Privacy Policy

Last updated 23 September 2026

This says what G'day Spud collects, which other companies see it, how long it is kept, and what you can make us do about it. Where something is not built yet, it says that too. It covers the app and this website.

The short version

• We collect your email and name, what your household eats and avoids, your plans, your shopping, and the contents of receipts you scan.
• Allergy and dietary information is sensitive health information. We only take it if you type it in, and it never goes to advertising or analytics.
• Photos of receipts and recipes are sent to Google to be read. Cook-mode voice sends your microphone audio to Google. Recipe text and your household's dietary and allergy rules are sent to Anthropic. Details in Artificial intelligence.
• The app records what you do, and can record your screen, through an analytics company called PostHog. See How you use the app.
• Your database sits in Sydney. Most of the companies above are in the United States.
• We sell nothing. We run no advertising. There is no ad tracking in the app.
• You can delete your account in the app. Today that closes it and blocks access immediately, but does not yet erase the record. Read How long we keep things — it is the part of this page we are least happy with.

Who is responsible

G'day Spud is made and run by Angus Dowling, an individual in Victoria, Australia. There is no company. When there is one, this page will name it.

Under the Privacy Act 1988, a business turning over A$3 million or less a year is generally exempt from the Australian Privacy Principles. G'day Spud is well under that, so the Act probably does not bind us today. We apply the Australian Privacy Principles anyway, and this page is written as though they do. If turnover crosses the threshold, or the exemption is repealed, nothing here has to change.

Privacy contact: privacy@gdayspud.com.au.

What we collect

Your account

Your email address and your name. If you sign in with Apple or Google, we get whatever that sign-in hands over — usually name and email, and with Apple that can be a relay address that hides your real one. Sign-in is run by a company called Clerk. They hold your credentials and your session. We never see a password.

You can add a profile photo. It is stored in Cloudflare's object storage and served from a public web address with a random name in it. It is not listed anywhere and not indexed, but anyone who has the link can open it without signing in. Do not use a photo you would mind a stranger seeing.

What your household does

Recipes you save, write or import. Weekly plans. Shopping lists and what you ticked off. Your pantry. Cooking notes. Which cuisines you like and which foods you would rather not see. Ratings. Who else is in your household and what role they have.

Receipts

If you scan a receipt, we keep what was read out of it: the store, the date, every line, every price, the total. This is the most detailed thing we hold about you. A grocery receipt says a lot about a household.

We do not keep the photo. It is sent to Google to be read, the text comes back, and our servers do not store the image. The same is true of a photo or screenshot you import a recipe from: the picture is not kept, the recipe is.

Dietary and allergy information

Dietary tags for each household member ("vegan", "gluten-free"), and contact-risk notes you write against a member — an ingredient, how serious it is, and any note you add.

Voice, in cook mode

Cook mode can run hands-free. Listening for "hey spud" happens on your phone and goes nowhere. Once it hears the phrase, or you tap the mic, your phone opens a live audio connection to Google and streams what the microphone picks up until the session ends.

Your device

A push token and a device identifier we generate, so notifications reach the right phone. The app version and operating-system version. Request timings when you switch on performance recording, which is off by default and only exists in development builds.

How you use the app

Product analytics, through a company called PostHog: which screens you open, which actions you take, and when. Events carry your user ID and your household ID, plus things like a recipe ID, how long a search was, a basket total, a receipt total and the number of items on it. Your email address is not in them.

Session replay is switched on. That means PostHog can record what your screen showed and play it back to us, so we can see what broke instead of guessing. It is on for the app and for this website. On the website, everything you type into a form is masked out of the recording. It is for finding faults, and it is not shown to anyone but us.

This website

The same analytics runs here, including page views and session recording, and it sets a cookie and a browser storage entry to keep count of one visit rather than many. If you join the waitlist, we store the email address you give us, the answer to the question next to it, and which page you came from.

The site also loads its typefaces from Google Fonts, which means Google sees your IP address and browser when a page loads. That is a thing we could stop doing by hosting the fonts ourselves, and have not yet.

What we do not collect

• Your location. The app never asks for it.
• Your contacts.
• Apple Health or any fitness data.
• Card or bank details. Apple takes the payment; we never see the card.
• Advertising identifiers. There is no Meta pixel, no ad SDK, no attribution SDK and no cross-app tracking. We do not show the App Tracking Transparency prompt because there is nothing to track you with, and the app's own privacy manifest declares no tracking.
• Anything from a crash-reporting service. We do not run one.

Allergy and dietary information is sensitive

We treat it that way. Specifically:

• We only get it because you typed it in. We never guess it, infer it from what you cook, or buy it from anyone.
• Typing it in is your consent to us holding it and to using it for the one job it is for: keeping the thing you told us about out of your week, and showing your own note back to you when an ingredient touches it.
• It never goes to analytics and never goes to advertising. It is not in a PostHog event. It is not in an ad profile, because we have no ads.
• It does go to Anthropic. When the app suggests meals, the dietary tags and the contact-risk ingredient names for your household are sent to Anthropic's Claude model as constraints, so what comes back does not contain the thing you avoid. The ingredient name and the severity are sent. The free-text note you write beside them is not.
• Delete any of it in the app, at any time, and it stops being used immediately.

G'day Spud is not a medical, safety or allergy tool. Household rules are reminders, not authoritative health information. That is set out in the terms of use, and it matters here too: we store what you wrote, we do not check it, and we do not decide what is safe.

Artificial intelligence, and what goes to it

Google — reading photos of receipts and recipes

When you scan a receipt, or import a recipe from a photo or a screenshot, the image itself is sent to Google (Gemini 2.5 Flash, through Google AI Studio) to be read back as text. The whole image goes, not a crop. If your receipt shows a loyalty number, a store, a time and everything in your trolley, all of that goes with it.

Your permission: the first time you scan a receipt or import a recipe from a photo, the app asks you on a sheet that names Google, before the photo picker opens. Nothing is sent unless you agree there and then choose a photo or take one. Tap "Not now" and the scan is abandoned — no photo is taken, none is chosen, and nothing leaves your phone. One yes covers both photo paths on that device, because both send the image to the same place, and you are not asked again on that device. No image leaves your phone on its own, and the app never reads your photo library in the background. If you would rather nothing of yours reached Google, decline: every other way in still works.

Google — cook-mode voice

If you turn on hands-free cooking, your microphone audio goes to Google (Gemini Live), straight from your phone, for as long as the session is open. The recipe you are cooking goes with it, so the answers make sense.

Your permission: voice is off until you tap "Turn on voice" on the sheet that explains it and names Google, and iOS asks separately for the microphone. Listening for "hey spud" happens on your phone, using Apple's on-device speech recognition. Nothing goes to Google until the phrase lands or you tap the mic. Leave voice off and no connection is made.

Anthropic — recipes, ingredients, and your household rules

Recipe titles, ingredients and instructions you import, text read out of a photo, pantry and shopping item names, search queries, and your household's dietary tags and contact-risk ingredients are sent to Anthropic (Claude Haiku) — to pull a recipe out of a web page, tidy an ingredient list, work out quantities, match an item to a supermarket product, and suggest swaps. Your name, your email and your receipts are not sent.

Your permission: this runs whenever you import a recipe, add to your pantry or build a shop, because it is how those features work. If that is not acceptable to you, the app is not for you, and you should not create an account.

Cloudflare — small text jobs

Short jobs like normalising an ingredient name or classifying a search run on Cloudflare's own AI models, inside the same service that already runs our servers.

The limits of what we can promise

We do not train any model on your content, and we do not sell it. Whether Google or Anthropic retain what they receive is governed by our agreements with them. We have not yet confirmed zero-retention terms in writing with either. Until we have, that is the honest position, and this paragraph will change when it changes.

Everyone who receives your data

This list was checked against the code on 23 September 2026, not against a plan. If a company is not on it, we are not sending it anything.

Coles and Woolworths

We read their public prices. We never send them your account, your household or your receipts.

Filling a trolley works differently, and you should know how. The app opens the retailer's own website inside a window in the app, signed in as you, and adds the products and quantities from your list to your trolley there. It can tell whether you are signed in, and after you order it can read the order back off the page to save as a receipt. It cannot read your retailer password or your payment details. From the moment that window opens you are dealing with Coles or Woolworths under their terms and their privacy policy, not ours.

Nobody else. No advertising network, no data broker, no other analytics company, no crash reporter, no email marketing platform.

Where your data lives, and when it leaves Australia

The database is Postgres, hosted by PlanetScale in Sydney (AWS ap-southeast-2). Our servers are placed close to it.

Clerk, Google, Anthropic, Expo, PostHog and RevenueCat are all based in the United States, and data sent to them is handled there or wherever they choose to run it. Cloudflare's network is global.

Australian Privacy Principle 8 makes us take reasonable steps to see that an overseas recipient handles your information consistently with the APPs, and generally makes us accountable for what they do with it. We rely on each company's published terms and security commitments. We have not negotiated bespoke data-processing agreements with any of them. At this size we take their standard terms as offered, and that is a real limit on what we can guarantee. If you are not comfortable with your information being handled overseas, do not create an account.

How long we keep things

While your account is open, we keep your content until you delete it. Delete a recipe or a receipt and it goes from the database.

When you delete your account, here is exactly what happens today:

• Your account is marked deleted and your access is cut off immediately. Every request from your device is refused from that moment.
• Your sign-in identity is deleted at Clerk, so you cannot sign back in.
• Your push tokens are deleted, so the phone stops buzzing.
• If you were the only person in your household, the household and everything in it goes. If there are others, ownership passes to the next member and the recipes, plans and pantry the household shares stay with them.
• Your user record itself is not yet erased. It stays in the database, marked deleted and unreachable, because a recipe or receipt you added carries a link back to you, and we have not yet decided what those links should point at once you are gone. Until that is settled and the erase step is built, we cannot give you a date by which the record disappears. We are not going to invent one.

Also true:

• PlanetScale keeps database backups for around 30 days. A deletion is only fully out of those once they age out.
• Profile photos sit in Cloudflare storage. Deleting your account does not yet delete the image file; ask us and we will remove it.
• Analytics events and session replays at PostHog, and push records at Expo, are kept under those companies' retention settings rather than ours. Ask us and we will delete what is attached to your ID.

Your rights, and how to use them

Everything above is free. We will not ask you to explain why. Send requests to privacy@gdayspud.com.au from the address on your account, and expect an answer within 30 days.

The Australian Privacy Principles, one by one

Thirteen principles, and where each one lands here.

• 1 — Open and transparent handling. This page, kept current with the code, and a named contact. Nothing about how the app handles data is deliberately left off it.
• 2 — Anonymity and pseudonymity. Use any display name. An email address is needed to sign in, so full anonymity is not possible; Sign in with Apple's hidden relay address is the closest the app can get.
• 3 — Collection of solicited information. We collect what the features need and nothing more. Sensitive information — allergy and dietary data — is collected only with your consent, given by typing it in, and only for planning your household's food.
• 4 — Unsolicited information. If something reaches us that we had no business collecting, we delete it.
• 5 — Notification of collection. This page is the notification, and the app points to it at sign-in and in Settings.
• 6 — Use and disclosure. Your information is used to run the app for you and your household. The only companies that receive it are in the table above, each doing a job we asked them to do. We do not disclose it for anything else unless you ask us to or the law requires it.
• 7 — Direct marketing. We do none. If that ever changes, it will be opt-in, with an unsubscribe in every message, and this page will say so first.
• 8 — Cross-border disclosure. Named in full above, with the honest limit on what we can guarantee.
• 9 — Government identifiers. We collect none and never will. No Medicare number, no tax file number, no driver licence.
• 10 — Quality. Most of what we hold, you typed. Prices read from a receipt photo can come back wrong, which is why the app asks you to confirm low-confidence lines. Correct anything that is wrong, any time.
• 11 — Security. See the next section, including what we cannot claim.
• 12 — Access. Covered above. Thirty days, free.
• 13 — Correction. Covered above. Most of it you can do yourself.

Security, and what we are not going to claim

What is true:

• Everything between your phone and us travels over HTTPS.
• The database is reached over an encrypted connection and is not exposed to the internet.
• We never see or store your password. Clerk handles sign-in.
• We never see your card. Apple handles payment.
• Every request checks who you are and that you belong to the household whose data you are asking for.
• The hosting, database and sign-in companies above publish their own security certifications.

What we are not claiming:

• We hold no security certification of our own. No SOC 2, no ISO 27001, no independent penetration test. This is one person's software.
• No system is unbreakable, and we are not going to write that we take security seriously as though saying it made it so. If something goes wrong that could seriously harm you, we will tell you and the Office of the Australian Information Commissioner, promptly.

Children

G'day Spud is for adults running a household. You need to be 16 to hold an account. Children in your household appear only as names and rules you write about them — they have no account and cannot sign in. If you believe a child has created an account, email us and we will remove it.

Changes to this page

The app is being built. When what it does with your data changes, this page changes with it, and the date at the top moves. If a change is significant — a new company on that table, a new kind of data collected — you will be told in the app or by email before it starts.

Complaints

Email privacy@gdayspud.com.au. You will get an answer within 30 days. Say "privacy complaint" and it goes to the top of the pile.

If you are not happy with the answer, take it to the Office of the Australian Information Commissioner: oaic.gov.au, or 1300 363 992.

Contact

Angus Dowling, trading as G'day Spud
Victoria, Australia
privacy@gdayspud.com.au