SAVE app privacy policy

In short

SAVE records your journeys so walking, cycling and public transport can earn you Green Points and show you how your travel habits change over time. To do that it needs your location and your device's activity detection, including while the app is closed or not in use. Your journeys are stored on your device. We do not keep them, we do not use them for advertising, and we do not sell them.

A few features need help from companies that work for us — hosting our server, interpreting what you type, sending email, drawing maps. Each one is listed under third parties with exactly what it receives. None of them receives your routes or where you have been.

How to read this

SAVE gains features over time, and not every feature described here is switched on in every version of the app. This policy sets out what SAVE does when it does a thing, and the limits that apply either way — it is not a claim that every feature below is live in the version on your phone today. Where something is available only if you turn it on, it says so.

What we will not do is quietly widen this. If we ever begin collecting a kind of data this policy does not already cover, we will update the policy and say so before that starts, not afterwards.

Who we are

SAVE is provided by LessTrace. For anything in this policy, or to exercise any of the rights below, write to save@lesstrace.com.

What we collect, and why

Location — including in the background

The app collects precise location including when the app is closed or not in use. This is what lets it notice that a journey happened, measure how far it went, and draw its route. Journeys mostly happen while your phone is in a pocket, so without background collection the feature does not work at all.

We ask only after showing you an in-app explanation. You may decline and still use SAVE by logging journeys yourself. You can withdraw the permission at any time in your device settings.

Recognising places — only if you turn it on

In Settings you can turn on place recognition. It is off unless you do. When it is on, the app downloads a map of grocery stores and shopping centres, and of restaurants, cafés and libraries — the same file for everyone in the country, so the download says nothing about where you are — and checks, on your phone, where a journey ended. That lets SAVE tell a shopping trip from any other journey.

When a journey ends somewhere that is not a shop and you stay at least 20 minutes, the app asks once, after you leave, what the stop was so you can log it for Green Points — eating out, shopping, something else, or home or work, and the library when the map has one there. You choose; the map only decides whether the library is offered. Your answer is remembered on your phone for that place, so it is not asked again, and it is never asked at home (where your days usually begin) or at a place you answered as home or work. You can make the app forget every answer in Settings.

Your location is not sent anywhere to do this. On your phone, the app keeps the kind of place a journey ended at, which place in the downloaded map it was, and for other places where it was and what you answered — so it can show visits on your own map, ignore a place you choose (for example, one where you work) and not ask twice. Which place, and where, never leaves your phone: anything sent for your score says only "grocery store" or "shopping centre". The map contains only the kinds of place listed above and nothing else — no clinics, pharmacies, places of worship or political offices — so it cannot suggest that you visited one. Turning the feature off deletes the downloaded map. The map is built from OpenStreetMap data (© OpenStreetMap contributors).

Shopping tips and reminders

With place recognition on, the app shows one practical tip when a journey ends at a shop — at most one a day — and, when your next journey starts, asks what you bought. Both are created on your phone; nothing is sent to show them. They can be turned off in Settings, and they never turn themselves off.

If your organization runs its own server

An organization can run SAVE's server itself. If your invitation code names such an organization, the app finds its server in a public list on save.lesstrace.com, checks that the server says it belongs to that organization, and from then on talks only to it. That server then takes the place of "our server" everywhere in this policy, and the organization is responsible for it. What your phone keeps, and what it sends, is exactly the same.

Recognising public transport

While journey tracking is on, the app downloads a list of Finland's public transport stops and stations — the same file for everyone — and checks, on your phone, whether a journey looked like a train, metro, tram or bus ride, or a walk. When it looks like public transport, the app cheers it right after the ride and you confirm it or say it wasn't. The guess is kept with the journey on your phone. The stop data comes from Digitransit (© Digitransit, CC BY 4.0) and Fintraffic (Source: Fintraffic / digitraffic.fi, license CC 4.0 BY), downloaded by our server — your location is never sent to them, or to us, for this.

The app does not ask how you travelled after each journey. At most twice a day — in the afternoon and in the evening, once you have stopped moving — it reminds you of lunch or dinner if it is not logged, and, while journey tracking is off, asks for today's trips. You can choose the times in Settings. These notifications are created on your phone.

Public transport connections (optional)

If you turn it on, the app can show the next public transport connections for your usual trips — the departure, the line and how long it takes — and open them in your local journey planner. It is off until you turn it on, after the app has explained what it sends, and you can turn it off any time in Settings.

To find the connections, the app sends the stop nearest to where your usual trip starts and the stop nearest to where it ends, and the time. Your phone picks those stops itself, from the stop list it already has. It sends them only when you tap Show connections, never in the background — and never your address, your exact position or your route. Our server asks Digitransit (Finland's public transport route service, run by HSL and Fintraffic) and keeps nothing; Digitransit sees our server, not you. A stop is still close to where you are: the stops near your home and your work say roughly where they are, which is why this is optional.

Open in journey planner opens your region's own planner — HSL in the Helsinki region, your city's planner elsewhere, or Fintraffic's Matka — with those two stops filled in. That is your tap to their website or app, under their own terms.

Physical activity

Your device tells the app whether you are walking, cycling, or travelling in a vehicle. That is how a journey is classified. It is used for nothing else.

Account details

An email address, a name, and a password so you can sign in. Passwords are stored only as a salted hash and are never readable by us or anyone else.

What you type in

Journeys and meals you log by hand, including anything you write when describing them. Descriptions are sent to our server to be interpreted and are not retained afterwards.

Maps and weather

When the app draws the route of a journey it needs map images, and it requests them from a map provider — OpenFreeMap for the light map and CARTO for the dark one. Like any request your phone makes to any website, this tells them your IP address and which part of the map you are looking at. It does not tell them who you are, and the route itself is never sent — it is drawn on your phone, on top of the images they send back. If you never open a journey's map, the app never contacts them.

The weather of a journey comes from a weather service — currently Open-Meteo. When a journey ends, and when you log a journey in the assistant, the app asks it for the weather at that hour near where you were. Your phone sends only an approximate position, rounded to about 10 km — enough for a local forecast, not an address — and the hour. Never your route, never the journey itself, and nothing about who you are. The weather is kept with the journey on your phone, and walking or cycling in rain or snow earns extra Green Points.

For the hint about your next journey, the app also asks the same service for the forecast of the coming week at that same rounded position. The forecast — only the kind of weather and the temperature for each weekday and hour, never a position — goes with the request for your score, so the hint can suggest public transport when rain is expected and show the Green Points the weather adds.

We may change which map or weather provider we use. Whoever it is, the rule is the same and is the reason this is worth stating: such a provider only ever receives what it needs to return a map image or a forecast, it never receives your journeys, and it is not permitted to use what it does receive for its own purposes.

Exactly where each thing is stored

This is the part most privacy policies leave vague, so here it is in full.

On your phone, and nowhere else

• Every journey: start and end time, distance, duration, transport mode, estimated emissions
• The route of each journey — the actual path you travelled
• Start and end coordinates, speed, altitude, and the activity your phone detected
• If you turned on place recognition: whether a journey ended at a grocery store or shopping centre, which shop in the downloaded map it was, when you arrived and left, any places you told the app to ignore, and the downloaded map; for other places you stayed at, where and when, and what you answered to "Where were you?"; and whether a meal you logged was eaten out
• Meals you have logged
• Purchases you have logged: what you called the item, its kind (for example clothing), whether it was new, second-hand, repaired or borrowed, any habit you mentioned, such as bringing your own bag, and for a grocery shop the food items you listed
• Which campaigns you have joined
• Your settings: units, your car's impact level, theme

None of this is uploaded for storage. It lives in the app's private storage on your device and is deleted when you uninstall the app.

That is how SAVE works and how we intend it to keep working. If we ever offer a way to back this up or move it to a new phone, it would be something you switch on yourself, described to you at the point you switch it on, and off unless you do. We will not start storing your journeys on our servers by default.

On our servers, kept

• Your account: email address, name, password hash, and when it was created
• Activation codes. Registering requires a code, which an administrator at your organisation creates by entering your email address into their dashboard. That email address and the code are stored so the code can be checked when you register, and deleted when you delete your account.
• Sign-in sessions, so you stay logged in — deleted when you sign out or delete your account
• Password reset requests. When you ask to reset your password we store a one-time code, for an hour, so the link in your email can be checked. We store only a scrambled form of it, never the link itself, and it is discarded once used or expired.
• A daily count of how many times you used the assistant to log something, which is how the daily limit is enforced. It is a number per day, not what you wrote.
• Campaign results, stored without any link to you — the total journeys and emissions saved for a campaign, with no user identifier attached
• Weekly totals for your organisation, stored without any link to you — see weekly totals below. Only the totals of everyone who shared that week are kept, never your own figures. To stop the same phone being counted twice in a week, a scrambled code made from your account and the week is kept until that week closes (about two weeks), then deleted.

Sent to our servers, then discarded

• Journey history, when your sustainability score is calculated. The server computes the result, returns it, and keeps nothing.
• Your shopping, when the same score is calculated: the time of each shop visit and whether it was a grocery store or a shopping centre, and for each purchase its kind, whether it was new, second-hand, repaired or borrowed, its impact level and any habit you mentioned. Never which shop, never where, and never the name you gave an item.
• Shopping descriptions you type, when the assistant interprets them
• Meal and journey descriptions you type, when the assistant interprets them
• The name of a meal, when its emissions are estimated
• A summary of your last four weeks, when the tip on your home screen is written: how many journeys you made by each kind of transport and how far, how many car journeys were under 2 km, how many meals you logged at each impact level, the ingredients you logged more than once, and — if you shop with SAVE — how many shop visits you made and how many purchases you logged of each kind and condition. No routes, places, shops, dates or times, and no meal or item names.
• The names and ingredients of up to three of your higher-impact meals from the last four weeks, only when you open a food tip to see lighter alternatives to them

These requests are processed and discarded. We do not write them to a database and we do not keep logs of their contents.

Where the AI features run. Several features pass text from our server to Google's Gemini API, which returns a result: turning what you typed into an entry; breaking a meal we do not already have in our own food database into ingredients; writing the tip on your home screen from the four-week summary above; and choosing, from our own list of dishes, the lighter ones closest to a meal of yours. Google processes this to return that result to us, not for its own purposes. We never send your email address, your name, your account, your location, your routes or your journey history with it.

The CO₂ figures are never produced there. They are calculated on our own server from published emissions factors.

Sending you email. When we need to email you — resetting your password is the only case today — we hand your email address and the message to Resend, which delivers it for us. They receive the address and what the message says, and nothing else: not your journeys, not your meals, not your score. They act on our instructions and may not use any of it for their own purposes. Mail for SAVE is sent through their European region. We do not use open or click tracking, so we do not record whether you opened an email or followed a link in one.

Third parties, and exactly what each receives

These are every company outside LessTrace that receives data from SAVE. Each acts on our instructions, receives only what its job needs, and may not use it for its own purposes. We do not sell data to any of them, and none of them is an advertiser or a data broker.

If we add or replace a provider, it will appear here before it receives anything.

Public data we download. Apart from the optional connections service above, our server downloads public map and transport data in bulk: shops, cafés, restaurants and libraries from OpenStreetMap (© OpenStreetMap contributors, ODbL), public transport stops from Digitransit (© Digitransit, CC BY 4.0) and train stations from Fintraffic / digitraffic.fi (CC BY 4.0). These requests are made by our server, for the whole country, and contain nothing about you or anyone else — no location, no journey, no account. Your phone then downloads the processed files from us and does all the matching itself. The app credits these sources in Settings, with the date the data was received.

What we never do

• We do not use your precise location or your journey history for advertising or to target content
• We do not sell your data, and we do not share it with data brokers
• We do not pass your journeys, your routes or your location to third parties for their own purposes. The only third parties your phone contacts directly are the map and weather providers, and neither of them receives a route or a journey; the weather service receives only a position rounded to about 10 km. Everything else goes through our server, to the providers listed above, and only what is listed there
• We do not build profiles about you for anyone other than you

Campaigns and how they are chosen

Campaigns are sustainability challenges published by an organisation — usually your employer.

Which ones you are shown may depend on things attached to your account and your device: the organisation your account belongs to, and broad settings such as the language or region your device is set to. None of those is a position.

If a version of SAVE ever narrows campaigns by area, it would use a general area only — a city, region or country — worked out on your device, with only that coarse result leaving it. We would say so here, and in the app's data disclosure on Google Play, before that shipped.

Whichever signals are used, three limits hold and will keep holding: your precise location is never used to decide what you are shown, your routes and journey history are never used for it either, and we never pass your data to an advertising network. That applies in full to sponsored or partner campaigns, if those ever appear.

Taking part is the only thing that sends anything back. Reporting progress on a campaign sends two numbers and nothing else: how many qualifying journeys you made, and how much CO₂ that saved.

Weekly totals for your organisation

Once a week, the app sends our server a summary of the week that has just finished, made on your phone. It contains counts and bands only: how many journeys you made by each kind of transport, how far and their estimated emissions; how many car journeys fell into each distance band (for example under 3 km); in which broad part of the week they happened (for example "weekday morning"); how many were in rain or snow; how many days you travelled without a car; the kind of car set in the app (electric, hybrid or petrol/diesel), if you drove; how many meals you logged at each impact level and their main kind of protein (for example "plant-based"); how many shop visits you made and how many purchases were new, second-hand, repaired or borrowed; and whether your share of lower-carbon journeys went up or down compared with your own previous weeks.

It never contains a place, a route, a shop, a meal or item name, an ingredient, a date or an exact time.

Our server adds your summary to the totals for that week and does not keep the summary itself. Your organisation sees a week only after it has closed, about two weeks later, and only if at least five people contributed; comparisons over time need at least ten. That way no figure can be traced to one person, and nobody can watch a number change when one person's week arrives.

You can stop this at any time in Settings → Share weekly totals. Your weeks are then left out of your organisation's totals.

If SAVE was given to you by your employer

Your organisation's dashboard is about campaigns, not about people. It shows campaign results: the totals, and the individual progress reports those totals are made of.

Those reports cannot be traced back to you. A report is a number of journeys, an amount of CO₂ saved and the time it was sent. No user identifier is attached to it, and none is stored on our side either, so neither your organisation nor we can work out afterwards which report came from whom.

The other thing it sees is the weekly totals described above: totals across at least five people, never one person's week. Any further reporting will follow the same rule. Your organisation is not shown your journeys, your routes, your location, your meals or your score, and is not told whether you have opened the app.

The one thing an administrator necessarily knows is who they invited: they create your activation code from your email address, so they know that address. That is the whole of it.

Your rights

Under the GDPR you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. Write to save@lesstrace.com and we will respond within 30 days. You may also complain to your national data protection authority; in Finland that is the Office of the Data Protection Ombudsman.

Deleting your account

In the app: Settings → Account → Delete account. If you have already uninstalled it, use our account deletion page. Deletion is permanent and signs you out everywhere. It removes your account, your sign-in sessions, your daily usage counts and the activation code that holds your email address from our servers. When you delete your account in the app, it also erases from your phone everything recorded under it — journeys and routes, meals, shop visits, purchases, campaigns and the name kept for reminders. If you uninstall the app instead, uninstalling removes all of it from the phone. Anonymous totals (campaign results and weekly totals) are not linked to you and so cannot be singled out or removed.

Children

SAVE is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has created an account, write to us and we will delete it.

Changes

If we change what the app collects or what we do with it, we will update this page and change the date at the top. Material changes will be shown in the app.