ShelfScout Privacy Policy
Last updated 31 July 2026. Applies to the ShelfScout website and mobile app.
About this policy
ShelfScout compares supermarket prices in New Zealand. This policy explains what personal information ShelfScout collects, why we collect it, who may receive it, how long we keep it, and the choices you have. ShelfScout is the agency responsible for that information under the New Zealand Privacy Act 2020.
Information we collect
You can browse and search supermarket prices without creating an account. If you create an account, providing an email address and password is voluntary, but we cannot create or sync an account without them.
When you create and use an account, we collect:
- Your email address and authentication details. Supabase handles authentication. Passwords are stored as cryptographic hashes; ShelfScout does not receive your plain-text password.
- Your shopping lists, including the products and quantities you add.
- Your selected stores, so we can show prices for the supermarkets you use.
- Your price watches, including their rules and thresholds, and alert history needed to show alerts and avoid duplicates.
We do not ask for your name, phone number, street address, payment details, supermarket loyalty details, receipts, or purchase history.
Location, camera, and device storage
Location. ShelfScout uses location to find nearby stores and calculate relevant price results. The mobile app asks for device location permission. The website first asks the browser for location; if that is unavailable or refused, it may use GeoJS to estimate an approximate location from your IP address. GeoJS receives your IP address as part of that request.
The website keeps the resulting coordinates in your browser for up to 24 hours and sends them to ShelfScout when requesting nearby stores or prices. The mobile app sends coordinates when making the same requests. We use the coordinates to answer the request and do not add them to your ShelfScout account. You can deny device location permission and search for stores by name.
Camera. The website and mobile app can use your camera to scan product barcodes. Barcode detection happens on your device. Only the barcode number is sent to ShelfScout to find the product; camera photos and video are not uploaded or stored by ShelfScout.
Storage on your device. We use cookies, browser storage, or mobile app storage for essential sessions and preferences such as your theme, selected stores, cached lists, and recent location. The website's signed-in session is held in an encrypted, HTTP-only cookie. The mobile app stores its session credential in app storage. Signing out or requesting account deletion clears account data cached by the mobile app; browser preferences may remain until you clear them.
Technical information, analytics, and diagnostics
Like most online services, our servers receive technical information such as your IP address, request time, requested page, browser or device details, and error information. We use this to deliver and secure ShelfScout, diagnose faults, and prevent abuse.
The website uses Umami Cloud for cookieless usage analytics, such as page visits, referrers, general device information, and approximate location derived from network information. It also uses Sentry for error and performance diagnostics. When an error occurs, Sentry may receive technical context and a replay of interactions around the error; sensitive text and media are masked or blocked by Sentry's replay controls. We do not use these services for advertising or to track you across unrelated websites or apps.
How we use information
We use personal information to authenticate you, operate and secure ShelfScout, sync your lists and stores across devices, evaluate and show the price alerts you request, find nearby stores, understand whether the service is working, respond to support requests, and meet legal obligations. We do not sell personal information, use it for targeted advertising, or make decisions about you solely by automated means.
Service providers and overseas processing
We disclose information only where needed to operate ShelfScout or where the law requires it. Providers involved in the service include:
- Supabase for authentication and database hosting.
- Umami Cloud for website usage analytics.
- Sentry for error, performance, and session-replay diagnostics.
- GeoJS for approximate IP-based location when browser location is unavailable.
- Google Maps Platform for resolving supermarket addresses and displaying store maps. We send store information, not your ShelfScout account details, for this purpose.
Some providers may process information outside New Zealand. Where the Privacy Act requires it, we take steps to ensure overseas providers protect personal information in a way that provides comparable safeguards. The supermarkets whose prices we compare are not ShelfScout partners and do not receive your personal information from us.
How long we keep information
- Account data is kept while your account exists and during the 30-day deletion grace period described below.
- Website location is cached on your device for up to 24 hours.
- Security logs, analytics, and diagnostic records are kept only for the operational period configured in our systems or the relevant provider.
- Information may remain in protected backups until those backups are overwritten through their normal rotation.
Supermarket product and price data is not tied to your account and may be kept indefinitely as part of ShelfScout's price history.
Access, correction, and deletion
You can ask for access to the personal information we hold about you, ask us to correct it, or raise a privacy concern by emailing the address below. We may need to verify your identity before completing a request.
You can request account deletion at any time:
- In the app: Account → Delete account.
- On the web:www.shelfscout.nz/delete-account.
A deletion request signs you out and starts a 30-day grace period. Signing in during that period cancels the request. After 30 days we permanently delete your shopping lists, selected stores, price watches and alert history, and Supabase sign-in identity. Protected backups age out through their normal rotation.
Children
ShelfScout is not directed at children under 13 and we do not knowingly collect account information from them. If you believe a child has created an account, contact us so we can investigate and delete it.
Security
We use safeguards designed to protect personal information, including encryption in transit and access controls. No internet service or storage system is completely secure, so we cannot guarantee absolute security.
Changes to this policy
We may update this policy as ShelfScout or its legal obligations change. We will post the revised policy here and update the date above. If a change materially affects how we use personal information, we will take reasonable steps to make it clear before the change takes effect.
Contact us
For a privacy request or question, contact the ShelfScout privacy officer at hello@shelfscout.nz. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner.