Privacy Policy

Last updated: 5 November 2026

Mai Pantry ("we", "us", "our") is run by a sole trader based in Perth, Western Australia (ABN 32 511 959 702), and operates the Mai Pantry mobile application (the "App") and the maipantry.com.au website (the "Website"). This Privacy Policy explains what information we collect, why we collect it, how we use and hold it, and the choices you have.

1. Information We Collect

1.1 Information You Provide

• Profile information: A display name (optional) and your home address or suburb. These are stored on your device and used to find nearby grocery stores, show prices for your region and plan your shopping trips. They are not sent to our servers, except a display name you choose to use on a Shared Shopping List (see below). When you open a product's price history, the App sends only your broad price region (Western Australia or the eastern states), worked out from your home location. Looking up an address uses your phone's location service, as explained under "Maps and address search" in Section 5.
• My IGA store: If you pick your IGA store in Settings, that store's identifier is sent to our servers so we can collect that store's prices for the App. It is not stored with your device identifier. Like every request, it appears in our web server access logs, with your IP address, for about 14 days.
• Price reports: When you report a product as sold out, we collect the product and the store it relates to, plus any note you add. Earlier versions of the App could also send price corrections and missing-product reports; we hold any we received in the same way. A wrong price you flag from a product page reaches us as feedback (below). To weigh reports fairly, we also keep a reliability score against the hashed reporter identifier (a count of how many of its reports were accepted or rejected).
• Feedback: When you use Submit feedback, or flag a problem from a product page, we collect the message you write, the category you choose (for example, bug, pricing issue, or wrong image), the product it relates to (if any), the app version, and your email address if you choose to add one so we can reply.
• Product star ratings: If you rate a product, we store the product's identifier, your star rating (1–5), the time you rated it (and last changed it), and a hashed device identifier so you can change or delete your rating. Other users only see a product's average rating and the number of ratings — never who gave them.
• Shared shopping lists: If you create or join a Shared Shopping List, the list's name, its items (including who added or ticked each item, and when), a display name you choose, and a random device identifier are stored on our servers so the list can sync between the people you share it with. The display name you enter is visible to the other members of that list (so choose one you are comfortable sharing with your group); your device identifier is not shown to other members, and we do not collect your email address for shared lists. On the free plan, we also record which month you used your free shared list, against your device identifier, so the monthly limit works.
• Reporter identifiers: When your device sends a device identifier or user identifier with a report, feedback, or star rating, we hash it using a one-way SHA-256 algorithm before storage. The original identifier is never stored with them. (Shared Shopping Lists use the device identifier itself, as described above, so the list can recognise your device.)
• Emails and Android testing: If you email us, we receive your email address and message and use them to reply. If you email us to join testing of the Android version of the App, we use the Google account email address you send only to add you to the test and to contact you about it.

1.2 Information Collected Automatically

• Location data: With your permission ("When In Use"), we access your device's GPS location to set your home location and to show nearby stores and distances. Location data is processed on your device and is not sent to our servers (see Section 5 for maps and directions).
• Server access logs: Whenever the App or the Website connects to our servers, our web server keeps standard access logs: your IP address, the date and time, the request made (such as the page or API address), the response status, the referring page, and your browser's or the App's user-agent string. We use these logs for security, preventing abuse, and troubleshooting. Web server access logs are deleted automatically after about 14 days. Until 2 October 2026 our application's own logs also recorded IP addresses; we deleted those older logs on 2 October 2026.
• Operational monitoring: Our application also records each request's method, address path, response status, and response time so we can monitor performance and fix faults. These application logs do not include IP addresses and are deleted automatically after one month.
• Rate limiting: To prevent abuse, our servers count requests per IP address. These counters are held in memory only, are not written to disk, and are cleared regularly and whenever the server restarts.

1.3 Information We Do Not Collect

• We do not use any third-party analytics, advertising, or tracking SDKs in the App, or analytics or advertising tools on the Website.
• We do not collect your Apple ID, contacts, photos, health data, or browsing history.
• We do not use the Identifier for Advertisers (IDFA) or App Tracking Transparency framework.
• We do not sell or rent your personal information.
• We do not collect or store any payment information. Mai Pantry Pro is bought through the App Store (Apple) or Google Play (Google), which process the payment; we never see your payment details.

2. Why We Collect and Use Your Information

We collect only the information we need for the purposes below, and we use and disclose it only for the purpose we collected it for (or a directly related purpose you would reasonably expect), or where the law requires or allows it.

3. Data Storage and Security

• On-device storage: Your profile, personal shopping lists, pantry, purchase history, meal plans, price-tracked products, and cached product data are stored locally on your device in an on-device database. This data stays on your device unless you submit a report or feedback, rate a product, or create or join a Shared Shopping List.
• Server storage: Reports, feedback, product star ratings, and Shared Shopping Lists are stored on our servers in Australia, which run on a cloud hosting provider's infrastructure. Device or user identifiers attached to reports, feedback, and ratings are hashed before storage using SHA-256, making them irreversible; Shared Shopping Lists use a random device identifier, stored with the display name you choose for that list.
• Security measures: Our servers use HTTPS encryption, rate limiting, input validation, and security headers to protect your data.

4. Data Retention

• On-device data: Remains on your device until you delete the App or clear its data.
• Reports: Retained on our servers until you request deletion (see Section 6). Reports may be trimmed on a first-in-first-out basis when storage limits are reached.
• Feedback: Deleted automatically after 90 days, or sooner if you request deletion.
• Product star ratings: Retained until you request deletion (see Section 6).
• Reliability scores: Deleted automatically once no report from that reporter identifier has been accepted or rejected for 24 months. Until then a score is kept even after you delete your data, so deleting can't be used to wipe a record of rejected reports. A score holds only the hashed reporter identifier and counts of accepted and rejected reports, never report content.
• Shared Shopping Lists: Kept while the list is in use. A list its owner deletes is removed straight away. A list that is converted back to a normal list, or that reaches the end of its free-plan lifetime, is removed once members' apps have taken their copy, normally within 7 days. A list that nobody has changed for 12 months is converted back to a normal list for its members and removed in the same way. The free-plan monthly record is kept for up to two months.
• Web server access logs: Deleted automatically after about 14 days. Our application's own logs no longer record IP addresses, and the older ones that did were deleted on 2 October 2026.
• Rate-limiting counters: Held in server memory only; cleared regularly and discarded on server restart.
• Backups: We keep encrypted backups of our servers so we can recover from a fault, each for no more than three months. Since 5 November 2026 they leave out reports, feedback, product star ratings, reliability scores and Shared Shopping Lists. Older backups that include them are deleted on that schedule, and all of them will be gone by the end of December 2026.
• Emails: Kept for as long as we need them to deal with your message or the Android test, and deleted on request.

5. Data Sharing

We do not sell or rent your personal information, and we do not share it with third parties for their own purposes. Our cloud hosting provider stores data on our behalf on servers in Australia. The contents of a Shared Shopping List, including your display name, are visible to the other people you choose to share it with via its share code. Mai Pantry Pro purchases are handled by Apple (App Store) or Google (Google Play).

Maps and address search. When you search for an address or view a map, your phone talks directly to a map provider, not to us. On iPhone, maps come from Apple Maps and address search uses Apple's location service, so Apple receives the address you type or the area shown. On Android, maps are loaded from OpenStreetMap and address search uses your phone's built-in location service (usually provided by Google), which receive the address or map area and your IP address. Their own privacy policies apply. If you join the Android test, we add the Google account email address you gave us to the test's tester list with Google. We may disclose information where the law requires it. Product catalogue data displayed in the App is based on publicly available information.

Photos, recipes and directions. Product and recipe photos load directly from the websites that publish them, so those sites receive your IP address, as with any website. If you import a recipe from the web, your phone fetches that recipe page directly. If you ask for directions to a shop, the App opens Google Maps with your trip's starting point (your home or current location) and the shops on the route, and Google's privacy policy applies.

Email. Our email (hello@maipantry.com.au) is handled by Google (Gmail), and our replies are sent through an email delivery provider (Resend, which runs on Amazon Web Services). Emails you send us, and our replies, may be stored or processed outside Australia, including in the United States.

App store reports. If you've chosen to share analytics with app developers in your device settings, Apple or Google may give us crash reports and summary usage statistics for the App. These don't identify you.

6. Your Rights

You have the right to:

• Access the information we hold about you, and ask us to correct it.
• Delete your submitted reports, feedback, and product star ratings by using the data deletion feature in the App, via our data deletion page, or by contacting us.
• Withdraw consent for location access at any time through your device's Settings.
• Complain to us if you think we have mishandled your information. Email us and we'll reply within 30 days. If you're not happy with our reply, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, which can tell you whether it is able to help.

Requesting Data Deletion

To delete all reports, feedback, and product star ratings associated with your device, use the "Delete my data" option in the App's Settings under Privacy, follow the steps on our data deletion page, or contact us at the address below. Because reporter identifiers are stored as one-way hashes, the in-app option is the most reliable. If you contact us instead, tell us what you can (roughly when you sent things, which products, or the email address you added to feedback) and we'll do our best to find and delete them. Shared Shopping Lists are deleted from the list itself — see our data deletion page.

7. Children's Privacy

The App is not directed at children under 13, and our Terms of Service ask that you be at least 13 to use it. The App's age rating in the app stores describes its content, not who it is for. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

8. International Users

Our servers are located in Australia. If you access the App or the Website from outside Australia, the information you send us will be transferred to and processed in Australia. Email is the exception: as described in Section 5, emails may be stored or processed overseas, including in the United States.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page shows when it was last revised. If we make a change that matters to how your information is handled, we'll also say so on our website and, where we can, in the App before the change takes effect.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at:

Email: hello@maipantry.com.au

This privacy policy applies to version 1.0 and later of the Mai Pantry app and to the maipantry.com.au website.