Screvi

GDPR overview

GDPR is addressed concretely. The privacy policy, last updated 27 February 2026, opens by stating that Screvi is a company based in Portugal, so the publisher sits inside the EU and no Article 27 representative is required. It sets out the legal bases used for EU/EEA and UK users, namely consent, performance of the contract, legitimate interests and legal obligations, and grants access, rectification, erasure, objection, restriction, portability and withdrawal of consent, exercised at support@screvi.com, with a right to complain to the local supervisory authority. Section 13 confirms that Residents of Portugal and the EU/EEA have rights under the GDPR; US state rights (California, Colorado, Connecticut, Utah, Virginia) are covered separately. Do-Not-Track signals are not honored. Gaps remain: no DPO is named, no data processing agreement is offered, no SOC 2 or ISO 27001 certification is published, and no standard contractual clauses are mentioned despite US hosting.

Who owns the data?

Screvi's terms are explicit on ownership: Users retain ownership of their content. The same clause grants Screvi a license to use, store, and share your content as necessary to provide and improve our services, which is broad wording with no stated limit on duration or scope. In practice, highlights stay private to the account and are visible to others only through an explicit share. Portability is real: a full HTML or Markdown export is available at any time, the FAQ states there is no lock-in, a public read API returns the same material, and account plus data deletion runs from the app's danger-zone settings.

Reuse rights

Because users keep ownership of what they import, they can reuse, export and republish their own highlights without asking Screvi for permission: HTML and Markdown exports are available at any time, and a public read-only REST API returns the same highlights and sources. On Screvi's side, the privacy policy lists the purposes it processes data for: providing and maintaining the service, handling purchases and subscriptions, personalization, on-demand AI features, security and fraud prevention, communications and legal compliance. Automatically collected technical data (IP address, browser, operating system, language preferences, referrers, device name, country or region, approximate location and pages viewed) is used for security, operations, and internal analytics. AI features are optional and user-triggered, and only the minimum necessary content is sent to the Google Gemini API; Screvi states that no AI model is trained on uploaded content and that Google does not use those prompts and responses to improve its own products. Named recipients are Supabase (hosting and database), Stripe (web payments), Apple (in-app billing) and Google Gemini (AI), plus legal authorities and any business transfer. Sensitive categories of data are not intentionally processed. Signing in through Google or Apple passes a name and an email address to Screvi.

Data retention & training

Hosting summary

Screvi stores application data with Supabase, in managed Postgres databases located in the United States. The privacy policy says so twice, once under Storage and international transfers and again in the security section, which links out to Supabase Security for detail. No region choice is offered to the user. Web payments are processed by Stripe, in-app subscriptions are billed by Apple, and AI features send the minimum necessary content to the Google Gemini API. The gap worth noting is jurisdictional: the publisher declares itself a company based in Portugal, so an EU-to-US transfer is taking place, yet the policy names no standard contractual clauses, no adequacy decision and no transfer impact assessment. There is also no dedicated sub-processor page, no versioned list and no change-notification mechanism, as the four recipients are simply named in the text. No SOC 2 or ISO 27001 certification is published, and no data processing agreement is offered.