Privacy Policy

Who we are

ShopHop (shophop.au) is an Australian supermarket price-tracking service operated by a sole trader based in Brisbane, Queensland. This policy explains how we handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

For privacy requests, email [email protected]. General enquiries: [email protected].

What we collect

We collect only what we need to run the service:

• Account & alerts: email address and authentication data (managed by our auth provider), and — if you provide them — a display name and postcode, plus your saved lists, price alerts, and any browser push subscription you set up for notifications.
• Support: name, email, message content, and any screenshot or diagnostic information you choose to include when you report an issue or contact us.
• Browser extension: if you install the ShopHop extension and connect your account, it links your account to that device and shows comparisons on Woolworths, Coles and Aldi product pages. It talks only to ShopHop and those retailer sites; see the extension's store listing for its specific permissions.
• Product data: publicly visible supermarket listings (prices, names, sizes, images). This is not personal information about you.
• Technical logs: request metadata (user agent, path and IP address) used for security, rate limiting and reliability. Analytics events use a salted hash of your IP rather than the raw value; our security and abuse logs may retain the raw IP address for a limited period to detect and block attacks. We do not use these logs to build marketing profiles of individuals.

We do not ask for payment card details on ShopHop for ordinary consumer use. If paid Intelligence or similar products are offered later, billing is handled by a payment processor under their terms.

Cookies, analytics and advertising

We use a mix of first-party and third-party tools:

• Product analytics (PostHog): measures page views and feature usage using a first-party anonymous identifier and a salted hash of your IP. PostHog may process this data on servers outside Australia (currently the United States).
• Google Analytics 4 (GA4) when enabled: uses cookies or similar identifiers to measure traffic and usage. Google may process this data under its own policies.
• Google AdSense on selected commercial pages (not on integrity, methodology, account, alerts, lists, or admin surfaces): AdSense may set cookies and use identifiers for ad serving and, where Google enables it, ad personalisation based on browsing activity. You can manage ad personalisation via Google's Ads Settings (adssettings.google.com) and browser controls.
• Campaign / referral links: if you visit ShopHop through a first-party campaign URL (for example shophop.au/r/reddit-beta), we store a first-touch campaign identifier in an HttpOnly cookie for 30 days, plus a random attribution ID. We record aggregate events (link click, landing, signup, first list, first alert, extension connected) in UTC and display totals in Australia/Brisbane time on an admin dashboard. We do not store your full IP for marketing analytics, do not fingerprint devices for ads, and the admin view does not show names, emails or user IDs. A server-side HMAC of an account id may be used only to deduplicate milestones and is never shown.
• Session / preference cookies for sign-in, theme, and similar site functions.
• Affiliate / retailer cookies may be set if you click through to Woolworths, Coles or Aldi so a commission can be attributed if you purchase. That happens on the retailer's site under their policies.

We do not sell your account email or alert lists. Integrity and methodology pages are kept free of AdSense and retailer corporate ads.

Who processes data for us

• Supabase — authentication and related account infrastructure (processor).
• Resend — transactional and alert email delivery (processor).
• Hosting / CDN — our self-hosted origin and Cloudflare (including tunnel and edge caching) for delivery and abuse protection.
• Google — Analytics and AdSense when those features are enabled on a page.
• PostHog — product analytics (processor; may store data outside Australia, currently the United States).
• Web push services (Google, Mozilla and Apple) — deliver browser push notifications if you enable price alerts; the message payload is end-to-end encrypted to your device.

Some processors may store or access data outside Australia. We use them because they are reasonably necessary to operate an online service, and we take reasonable steps consistent with the APPs when disclosing personal information overseas.

Why we collect it (APP 3 & 6)

We use personal information to:

• create and secure your account;
• send price alerts and service emails you requested;
• respond to support tickets and abuse reports;
• understand aggregate site usage and keep the service reliable;
• show advertising on permitted pages (AdSense) to help fund the free consumer site.

We do not use your alert list or account email to sell third-party marketing lists.

Retention

Account and alert data is kept while your account is active. You can request deletion of your account by contacting us; we then remove or de-identify associated personal data within a reasonable period, except where we must retain records for security, dispute, or legal reasons.

Support tickets and security logs are retained only as long as needed for those purposes. Aggregated analytics are kept in non-identifying form. Supermarket price history is a public data archive and is not personal information about ShopHop users.

Your rights

Under the Privacy Act you may request access to, or correction of, personal information we hold about you. You may also:

• request deletion of your account by contacting us;
• unsubscribe from alert or newsletter emails via the link in the email or by contacting us;
• control cookies and ad personalisation in your browser and Google Ads Settings.

To make an access or correction request, email [email protected]. We will respond within a reasonable time. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Security

We use HTTPS, access controls, and least-privilege database roles where practical. No method of transmission or storage is perfectly secure; please use a unique password for your account.

Children

ShopHop is a general grocery information service. We do not knowingly collect personal information from children for marketing purposes.

Changes

We may update this policy as the product or law changes. The “Last updated” date at the top will change when we do. Continued use after an update means you accept the revised policy.

Related

See also our Terms of Service (including the data-accuracy disclaimer) and About ShopHop.