To help you cut your carbon footprint, an app has to understand how you live: how you get around, what you eat, where you shop. That is exactly the kind of information most people would rather not hand to a company.
Most apps settle this the easy way. They collect everything, store it on their servers and promise to look after it. SAVE takes a different route. It was designed from the start to measure what it needs without building a record of your life anywhere but your own phone.
The privacy paradox of climate apps
Useful climate advice has to be personal. A tip about driving less means nothing to someone who already cycles everywhere, and someone who eats little meat does not need to hear about burgers.
But the data that makes advice personal is also among the most sensitive there is. A log of your journeys shows where you live and work and when you are away. Your meals and shopping say a lot about your routines and health. Research on AI sustainability tools finds that this worry is one of the main reasons people hold back from using them (Clark et al., 2025).
So the question behind SAVE was: can an app give personal advice without collecting personal data? It turns out it mostly can, if privacy is part of the design rather than a promise added at the end.
Four ideas behind the design
1. Your phone keeps the diary
Everything that describes your life in detail — your journeys and their routes, your meals, your purchases, the places you shop — is stored only on your phone. It is never uploaded for safekeeping, and we have no copy.
Think of your phone as a private diary that only you hold. SAVE reads from it to help you, but the diary never leaves your pocket. Uninstall the app and it is gone.
Your journeys and routes live on your phone.
2. Only numbers and categories are sent
Some work is better done on a server: calculating your score, understanding what you type to the assistant, writing a personal tip. But the server never needs to know where you were to do that maths. So the app sends only the few facts each task needs.
A preview of your journey — these locations never leave your phone.
Never sent to our servers:
- your location, your GPS positions or your location history
- the routes of your journeys, or where they started and ended
- the addresses or names of places you visit, or which shops you go to
Only sent, when a feature needs it:
- for each journey, how you travelled, how far and when — for example “car, 4 km, Tuesday morning” — and its estimated CO₂
- the kind of place a shopping trip ended at — “grocery store” or “shopping centre”, never which one
- the kind of each purchase and whether it was new or second-hand
- the meals you log, and anything you type to the assistant
- for your home-screen tip, a short summary of recent weeks: how many journeys you made by each kind of transport, how far, and how many meals you logged at each impact level — no places, dates or dish names
The same rule applies outside SAVE. Weather for a journey is looked up with an area of about 10 km, enough for a local forecast but not an address, and your route is never part of the request.
Each feature gets the smallest piece of information that still does the job. That is what European data protection law calls data minimisation, and what the GDPR asks for when it requires data protection “by design and by default” (GDPR, Articles 5 and 25).
3. The server does the maths, then forgets
What reaches the server is used once and discarded. It calculates the answer, sends it back to your phone and keeps nothing — it is not written to a database, and we keep no log of what was sent.
It works like a calculator rather than a filing cabinet. The only things our server keeps about you are what any account needs to sign in.
Your score and tips return; the server forgets.
4. Organizations see the crowd, not the person
Many people use SAVE because their employer offers it. Organizations naturally want to know whether their climate efforts are working, and employees naturally do not want to be watched.
SAVE serves both. Campaign results reach the organization without any link to the person who sent them, so nobody can tell whose they are. Weekly insights are built from anonymous totals and are shown only when at least five people contributed, so no figure can point to one person. The organization learns what is changing across its people, never what any one of them did.
You stay in control
A privacy-first design also makes your choices simple and real:
- Location is optional. You can decline it and log journeys yourself.
- Shop recognition is off unless you turn it on.
- Sharing weekly totals with your organization can be switched off at any time.
- Deleting your account removes it from our servers and erases your history from your phone, in one step.
No data is sold, none is used for advertising, and every outside service SAVE relies on is named in the app privacy policy, together with exactly what it receives.
Smarter, not just safer
It is often assumed that better personal advice needs more data held centrally. SAVE is built on the opposite idea: what makes feedback useful — your own patterns, your own baseline, your own progress — can stay with you.
That design is safer, because there is no central store of people’s lives to leak or misuse. It is also simpler to trust, because you do not have to take our word for how we look after your history: we never hold it.
Your data stays with you. SAVE only borrows what it needs, for as long as it needs it, to help you make lower-carbon choices.
Sources