Privacy Policy

Last updated: 3 October 2026

Mai Pantry ("we", "us", "our") operates the Mai Pantry mobile application (the "App") and the maipantry.com.au website (the "Website"). This Privacy Policy explains what information we collect, why we collect it, how we use and hold it, and the choices you have.

1. Information We Collect

1.1 Information You Provide

• Profile information: A display name (optional) and your home address or suburb. These are stored on your device and used to find nearby grocery stores, show prices for your region and plan your shopping trips. They are not sent to our servers, except a display name you choose to use on a Shared Shopping List (see below). Looking up an address uses your phone's location service, as explained under "Maps and address search" in Section 5.
• My IGA store: If you pick your IGA store in Settings, that store's identifier is sent to our servers so we can collect that store's prices for the App. It is not stored with your device identifier or anything else about you.
• Price reports: When you submit a price correction, sold-out report, or missing product report, we collect the product details, price, and store information you provide, plus any note you add. To weigh reports fairly, we also keep a reliability score against the hashed reporter identifier (a count of how many of its reports were accepted or rejected).
• Feedback: When you use Submit feedback, or flag a problem from a product page, we collect the message you write, the category you choose (for example, bug, pricing issue, or wrong image), the product it relates to (if any), and the app version.
• Product star ratings: If you rate a product, we store the product's identifier, your star rating (1–5), the time you rated it (and last changed it), and a hashed device identifier so you can change or delete your rating. Other users only see a product's average rating and the number of ratings — never who gave them.
• Shared shopping lists: If you create or join a Shared Shopping List, the list's name, its items (including who added or ticked each item, and when), a display name you choose, and an anonymous device identifier are stored on our servers so the list can sync between the people you share it with. The display name you enter is visible to the other members of that list (so choose one you are comfortable sharing with your group); your device identifier is not shown to other members, and we do not collect your email address for shared lists. On the free plan, we also record which month you used your free shared list, against your device identifier, so the monthly limit works.
• Reporter identifiers: When your device sends a device identifier or user identifier with a report, feedback, or star rating, we hash it using a one-way SHA-256 algorithm before storage. The original identifier is never stored with them. (Shared Shopping Lists use the device identifier itself, as described above, so the list can recognise your device.)
• Emails and Android testing: If you email us, we receive your email address and message and use them to reply. If you email us to join testing of the Android version of the App, we use the Google account email address you send only to add you to the test and to contact you about it.

1.2 Information Collected Automatically

• Location data: With your permission ("When In Use"), we access your device's GPS location to show nearby stores and calculate distances. Location data is processed on-device and is not sent to our servers.
• Server access logs: Whenever the App or the Website connects to our servers, our web server keeps standard access logs: your IP address, the date and time, the request made (such as the page or API address), the response status, the referring page, and your browser's or the App's user-agent string. We use these logs for security, preventing abuse, and troubleshooting. Web server access logs are deleted automatically after about 14 days. Until 2 October 2026 our application's own logs also recorded IP addresses; we deleted those older logs on 2 October 2026.
• Operational monitoring: Our application also records each request's method, address path, response status, and response time so we can monitor performance and fix faults.
• Rate limiting: To prevent abuse, our servers count requests per IP address. These counters are held in memory only, are not written to disk, and are cleared regularly and whenever the server restarts.

1.3 Information We Do Not Collect

• We do not use any third-party analytics, advertising, or tracking SDKs in the App, or analytics or advertising tools on the Website.
• We do not collect your Apple ID, contacts, photos, health data, or browsing history.
• We do not use the Identifier for Advertisers (IDFA) or App Tracking Transparency framework.
• We do not sell or rent your personal information.
• We do not collect or store any payment information. Mai Pantry Pro subscriptions are processed entirely by Apple through your Apple ID; we never see your payment details.

2. Why We Collect and Use Your Information

We collect only the information we need for the purposes below, and we use and disclose it only for the purpose we collected it for (or a directly related purpose you would reasonably expect), or where the law requires or allows it.

3. Data Storage and Security

• On-device storage: Your profile, personal shopping lists, pantry, purchase history, meal plans, price-tracked products, and cached product data are stored locally on your device in an on-device database. This data stays on your device unless you submit a report or feedback, rate a product, or create or join a Shared Shopping List.
• Server storage: Reports, feedback, product star ratings, and Shared Shopping Lists are stored on our servers in Australia, which run on a cloud hosting provider's infrastructure. Device or user identifiers attached to reports, feedback, and ratings are hashed before storage using SHA-256, making them irreversible; Shared Shopping Lists use an anonymous device identifier and are not linked to your name or email.
• Security measures: Our servers use HTTPS encryption, rate limiting, input validation, and security headers to protect your data.

4. Data Retention

• On-device data: Remains on your device until you delete the App or clear its data.
• Reports: Retained on our servers until you request deletion (see Section 6). Reports may be trimmed on a first-in-first-out basis when storage limits are reached.
• Feedback: Deleted automatically after 90 days, or sooner if you request deletion.
• Product star ratings: Retained until you request deletion (see Section 6).
• Reliability scores: Kept after you delete your data, so deleting can't be used to wipe a record of rejected reports. A score holds only the hashed reporter identifier and counts of accepted and rejected reports, never report content.
• Shared Shopping Lists: Kept while the list is in use. A list its owner deletes is removed straight away. A list that is converted back to a normal list, or that reaches the end of its free-plan lifetime, is removed once members' apps have taken their copy, normally within 7 days. The free-plan monthly record is kept for up to two months.
• Web server access logs: Deleted automatically after about 14 days. Our application's own logs no longer record IP addresses, and the older ones that did were deleted on 2 October 2026.
• Rate-limiting counters: Held in server memory only; cleared regularly and discarded on server restart.
• Emails: Kept for as long as we need them to deal with your message or the Android test, and deleted on request.

5. Data Sharing

We do not sell or rent your personal information, and we do not share it with third parties for their own purposes. Our cloud hosting provider stores data on our behalf on servers in Australia. The contents of a Shared Shopping List, including your display name, are visible to the other people you choose to share it with via its share code. Mai Pantry Pro purchases are handled by Apple.

Maps and address search. When you search for an address or view a map, your phone talks directly to a map provider, not to us. On iPhone, maps come from Apple Maps and address search uses Apple's location service, so Apple receives the address you type or the area shown. On Android, maps are loaded from OpenStreetMap and address search uses your phone's built-in location service (usually provided by Google), which receive the address or map area and your IP address. Their own privacy policies apply. If you join the Android test, we add the Google account email address you gave us to the test's tester list with Google. We may disclose information where the law requires it. Product catalogue data displayed in the App is sourced from publicly available grocery retailer websites.

6. Your Rights

You have the right to:

• Access the information we hold about you, and ask us to correct it.
• Delete your submitted reports, feedback, and product star ratings by using the data deletion feature in the App, via our data deletion page, or by contacting us.
• Withdraw consent for location access at any time through your device's Settings.
• Complain to us if you think we have mishandled your information, and, if you are not satisfied with our response, lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Requesting Data Deletion

To delete all reports, feedback, and product star ratings associated with your device, use the "Delete my data" option in the App's Settings under Privacy, follow the steps on our data deletion page, or contact us at the address below. Because reporter identifiers are stored as one-way hashes, we can only match and delete these items if you provide the same device identifier that was used when submitting them. Shared Shopping Lists are deleted from the list itself — see our data deletion page.

7. Children's Privacy

The App is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

8. International Users

Our servers are located in Australia. If you access the App or the Website from outside Australia, the information you send us will be transferred to and processed in Australia.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when it was last revised. We encourage you to review this policy periodically.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at:

Email: hello@maipantry.com.au

This privacy policy applies to version 1.0 and later of the Mai Pantry app and to the maipantry.com.au website.