Shopmate ("Shopmate", "we", "us") helps you scan grocery receipts, track what you paid, and compare prices. This policy explains what we collect, how we use it, who we share it with, and the choices you have. Shopmate is operated from Australia; you can reach us any time at tom@shopmategrocery.com. Our Terms of Service set out the licence you grant us over the data you contribute.
Because Shopmate shares data derived from the personal information you give us, we treat ourselves as bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles regardless of our turnover, and we do not rely on the small business exemption in section 6D of that Act.
Account and identity
Receipts and purchases
How you use the app
Location
Technical
Anything we share under the section above is aggregated or de-identified before it leaves us. We de-identify to the standard the OAIC applies: the risk of anyone being re-identified must be very low in the context the data is released into, judged against what the recipient could realistically combine it with. We assess that risk before each release, and we restrict recipients from attempting re-identification. We cannot promise the risk is zero — no de-identification can. Where data genuinely meets that standard it is no longer personal information under the Privacy Act, and we may keep and use it indefinitely.
We rely on a small number of trusted service providers to run Shopmate:
Separately, we may share the aggregated and de-identified insights described above with retailers, brands, market-research firms, publishers, researchers, and other partners. If Shopmate is ever sold or merged, data may transfer to the acquirer under this policy.
Shopmate is operated from Australia, but the providers listed above store and process data outside Australia — primarily in the United States, and potentially in other countries where those providers operate infrastructure. This includes your receipt images and account data (Supabase), receipt images sent for extraction and store lookups (Google), crash diagnostics (Sentry), and website hosting and analytics (Vercel).
Our normal practice is to take the reasonable steps Australian Privacy Principle 8.1 requires — dealing only with providers contractually bound to handle your information consistently with the Australian Privacy Principles.
Before you agree, you should understand what an overseas disclosure means. If you consent to us disclosing your personal information overseas, Australian Privacy Principle 8.1 will not apply to that disclosure. That means we will not be accountable under the Privacy Act for what the overseas recipient does with your information, the recipient may not be subject to privacy obligations similar to the Australian Privacy Principles, you may not be able to seek redress under the Privacy Act or in the recipient's country, and foreign laws may compel the recipient to disclose your information. You can avoid overseas disclosure of your receipts by not using Shopmate.
Shopmate uses automated systems on your personal information. Google's Gemini AI reads your receipt images and extracts the store, date, and every line item; automated matching then links each item to a product in our catalog, infers its category, and calculates per-unit prices; and automated checks flag receipts as submitted, verified, or rejected. These decisions affect what appears in your history and whether your prices reach the shared catalog. They are not used to make decisions about your credit, employment, insurance, or access to any service outside Shopmate.
Automated extraction makes mistakes. You can review and correct any line item in the app, and you can delete a receipt outright.
If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth).
You can delete your account and personal data at any time inside the app: Account → Delete account. You can also email tom@shopmategrocery.com to request deletion.
When you delete your account we permanently remove your login, your receipt photos, your receipt records and purchase history, your grocery lists, and your profile and preferences.
What remains: two sets of records are kept in de-identified form — detached from your account and identity, carrying no personal identifiers:
Device location access is optional and read only while the app is open. Your chosen shopping location is saved to your profile so the app keeps showing prices near you. You can decline or revoke location permission in your device settings and pick a location manually instead, without losing core functionality.
Data is encrypted in transit. Receipt images are stored in a private bucket accessible only to you (and our server processes acting on your behalf). Access to your data is governed by per-user security rules.
Shopmate is intended for a general audience and is not directed at children. You must be at least 16 to use it.
Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you may request access to the personal information we hold about you, ask us to correct it, and complain about how we have handled it. Email tom@shopmategrocery.com and we will respond within 30 days. Most of your data is also visible and editable directly in the app.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or call 1300 363 992.
If we make material changes we will update the effective date above and, where appropriate, notify you in the app.
Questions? Email tom@shopmategrocery.com.