Privacy Policy

1. About this policy

This policy explains how we, PennyPossum (ABN 31 869 953 292), collect, use, share and protect personal information, and how you can see or correct yours or make a complaint. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

It applies whenever you use PennyPossum, with or without an account. Please read it together with our Terms of Service.

2. What we collect

We collect only what we need to run PennyPossum:

• Account details: your name, email address and Australian mobile number, whether you've confirmed them, and your password. We never store the password itself, only a salted one-way hash of it, which lets us check it but not read it.
• Shopping lists and purchase history: the lists you compare, and what each trolley button sent to Coles or Woolworths (section 3).
• Membership and payments: your plan, its dates and status, the payments we've taken and a summary of your payment method, but never your full card number or security code (section 4).
• Sign-in and security details: the IP address and browser of each signed-in session, when we sent you codes, and counts of recent attempts at things like signing in (section 6).

We collect these from you as you sign up and use PennyPossum, from Braintree about your payments, and from Twilio about whether a code you typed in was right. Your IP address and browser are recorded automatically when you sign in. We don't buy personal information or get it from data brokers.

We don't ask for sensitive information, such as about your health, religion or ethnicity. A shopping list or purchase history can hint at things like dietary needs or health, though, so we use them only to compare prices and show you your history, never to profile you.

You can read our public pages without telling us who you are. Using PennyPossum needs an account with a working email address and Australian mobile number, and a payment method, so it isn't possible to use it anonymously, and without these details we can't give you an account. PennyPossum is for people aged 18 or over, and we don't knowingly collect information about children.

3. Your shopping lists and purchase history

• Your latest list is saved in your browser, on your device, so it's there next time. It's removed when you sign out.
• To compare prices, your browser sends the list to our server, which matches it to products and sends back the results. We don't save or log your lists on our server.
• Each time you use a trolley button, we save what it sent: the store, the products, their sizes and quantities, the prices we showed, the total and the time. You can see these under Purchase History on your profile. It's a record of what PennyPossum sent, not of what you bought.
• The trolley button then opens the store's website with the products and quantities in the link, but not your name or contact details. The store may still know who you are if you're signed in there, and its own privacy policy applies from then on.
• Product photos load straight from Coles' and Woolworths' image servers. Like any website, those servers can see your IP address and browser, but your browser doesn't tell them which page you're on.

4. Payments through Braintree

Payments are processed by Braintree, a PayPal service. We never see or store your full card number or security code.

• Card details go straight from secure fields on our payment page to Braintree. If you choose PayPal, Apple Pay or Google Pay instead, that service passes Braintree a payment token, and its own terms and privacy policy apply too.
• Braintree gives us a token for your payment method and its card type, last four digits and expiry date, or the email address of your PayPal account. We keep these to charge you and to show you which payment method you're using.
• We keep your plan, its dates and status, and a record of each payment: the amount, what it was for, when it was due and paid, and Braintree's reference for it. Braintree tells us when a payment goes through or fails.
• When you join, we give Braintree your email address so it can link your payment method and membership to you.
• To prevent fraud, Braintree's tools on the payment page collect information about your device and browser, and Braintree may decline a payment it thinks is fraudulent. PayPal's and, for Google Pay, Google's scripts on that page may set their own cookies.

Braintree handles your payment details under its own privacy statement.

5. Emails and text messages

• We send one-time codes to confirm your email address and mobile number, and to reset your password.
• Emails are sent through Resend, which receives your email address and the message. We keep only a one-way hash of each emailed code, never the code itself. A code stops working once it's used, after 10 minutes, or after 5 wrong tries.
• Texts are sent through Twilio Verify, which receives your mobile number, sends the code and checks it when you type it in. Twilio also uses the number to block fraudulent requests.
• We note when we send each code, and keep that for about an hour, so we can limit how many codes go to one email or mobile.
• We'll also email you about your account when we need to, such as before a price rise. We don't send marketing (section 7).

6. Cookies, sessions and limits on attempts

• Sign-in cookie. When you sign in, we set a cookie that keeps you signed in on that device for up to 30 days. Scripts on the page can't read it, and it's only sent over secure connections.
• Session records. For each signed-in session we record the IP address and browser it started from, and when, to help keep your account secure. When you sign out, or reset your password (which signs you out everywhere), we delete the record straight away. A session you don't sign out of expires at most 30 days after you last used it, and we delete its record soon after.
• Password reset cookie. While you reset your password, a cookie remembers which email or mobile you're using, for up to 15 minutes.
• Browser storage. Your latest shopping list, and a one-off welcome message after you join, are stored in your browser and removed when you sign out.
• Limits on attempts. To stop password guessing and floods of codes, we count recent attempts at things like signing in, sending codes and resetting a password, by IP address and by the account, email or mobile involved. Each count covers 10 minutes. The counts are kept only in our server's memory and are never saved.

We don't use analytics, advertising or tracking cookies. Apart from ours, the only cookies are the payment services' on the payment page (section 4). If you block cookies, you won't be able to sign in.

7. How we use your information

We use personal information to:

• create your account, confirm your email and mobile, sign you in and let you reset your password;
• compare prices for your lists, build trolley links and show your purchase history;
• run your free trial and membership, take payments, and handle renewals, cancellations and refunds;
• send you codes and messages about your account, and reply when you contact us;
• keep PennyPossum and your account secure, prevent fraud and misuse, and fix problems; and
• meet our legal obligations and enforce our Terms of Service.

We don't sell personal information, share it with advertisers or use it for marketing. If we ever want to send you marketing, we'll ask you first, and every message will let you unsubscribe.

Automated decisions. Some decisions are made by software alone: PennyPossum matches your list to products and works out where each item is cheaper, Braintree may decline a payment to prevent fraud, and if a renewal payment still can't be collected after retries, your membership ends, as our Terms describe. These use the details in sections 3 and 4. If you think one of these decisions is wrong, contact us and a person will look at it.

8. Who we share it with

We share personal information only as this policy describes:

• Braintree (PayPal), for payments and fraud checks (section 4).
• Resend, to send emails, and Twilio, to send and check text message codes (section 5).
• DigitalOcean, which hosts our servers and database in Sydney, Australia.
• Coles and Woolworths get only what your browser sends them when you open a trolley link, product page or photo (section 3). We don't give them your details.
• Professional advisers, such as lawyers and accountants, when they need it to advise us.
• Courts, regulators and law enforcement, when the law requires or allows it, such as under a court order.
• A buyer of our business, if PennyPossum is sold or restructured. They would have to handle your information in line with this policy.

Our service providers handle your information under their contracts with us and their own privacy policies.

9. Sending information overseas

Braintree (PayPal), Resend and Twilio store and process personal information in the United States, and Braintree and Twilio may also do so in other countries where they operate. Our servers and database are in Sydney, Australia.

Before we send personal information overseas, we take reasonable steps, including through our contracts with these providers, to make sure they handle it in line with the Australian Privacy Principles.

10. How we protect it

• Connections to PennyPossum are encrypted.
• Passwords and emailed codes are stored only as one-way hashes, and codes expire after 10 minutes.
• Card details go straight to Braintree and never reach our servers.
• We limit attempts to sign in and how many codes can be sent, and resetting your password signs you out everywhere.
• Only the people who run PennyPossum can get into our servers and database.

No system is completely secure. If you think someone has used your account, tell us straight away at contact.penny.possum AT gmail DOT com. If a data breach is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires.

11. How long we keep it

• Account details, membership, payment records and purchase history: until you delete your account (section 12).
• Session records: until you sign out, or soon after the session expires (section 6).
• Codes: deleted once used, or soon after they expire. The note of when we sent them: about an hour.
• Counts of attempts: in our server's memory only, for 10 minutes each.
• The list in your browser: until you change it, sign out or clear your browser's data.
• Backups and server logs: up to 30 days. Logs can include an email address or mobile number, for example when sending a code fails.

When we no longer need personal information, we delete it or remove anything that identifies you.

12. Deleting your account

You can delete your account at any time from your profile. When you do, we:

• end any membership straight away and cancel it with Braintree;
• delete your customer record and saved payment methods at Braintree;
• delete your account details, sessions, membership, payment methods, payment records and purchase history, and any codes and notes of codes sent to your email and mobile; and
• clear the list saved in the browser you deleted it from.

Braintree keeps its own records of past payments, as the law requires it to, under its own privacy statement. Copies in our backups and logs are gone within 30 days. If you can't sign in, you can ask us to delete your account instead.

13. Seeing and correcting your information

• Your profile shows your name, email address, mobile number and purchase history.
• To get a copy of the personal information we hold about you, or to correct anything that's wrong, out of date or incomplete, email us at contact.penny.possum AT gmail DOT com. If you mistyped your email or mobile when you signed up, you can fix it yourself while confirming it.
• We'll check it's you first, for example by sending a code to your email or mobile, and we'll respond within 30 days. There's no charge.
• If we can't give you access or make a correction, we'll tell you why in writing and how to complain. If we don't make a correction you asked for, you can ask us to attach a note saying you believe the information is wrong.

14. Complaints

If you think we've mishandled your personal information or breached the Australian Privacy Principles, please tell us first, by email at contact.penny.possum AT gmail DOT com or by post (section 16). We'll look into it and reply in writing within 30 days.

If you're not satisfied with our reply, or haven't had one within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

15. Changes to this policy

We may update this policy, for example when PennyPossum or the law changes. We'll publish each new version here with its effective date. If a change is significant, we'll email you before it takes effect.

16. Contact us

For privacy questions, requests or complaints:

PennyPossum (ABN 31 869 953 292)
Email: contact.penny.possum AT gmail DOT com
Post: Parcel Locker 31, GLADESVILLE NSW 2111