Security & Privacy
What you save is personal. This page says plainly how it is protected, and where the limits are.
Encrypted in transit, secrets encrypted at rest
Everything between your browser and our servers travels over HTTPS. The most sensitive things we hold for you, such as AI provider keys and calendar tokens, are encrypted with AES-256-GCM before they are stored.
Never used for training
When something needs AI, only the relevant content is sent to the AI provider, and the result is written back to your account. We don't use what you save to train any model, ours or anyone else's.
Open Source Trust
The whole product is open source under the AGPL-3.0 license, so anyone can read exactly how your data is handled and check it against what we say here.
Run it yourself
You can self-host Savedly on your own server. Your data then stays in your database and storage, and AI requests go only to the provider you choose.
Where your data lives
On the hosted service, your account and saved items are kept in a managed PostgreSQL database, uploaded files in Cloudflare R2, and search vectors in a managed vector index. Every record is tied to your account, and every request is checked against it, so one person can't read another's library.
Savedly is a small, independent project. We don't hold security certifications such as SOC 2 or ISO 27001, and we won't claim otherwise.
Sign-in and sessions
You sign in with Google or GitHub, so we never see or store that password. Your session is held in cookies that scripts on the page can't read. On a self-hosted install that uses email and password, passwords are hashed with scrypt and never stored in plain text.
The vault
Items in the vault are hidden behind a PIN, which is hashed with scrypt and checked on the server. This is access control, not end-to-end encryption: the content itself is stored like the rest of your library.
Reporting Vulnerabilities
If you find a vulnerability, please report it privately through GitHub's private vulnerability reporting or the contact page, not in a public issue. Give us a reasonable time to fix it before you disclose it.