliss apps' assistant memory, ambient recordings, email, contacts or reminders. It requires an internet connection and does not offer a private offline AI mode. Avoid entering sensitive information about yourself or other people when it is not needed for language practice.

Optional voice features

Microphone permission is requested when you choose to use voice in a lesson. Recorded audio goes through Savili's backend to ElevenLabs for transcription. When supported and enabled, live captions stream audio after local speech detection. Provisional captions stay in memory until the final recognised reply enters the learning flow. Tutor text is sent to ElevenLabs to generate speech.

Recording and playback stop when you leave a lesson, background the app or interrupt native audio. Optional hands-free listening operates only within an explicitly started foreground lesson. Cancelling stops further processing in the app but cannot withdraw audio already sent to Savili or ElevenLabs.

Learner recordings are not saved in Savili's learning database tables. Recognised replies can be saved as learning content. Generated opening speech may be cached with an encrypted lesson. If live transcription fails in certain connection or provider conditions, the retained recording may be sent once through batch transcription. Provider retention is separate from Savili's database storage.

Optional photos and generated pictures

You can select a photo with the system photo picker. Savili does not request broad photo-library or camera access for this feature and does not request EXIF metadata from the picker. The selected image is sent through the backend to OpenAI to prepare a learning task.

Savili does not retain the original selected photo in its learning tables, but generated task text may reflect its contents. Avoid selecting private documents, faces or identifying information. Generated lesson pictures are stored in encrypted, account-scoped lesson packs rather than at public image URLs. Decoded lesson pictures are held in device memory, without a plaintext picture cache on disk.

Optional place suggestions

For practice suggestions, you may type a town and country or choose a one-time foreground location request. The device's operating-system geocoding service may process coordinates over its network to resolve a town. Location access stops after a fix, cancellation or backgrounding.

Through this feature, Savili receives only the town, optional region and country, not raw coordinates, street addresses, postcodes or venue identifiers. You see the place before submitting it. The original place selection stays in memory for that screen, although saved generated suggestions or lesson text may mention the town. Savili does not infer your location from your IP address for practice suggestions.

Usage, security and feature checks

Savili records operation identifiers, metered quantities, timestamps and, where supplied by the text provider, model and token counts. These allowance records do not contain prompts, replies, recordings or image payloads. Allowances are enforced by the server. A cancelled or failed provider request can still consume allowance.

The current app does not initialise optional product-analytics, crash-reporting or content-diagnostic SDKs. When configured in production, the backend checks feature availability with PostHog EU using an opaque account identifier. Those checks do not send lesson text, language choices, location or media.

Operational logs and security controls help diagnose failures and prevent abuse. Network services process connection information, including IP addresses. The application uses protected IP-derived rate-limit counters and excludes request content and credentials from its learning error logs.

The current beta has no in-app subscription or payment-processing flow. Usage allowances measure access to AI services, rather than card payments collected by Savili.

Service providers and processing locations

Savili uses OpenAI for AI lessons, responses and pictures, ElevenLabs for transcription and speech, Apple for Apple sign-in, Amazon Simple Email Service for sign-in emails, and Cloudflare for network delivery and protection. Optional production feature checks use PostHog EU. Your device's operating system provides the photo picker, permissions and location geocoding.

These services may process information outside your country. The use of an Ireland-based email service or an EU feature-check endpoint does not mean all app data remains in those regions. Savili does not promise zero retention by its AI or speech providers.

OpenAI's API documentation describes abuse-monitoring retention separately from saved application responses. ElevenLabs documents default retention and a separate enterprise zero-retention option. Deleting learning data in Savili does not automatically delete provider logs or withdraw information already transmitted. Contact us if you need help with a request involving provider-held information.

• OpenAI API data controls
• ElevenLabs API retention information

Storage and retention

Saved learning records support your account, lesson history, resumed practice and future reviews. You can remove them using the deletion controls below. The current service does not automatically erase all saved learning records after a fixed period of inactivity.

Content-free allowance records remain while the account is active so deleting learning history does not reset usage limits. Operational records are used for service reliability, security and abuse prevention. Retention depends on those purposes and on the relevant provider's processing terms. There is no single fixed deletion period covering learning records, operational logs, backups and provider records.

Unsent conversation drafts use the app's secure device storage. Sign-out and deletion clear the active saved draft. Native secure storage can survive reinstalling an app, so uninstalling Savili is not a request to delete your account or server records. Account deletion does not promise immediate erasure of every backup or provider-held record.

Your choices and deletion controls

You can choose whether to use voice, photos and location. Device settings let you withdraw microphone or location permission. You can edit your learning preferences and review saved lessons within the app.

• Settings → Delete learning data removes your learning profile, attempts, sessions, generated images, evidence and scheduled reviews. Your account, content-free usage records and access grants remain.
• Settings → Delete my account deletes the isolated Savili account and its associated learning, access and usage records. For Apple sign-in, Apple authorisation is revoked before deletion. If revocation or deletion fails, the app preserves a way to sign in and retry.
• Deleting a Savili account does not delete your accounts or data in other Bliss family apps.

Visiting this privacy page

This page uses no analytics, tracking cookies, forms, external fonts or third-party scripts. Its app icon and stylesheet are served with the page.

AWS Amplify hosts the static site in the Ireland region and delivers it through a global content delivery network. Serving and protecting the page involves ordinary connection information such as your IP address, requested URL, browser information and request time. Hosting and security providers can process this information where their infrastructure operates, including outside Switzerland. It is separate from the information you enter in the app.

• AWS privacy notice

Questions and privacy requests

Contact savili@shumil.in to ask about this notice or request access, correction or deletion of information under our control. Include the app name and enough information to locate the relevant account or record. Do not send passwords, API keys or unrelated sensitive information.

We may ask for proportionate information to verify that a request concerns your data. Rights and available remedies depend on the applicable law. You can also raise a concern with the relevant data protection authority, including the Swiss Federal Data Protection and Information Commissioner.

This notice is updated when the app’s data handling changes. The date at the top identifies this version.

• Swiss data protection authority