Privacy Policy

Stuff the Shopping is built to make grocery shopping easier without taking control of your retailer account or checkout.

Last updated: 27 August 2026

1. What we collect

Depending on how you use Stuff, we may collect and hold:

• account details such as your name, email address, mobile number, suburb and postcode;
• household membership, invitations and shared household settings;
• shopping lists, product preferences and supermarket preferences;
• voice recordings that you choose to submit by tapping the microphone, plus the resulting transcript and grocery-list instructions while they are being processed;
• technical information needed to operate, secure and troubleshoot the service.

We aim to collect only information reasonably necessary to provide and improve Stuff.

2. Voice and AI processing

When you tap to talk, your recording is sent to our backend and then to OpenAI’s API so it can be transcribed and interpreted as grocery-list actions. We do not intentionally store the audio file in the Stuff database after the request is processed.

OpenAI states that API inputs and outputs are not used to train or improve its models by default unless the API customer opts in. Depending on the API configuration and endpoint, OpenAI may retain API inputs and outputs for up to 30 days for service and abuse-monitoring purposes, unless different eligible data-retention controls apply.

3. How we use information

We use information to provide the shopping-list service, sync household lists, remember preferences, process voice input, match requested groceries to retailer products, maintain security, troubleshoot problems, respond to support/privacy requests and comply with applicable law.

4. Retailer accounts and payment information

Stuff is separate from your Woolworths, Coles or other retailer account. Retailer login happens inside the retailer experience on your device. Stuff does not ask you to provide your retailer password or payment-card details to Stuff.

Retailer cookies or session information may be stored locally by the embedded retailer browser on your device so the retailer can keep you signed in. Checkout and payment remain with the retailer.

5. Who we disclose information to

We use service providers where necessary to operate Stuff. Current providers include Supabase for authentication, database, realtime sync and backend functions, and OpenAI for voice transcription and grocery-list interpretation. When you choose to shop, your device also interacts directly with the selected retailer website.

We do not sell personal information to advertisers.

6. Overseas processing

Some service providers process or store information outside Australia. Our current Supabase project is hosted in South Korea. OpenAI and its subprocessors may process information in other jurisdictions depending on the service configuration. We will update this policy if our material data-hosting arrangements change.

7. Household sharing

If you join a shared household, other members of that household can see and change the shared grocery list and related household information. Do not add information to a shared list that you do not want other household members to see.

8. Security and retention

We use access controls and database security rules intended to limit account and household data to authorised users. We keep personal information only for as long as reasonably needed for the service, legal obligations, security and dispute resolution. Account deletion is available in the app and is designed to remove the Stuff account and associated stored Stuff data that we are not required to keep.

9. Access, correction and complaints

You can update key account details in the app. You can also request access, correction or raise a privacy complaint through More → Help & support in the app. We will review privacy complaints and respond within a reasonable period. If you remain dissatisfied, you may also have the right to contact the Office of the Australian Information Commissioner.

10. Children

Stuff is designed as a household grocery tool. Account holders are responsible for how household members use the service. We do not intentionally ask children to provide retailer payment details or retailer passwords.

11. Changes

We may update this policy as Stuff changes. The latest version will be published at this address with an updated date.