Privacy Policy – Footprint
Footprint is a mobile app that helps you understand and reduce your carbon footprint by tracking journeys, energy use and other activities. This Privacy Policy explains what information we collect, how we use it, and the choices you have.
If you have any questions about this Policy or how we handle your data, you can contact us at info@sashy.ai.
1. Who this app is for
- Footprint is intended for people aged 13 and over.
- The app is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, please contact us and we will delete it.
2. Information we collect
We only collect information needed to provide and improve the app’s core features. We do not sell your data and we do not use third‑party advertising SDKs.
2.1 Account and profile information
When you sign in with Google or Apple, we receive:
- A unique identifier from your sign‑in provider.
- Your email address (if shared by the provider).
- Your display name and optional profile picture.
Within the app you can also set:
- A username used for social / leaderboard features.
- An annual carbon target (tonnes of CO₂e per year) and whether to show that target on charts.
We store account timestamps such as when your account was created and when you last signed in.
2.2 Location and journey information
With your permission, Footprint uses your device’s location to detect journeys and estimate emissions. This includes:
- Precise location points (latitude, longitude, accuracy, speed, timestamp) recorded while a journey is active.
- Derived journey summaries: start and end time, distance, transport mode, and approximate start/end place names derived from reverse geocoding.
On your device, journeys and their raw points are stored in a local SQLite database so the app can work even with a poor network connection. On the backend, journeys and points are stored in a database associated with your account.
2.3 Carbon events and energy use
You can record other sources of emissions (for example, food, products or energy use). For each event we may store:
- Item or activity name, category and amount.
- Calculated carbon footprint (per unit and total).
- How and when it was recorded (for example, manually, via a receipt or photo).
You can also configure household energy profiles, which store the types of energy you use (for example, electricity or gas) and approximate annual usage amounts. These records are stored in the backend database linked to your account.
2.4 Photos and receipts
If you choose to analyse a photo or receipt:
- The app sends a base64‑encoded copy of the image to our backend.
- The backend forwards that image to third‑party services (Google Cloud Vision, Google Document AI, or Clarifai) to detect items or extract text.
- Photos are processed in memory for this purpose and are not stored permanently in our database. We store only derived data, such as detected objects, line items and their estimated footprints, and logs of when the analysis happened.
2.5 Notifications and device information
To send you notifications we collect:
- A device push token (an identifier for your device provided by Apple or Google).
- The platform type (for example, iOS or Android).
We also store your notification preferences:
- Whether app notifications and particular categories (events, digests) are enabled.
- Your preferred digest frequency (daily, weekly, monthly), time of day and timezone.
On your device, notification preferences and last‑run timestamps are stored locally using secure storage so that digests can be scheduled correctly.
2.6 Social, groups and leaderboards
If you use social features, we store:
- Your username, display name and optional profile picture for display in lists and leaderboards.
- The groups you create or join, including group name, visibility (public or private) and your role (for example, admin or member).
- Aggregate emissions statistics per user for a given timeframe, calculated from your journeys and carbon events.
We do not expose your raw journey or event details to other users through these endpoints; social features are based on aggregated numbers and basic profile fields.
2.7 Diagnostic logs
The app can send optional diagnostic logs to help us understand errors and improve stability. These logs may include:
- Platform (iOS, Android or web), log level, a short tag (for example, “TripEngine”), a message and a JSON “extra” payload.
Logs are linked to your account in the backend so we can investigate issues. They are not used for advertising or sold to third parties.
3. How we use your information
We use the information described above to:
- Provide the app and its features, including automatic journey detection, carbon footprint estimation, charts and summaries, digest notifications, energy and consumption tracking, and optional social and group features.
- Maintain and improve the service, for example by understanding where carbon calculations or tracking may be inaccurate and monitoring reliability, performance and errors via diagnostic logs.
- Keep your account secure, for example by managing authentication and refresh tokens and preventing abuse of leaderboards and group features.
We do not:
- Sell your personal data.
- Use your data for third‑party advertising.
- Integrate third‑party advertising SDKs.
4. Legal bases for processing (EU/UK users)
For users in the EU, UK and similar jurisdictions, we rely on:
- Performance of a contract – most processing is necessary to provide the app you chose to use (for example, creating journeys, storing events, managing your account and groups).
- Your consent – for location access, notifications, camera access and the use of third‑party AI services, which you can enable or disable through system prompts and app settings.
- Legitimate interests – for aggregated analytics and diagnostic logs used to improve the app and ensure security, where these interests are not overridden by your rights and interests.
5. Sharing your information
We share data with:
- Service providers that help us operate Footprint, such as hosting and database providers (for example, an EU region data centre) and email/support tools if used when you contact us.
- Third‑party APIs used for core features, including Google Cloud Vision and Document AI (for photo/receipt analysis), Clarifai (for food recognition mode), and Google/Apple (for sign‑in).
These providers process data on our behalf to deliver the functionality described in this Policy. We do not grant them permission to use your data for their own advertising.
We may also share information if required by law or to protect our legal rights, for example in response to a valid legal request.
6. International data transfers
Our backend infrastructure and databases are currently deployed in the EU (for example, a region such as Frankfurt), but some third‑party providers (including Google and Clarifai) may process data in other countries.
Where data is transferred outside your country or region, we rely on appropriate safeguards provided by those providers (such as standard contractual clauses) where required by applicable law.
7. Retention and deletion
We keep your data only for as long as needed to provide Footprint and for legitimate business purposes, or until you ask us to delete it.
While your account is active, we retain:
- Account and profile information.
- Journeys and trip points.
- Carbon events and energy profiles.
- Notification preferences and push tokens.
- Social/group memberships and leaderboard aggregates.
- Diagnostic logs.
If you delete your account from within the app:
- Your account and associated personal data are deleted or irreversibly anonymised.
- This includes account and profile records, journeys and trip points, carbon events and energy profiles, notification settings and push tokens, groups you created or joined (to the extent they can be safely removed or detached from your identity) and refresh tokens and active sessions.
- Locally stored data on your device (credentials, local journey database) is cleared by the app’s deletion flow, but you can also delete the app or clear its data from system settings for additional assurance.
We may retain some aggregated, anonymised statistics (for example, total emissions across all users) that cannot be linked back to you personally.
8. Your rights and choices
Depending on your location, you may have the right to:
- Access a copy of the personal data we hold about you.
- Correct inaccurate or incomplete information.
- Delete your account and associated data.
- Object to or restrict certain types of processing.
- Withdraw consent for permissions such as location, notifications or camera at any time using your device settings (this may limit app functionality).
You can exercise many of these rights directly in the app (for example, via Settings and the Delete Account option). You can also email info@sashy.ai and we will help with access, correction or deletion requests.
9. Security
We take reasonable technical and organisational measures to protect your data, including:
- Using industry‑standard encryption in transit (HTTPS) between the app and backend.
- Limiting direct database access to the backend services.
- Storing refresh tokens as hashed values rather than in plaintext.
No system is perfectly secure, but we work to keep your information safe and will notify you of any data breaches where we are legally required to do so.
10. Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in the app or in legal requirements. If we make material changes, we will update the “Last updated” date at the top and may notify you in the app or by other reasonable means.
If you continue to use Footprint after changes take effect, you agree to the updated Policy. If you do not agree, you can stop using the app and delete your account.
11. Contact
If you have questions, requests or complaints about this Policy or how we handle your personal data, please contact:
Email: info@sashy.ai