Privacy

Effective [FOUNDER: effective date].

AllWise is the sign-in for GroceryWise (grocerywise.com.au), and will also be the sign-in for PetoWise (petowise.com.au) when PetoWise accounts launch. This policy covers your AllWise account: what we store, who processes it for us, and how to delete it. AllWise is run by [FOUNDER: legal entity name], ABN [FOUNDER: ABN].

What we store

• Your email address, and whether it's verified. We only create an account for a verified address: either you opened the link we emailed you, or Google confirmed it.
• Your name: the one Google gives us if you sign up with Google, or the one you set on your GroceryWise account page. It appears in the household invites you send.
• The web address of your Google profile picture, if you signed up with Google.
• Your sessions: one for each browser you're signed in on, with its IP address, browser user agent and expiry. A session lasts 7 days, and using the site extends it.
• If you sign in with Google, a record linking your Google account, with the tokens Google issues at sign-in. We ask Google only for your name, email address and profile picture (the openid, email and profile scopes), and we don't use these tokens to read anything else from your Google account.
• Households: each household's name, its members and their roles, and its invitations. An invitation holds the invited person's email address, who sent it, and when it expires (48 hours). Members of a household see each other's name and email address.
• Sign-in links: while a link we emailed you is waiting to be used, a record of it that holds your email address. The link works once and for 15 minutes, and the record is deleted when the link is used.
• Google sign-in in progress: a record of the attempt, so Google's reply can be matched to it. It expires after 10 minutes.
• Google sign-in hand-off: a one-use token that passes your sign-in from AllWise to the site. It expires after 3 minutes and is deleted when used.
• Rate-limit counters, which stop our sign-in and invite emails being abused: up to 3 sign-in emails per address every 10 minutes, and 10 invite requests per account an hour. The sign-in counter is keyed by a one-way hash of your email address, never the address itself, and the invite counter by your account id. Each one expires at the end of its window.

AllWise has no passwords, and stores none.

What GroceryWise handles

Each session records the IP address and browser user agent of the device you signed in on. With a sign-in link, GroceryWise passes them to us. With Google sign-in, your browser comes to accounts.allwise.com.au directly, and we take them from that request.

AllWise gives GroceryWise a signed token, valid for 15 minutes, holding your account id, your email address and whether it's verified. GroceryWise uses it to keep its own data for you, such as your price alerts.

GroceryWise's server and its sign-in proxy also pass your account details between your browser and AllWise: your name, email address and profile picture, your household's members, and each of your sessions with its IP address and browser. The account pages show your name, email address, household and the devices you're signed in on.

Who processes it

• Vercel runs AllWise. Its server code runs in Vercel's Sydney region.
• Neon hosts the database that holds your account.
• Resend delivers our emails. It receives the recipient's address and the email itself: a sign-in link, or an invite naming the inviter and the household.
• Upstash holds the rate-limit counters described above.
• Google, if you choose to sign in with Google.

[FOUNDER: which of these providers store or process data outside Australia, and in which countries]

Emails

Sign-in links and household invites come from an address at accounts.grocerywise.com.au. AllWise sends no other email.

Cookies

AllWise uses no analytics or advertising cookies. On https, the better-auth cookies below carry a __Secure- prefix.

On GroceryWise, when you sign in:

• better-auth.session_token: your session. It lasts as long as the session, up to 7 days after you last used it.
• better-auth.session_data: a short-lived copy of your session so pages load faster. It lasts 5 minutes and is renewed as you browse.
• gw_signed_in: holds only the value 1, so pages know to show your account. It lasts as long as your session and is cleared when you sign out.
• gw_google_…: set only while a Google sign-in is in progress. It holds a random value and the page to return to, and expires after 10 minutes.

On accounts.allwise.com.au, only if you sign in with Google:

• better-auth.state: ties Google's reply to your browser. It expires after 5 minutes.
• better-auth.session_token: set when Google sends you back, so AllWise can hand your sign-in to the site. It lasts as long as the session, up to 7 days.
• better-auth.session_data: set at the same time. It lasts 5 minutes.

Signing out on GroceryWise ends the session, but doesn't remove the cookies on accounts.allwise.com.au. Those expire on their own, within 7 days.

When PetoWise accounts launch, PetoWise will set the same cookies, named pw_ instead of gw_.

Deleting your account

Sign in to GroceryWise and go to localhost:3093/account/delete. That sends us a deletion request, which our team reviews and processes within [FOUNDER: deletion turnaround time].

Until it's processed, the request holds your account id, your email address, the site you asked from, and your household choice, including the account id of the member you chose to hand it to.

When we process the request, we remove:

• your AllWise account: your sessions, your Google link and its tokens, your household memberships, the invitations you sent, and invitations addressed to your email;
• your households, as you chose when you asked: one you're the only member of is deleted; one you own with other members is handed to the member you picked or deleted, whichever you chose; otherwise you're removed and the household stays;
• your data on GroceryWise: your profile and your price-alert subscriptions, with their alerts and the record of alerts sent, including subscriptions on the email address you had verified.

We keep a record that the request was completed, with your account id, the site and your household choice but not your email address, so an old sign-in can't recreate your data. Any unused sign-in link stops working within 15 minutes.

Access, correction and complaints

To get a copy of what we hold about you, correct it, or make a privacy complaint, email [FOUNDER: privacy contact email]. If you're not satisfied with our answer, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

If this policy changes, we'll update this page and its effective date.