Privacy policy
Effective 4 September 2026. Applies to the SavannahIQ Android app (com.savannahiq.app) and this website.
The short version
SavannahIQ collects the minimum needed to give you an account and value the holdings you choose to enter: your name, email, phone number and the positions you type in. It is not sold, and it is not used for advertising. You can delete all of it from inside the app at any time.
Who we are
SavannahIQ is operated from Nairobi, Kenya, and is the data controller for the personal data described here. For anything in this policy, write to [email protected].
What we collect
Information you give us
- Account details — first and last name, email address, and phone number in international format. Your password is stored only as a cryptographic hash; we never see it.
- Your holdings — the counters, quantities, prices paid, purchase dates and notes you enter. These are figures you type in. SavannahIQ has no connection to your broker or your CDS account and cannot read what you actually own.
- Your watchlist and alert rules — the counters you follow and the conditions you want to hear about.
Information generated by using the service
- Verification codes — a one-time code sent by SMS when you register or sign in. Codes are short-lived and are not retained after use.
- Push notification token — an identifier issued by Firebase Cloud Messaging so alerts reach your device. It is deleted with your account.
- Daily valuations — a snapshot of what your entered book was worth at each close, so the app can show change over time.
- Technical logs — server logs recording requests and errors, used to keep the service working and to spot abuse.
What we do not collect
No advertising identifiers. No location. No contacts. No analytics profile built for marketing. SavannahIQ has no payment processing, so it never sees card or M-Pesa details.
Why we use it, and on what basis
- To run your account — registration, sign-in, and verifying that a phone number and email belong to you. Necessary to perform the agreement between us.
- To value your holdings and send the alerts you asked for — the service you signed up for.
- To keep the service secure and working — rate limiting, error reporting, and preventing abuse. Our legitimate interest in a service that stays up and is not attacked.
We do not use your data to train any model, and we do not sell or rent it to anyone.
Artificial intelligence, and what it is not given
Some research calls are drafted by a language model (Google Gemini) and are labelled AI draft wherever they appear. The model is given published news articles and market prices, and nothing else. No personal data is sent to it — not your holdings, not your watchlist, not your identity. It does not know you exist, and it is not asked anything about you.
Who else touches your data
Only the providers needed to deliver the service, and only with what each one needs:
- TalkNTalk (Kenya) — receives your phone number to deliver verification codes by SMS.
- ZeptoMail — receives your email address to deliver account email.
- Google Firebase Cloud Messaging — receives your device token to deliver push alerts.
- Contabo — object storage and hosting infrastructure.
- Sentry — error reporting. Reports are stripped of email addresses and phone numbers before they are sent.
Some of these operate outside Kenya, so your data may be processed abroad. We rely on providers that offer appropriate safeguards for such transfers. We do not disclose your data to anyone else except where the law requires it.
How long we keep it
Your account data is kept for as long as you have an account. Delete the account and it is removed immediately, along with your holdings, watchlist, alert rules and device tokens — see Delete your account. Server logs are kept for a short period for security and troubleshooting. Backups roll over on their own schedule, so a deleted record may persist in a backup briefly before being overwritten.
Your rights
Under Kenya's Data Protection Act, 2019 you have the right to be informed, to access a copy of your data, to have inaccurate data corrected, to have your data deleted, to object to certain processing, and to lodge a complaint with the Office of the Data Protection Commissioner. To exercise any of these, write to [email protected] from the address on your account. Deletion is also available directly in the app, without asking us.
Security
Traffic between the app and our servers is encrypted in transit. Passwords are hashed, never stored in readable form. Sessions can be revoked, and the app offers an optional device lock. No system is perfect, and we do not claim otherwise.
Children
SavannahIQ is not intended for anyone under 18 and we do not knowingly collect their data. If you believe a child has an account, tell us and we will remove it.
Changes
If this policy changes materially we will update the effective date above and notify account holders. Continuing to use the service after a change means you accept the revised policy.