Privacy Policy

SavvySMS · Last updated: 5 July 2026

SavvySMS is built on a single principle: your messages stay on your device. We do not collect, upload, or sell your SMS data.

1. Who we are

SavvySMS is developed by Gowdhaman Karthikeyan, an independent developer based in India. The app is published on Google Play under the package name in.savvysms.app.

Contact: savvygandalf@gmail.com

2. Data we do not collect

SavvySMS does not have a server of its own. The following data never leaves your device and is never transmitted to us:

Your SMS messages or their contents
Your contact names or phone numbers
Your financial transaction data
Your location
Any personal identifiers
Usage analytics

SavvySMS keeps two technical logs entirely on your device — a sort/debug log (off by default) and a crash/events log (always on). Neither ever contains message content, and neither is automatically sent anywhere. They leave your device only if you deliberately tap "Share" on one and choose where to send it (for example, by email or WhatsApp) — typically to help us diagnose a problem you're reporting.

3. Permissions and why we need them

READ_SMS, RECEIVE_SMS, SEND_SMS, WRITE_SMS, RECEIVE_MMS, RECEIVE_WAP_PUSH
Required to function as your default SMS app. Used to read your inbox, sort messages into folders, send new messages, and receive incoming messages. All processing happens on-device.

READ_PHONE_STATE
Used only to detect which SIM slots are active on dual-SIM devices, so a message can be sent from the correct SIM. No phone number, IMEI, or other device identifier is stored or transmitted.

READ_CONTACTS
Used to display contact names next to phone numbers in your inbox. Contact data is read locally and never stored in our database or transmitted anywhere.

INTERNET, ACCESS_NETWORK_STATE
Used in two situations:

When you sign in with Google and choose to back up to Google Drive (see Section 4).
To look up a small brand icon for known senders (e.g. your bank or a delivery service), so their messages are easier to recognise at a glance. See Section 5 for exactly what this sends.

ACCESS_NETWORK_STATE is used only to check whether a network connection is available before attempting either of the above; it does not reveal your location or identity.

POST_NOTIFICATIONS, FOREGROUND_SERVICE, FOREGROUND_SERVICE_DATA_SYNC
Used to show notifications (such as OTP alerts) and to run background tasks like sorting, scanning, and backup as Android foreground services. No data is transmitted as a result of holding these permissions.

USE_BIOMETRIC, USE_FINGERPRINT
Used for the optional app lock feature. Biometric authentication is handled entirely by Android — SavvySMS never sees or stores your fingerprint or biometric data.

4. Google Drive backup

If you choose to enable Google Drive backup, a file containing your messages, folder rules, custom folders, and finance account preferences is uploaded to your personal Google Drive account. This file is stored in your Drive's app-specific folder and is accessible only by SavvySMS on your device and by you through your Google account.

We do not have access to your Google Drive or your backup file. You can delete the backup at any time from Google Drive.

SavvySMS also offers a Local Backup option that saves a backup file directly on your device without using Google Drive or the internet at all.

Google's privacy policy applies to data stored in Google Drive: https://policies.google.com/privacy

5. Brand icons

To help you recognise senders at a glance, SavvySMS shows a small logo next to known businesses (for example, your bank or a delivery service) instead of a plain initial. This works as follows:

SavvySMS matches the sender's ID code against a list of well-known businesses built into the app. It never guesses — if the sender isn't confidently identified this way, no icon is fetched and a plain coloured initial is shown instead.
If a match is found, SavvySMS looks up an icon for that business's public website domain (e.g. "hdfcbank.com") from two external services: Logo.dev and Google's public favicon service. Only the domain name is sent — never your phone number, the sender's raw address, any message content, or any other identifying information.
The icon is downloaded once per business and stored on your device from then on, so the same lookup is not repeated for every message.
This lookup happens automatically in the background for recognised senders; there is currently no setting to disable it, since it never involves any of your personal or message data — only a public company domain name.

Logo.dev's and Google's own privacy policies apply to how they handle this request: https://logo.dev/privacy-policy and https://policies.google.com/privacy

6. On-device storage

SavvySMS stores a local copy of your SMS messages in a private database on your device. This database is used to power folder organisation, search, and the finance tracker. It is not accessible to other apps and is deleted when you uninstall SavvySMS.

7. Third-party services

SavvySMS uses the following external services:

Google Play Services Auth — for Google account sign-in (Drive backup only)
Google Drive API — for uploading and downloading backups to your Drive
Logo.dev and Google's favicon service — for brand icon lookups, as described in Section 5. Only a public company domain name is ever sent to these services.

No advertising SDKs, analytics SDKs, or crash reporting SDKs are included. SavvySMS contains no ads.

8. Children's privacy

SavvySMS is not directed at children under the age of 13. We do not knowingly collect any data from children.

9. Changes to this policy

If we make material changes to this privacy policy, we will update the "Last updated" date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.

10. Contact

If you have questions or concerns about this privacy policy, please contact us at savvygandalf@gmail.com.