Spoonbill privacy policy

Spoonbill helps you plan your grocery shop across New Zealand supermarkets. We collect as little about you as we can. This page says what we keep, where it goes, and how to get a copy of it or have it deleted. We follow the Privacy Act 2020.

Last updated: [OWNER: date of publishing]

What stays on your phone
The web app
What we keep about you
Everything we hold, in one table
What Google and Apple pass to us
Usage statistics (only if you turn them on)
Who helps us
Outside New Zealand
This website
Getting a copy of your data
Deleting your account
Price watch
Barcode scanning
Your rights, questions and complaints
Who we are

What stays on your phone

Your shopping list, the stores you chose, your usual store, your memberships, how you shop, the answers you gave when the app asked which product you meant, the swaps you approved and the shops you logged are all kept on your phone, and in your phone’s own backup if you make one. They are not kept on our servers. They stay until you remove them in the app or remove the app.

The web app

You can also use Spoonbill in a web browser, at app.spoonbill.nz, signed in with the same account as in the phone apps. The web app keeps your shopping list, the stores you chose, your usual store, your memberships, how you shop, the answers you gave when it asked which product you meant, the swaps you approved, the shops you logged and your week of meals in that browser, not on our servers. They stay until you remove them in the web app, choose Me, then Clear this browser’s data, or clear the browser’s own data for app.spoonbill.nz.

Clerk keeps you signed in to the web app with its own cookies. [OWNER: name what Clerk’s script keeps in the browser, as item 18 of the checklist says.] The web app runs no script but its own, Clerk’s and, when Clerk asks for its check, Cloudflare’s Turnstile (see Who helps us): no advertising, no tracking and no usage statistics.

To work out prices, plans and searches, the web app sends our server what each answer needs, as the phone apps do (see What we keep about you).

What we keep about you

Your account

You sign in with an email code, with Google, or (on iPhone) with Apple. Your account holds your email address, an account number Clerk makes for it, and your sign-in sessions. We don’t ask for your name, and we never ask you to make a password. If you sign in with Google or Apple, we ask them for your email address only (see What Google and Apple pass to us). [OWNER: check what Clerk keeps with your sign-in sessions (any device or network details), and say it here.] Your account holds nothing about your shopping.

Nothing else about your shopping

To work out prices, plans and searches, the app sends our server what each answer needs, signed in with your account: what you search for, the products and quantities on your list, the lines of a list you paste and the answers you gave about which product you meant, your stores, usual store and memberships, how you shop, the swaps you approved, and, for Saved, the shops you logged with what you paid and when. The server works out the answer, sends it back and keeps none of it. We don’t keep your list or your shops on our servers, only your price watches if you make any (see Price watch). Prices, totals and savings are worked out by our own code from the price catalogue, and the apps don’t send your list or anything else about you to an AI service. [OWNER: confirm this stays true when you publish.]

Our server runs at Convex, in the United States. Convex may keep a short-lived record of the requests the app makes (which call, and what it carried) in its platform logs. [OWNER: confirm Convex’s log retention, and say how long here.]

How often your account asks

To stop one account overloading Spoonbill, our server at Convex counts how many requests your account makes in each hour and each New Zealand day, from the phone apps and the web app alike, and notes when it turned one away. Each count is deleted within a day of its hour or day ending, so we keep it for at most two days. If we change your account’s limits (for example, raising them after you write to us), we keep that setting until we remove it. When you delete your account in the iPhone or Android app, the app first deletes your other data on our server, which leaves these counts and that setting, so deleting can’t be used to reset the limits; Clerk then tells our server the account is gone, and they’re deleted with it. When you delete your account in the web app, the web app deletes it at Clerk first, and Clerk then tells our server, which deletes these counts and that setting with the rest of your data there. The counts are in the file Export my data gives you. [OWNER: check what stays after a deletion and for how long: the counts for at most two days, and a changed limit until the account is deleted in Clerk (the user.deleted webhook, item 13).]

What we never ask for

We never ask for a supermarket password, a card or any payment details, and the app never signs in to a supermarket for you or places or pays for an order.

Everything we hold, in one table

Every piece of information about you that Spoonbill holds or passes on: why, where it is, and for how long.

What	Why	Where	How long
Your email address	To make your account, send your sign-in codes, and know which account is yours when you write to us.	Clerk, in the United States	Until you delete your account.
Your account number, a code Clerk makes for your account	So our server knows each request comes from a signed-in account.	Clerk. Our server checks it on each request, and keeps it with the counts of your requests, any changed limit and your price watches (see How often your account asks, and Price watch).	Until you delete your account.
Your sign-in sessions	To keep you signed in.	Clerk, and your phone, or Clerk’s cookies in your browser on the web app	Until you sign out or the session ends. [OWNER: Clerk’s session length, and any device or network details it keeps with a session.]
What Google or Apple pass when you sign in with them, beside your email address: a code for that account	The code signs you in with them again.	Clerk	Until you delete your account.
What the app or the web app sends to work out prices, plans and searches: your searches, your list, pasted lines and your answers about them, your stores and memberships, how you shop, the swaps you approved, and the shops you logged with what you paid	To work out the answer and send it back.	Our server at Convex, in the United States	Not stored. Convex’s request logs may hold the calls for a short time (above).
A barcode you scan or type, with your store choices, usual store and memberships	To look up the product’s prices.	Sent to our server at Convex, in the United States	Not stored, beyond the count of requests (see How often your account asks). The scanned products stay on your phone until you tap Done or Start again.
How often your account asks: a count of its requests in each hour and each New Zealand day, whether one was turned away, and a changed limit if we set one	To stop one account overloading Spoonbill.	Our server at Convex, in the United States	Each count for at most two days, and a changed limit until we remove it. Both are deleted with your account (see How often your account asks).
Your price watches: the products you watch, your store choices and usual store, and whether you want notifications	To tell you when a price drops.	Our server at Convex, in the United States	Until you stop watching or delete your account, or with everything for someone we haven’t heard from in 13 months (opening the app while signed in counts, and on Android so does its daily check for price drops).
The notices we send you: the product, the store and the price	To show your price drops in the app, and never tell you about the same drop twice.	Our server at Convex, in the United States	90 days.
On iPhone, the code Apple gives us to send you notifications, with the app’s version	To send you notifications.	Our server at Convex, in the United States	Until you delete your account, or 120 days after we last heard from your phone.
Usage statistics, only if you turn them on	To learn which parts of Spoonbill, and which pages of this website, people use.	PostHog, in Frankfurt, Germany	Not linked to you (see Usage statistics). [OWNER: PostHog’s retention, as in Usage statistics.]
Your export file	So you can have a copy of your data.	Made on your phone, or in your browser on the web app. We keep no copy.	Until you delete it, or your account.
Emails you send us	To answer you, and to show what we did about a privacy request.	Our mail provider (see Who helps us)	2 years after the last message.
Your list, and everything else in What stays on your phone	So the app works.	Your phone, and your phone’s own backup if you make one	Until you remove it in the app or remove the app.
On the web app: your list, and everything else in The web app	So the web app works.	That browser, in app.spoonbill.nz’s own storage	Until you remove it in the web app, clear it (Me, then Clear this browser’s data) or clear the browser’s data for the site.

If you sign in with Google or Apple, some of what we hold comes from them, not from you:

From Apple, your email address and a code for your Apple account: we ask Apple for nothing else. If you choose Hide My Email, the address is one Apple makes that forwards to yours, and we never see your own.
From Google, your email address and a code for your Google account: we ask Google for nothing else, so it doesn’t pass us your name or picture.

We use your email address to make your account and sign you in, and the code to know it’s you when you sign in with them again, and nothing else. Clerk holds them for us (see Who helps us). No law requires you to give them, but you can’t sign in with Google or Apple without them; you can sign in with an email code instead. You can see, correct and delete them as this page says, and Who we are says who holds them.

Usage statistics (only if you turn them on)

To learn which parts of Spoonbill people use, the app can send us anonymous counts of what happens in it. This is off unless you turn it on. The switch is in the app under Me, then Your data, then Share anonymous usage statistics.

What is sent, if you turn it on

That the app was opened, and which screen you went to (Prices, List, Plan, Saved, Me, the welcome screens or Fill my trolleys).
That you searched, and whether the search found anything (not what you searched for).
That you added something to your list, and whether it came from a search, a product, a pasted list, the staples basket or a scan (not what it was).
That a plan was worked out, and whether it compared one, two or three stores (not which stores).
That you opened Fill my trolleys or logged a shop.
That you started watching a price (not which product or what price).
That you scanned or typed a barcode, and whether it was found (not the barcode).
That you finished the welcome screens, and whether you tapped “Use the defaults”.
The app’s version, the version of PostHog’s code in it, and whether it runs on iPhone or Android.

Each count carries a random code made on your phone, so we can tell one phone’s counts from another’s. It is not your account, it is not linked to your email or your account, and we never connect it to you. This is usage data that is not linked to you, and it is never used to track you across other apps or websites.

What is never sent

Your email address or account, your list or anything on it, what you searched for, product names, prices, totals or savings, what you paid, your stores, your memberships, your location, your contacts, or a recording of your screen. We don’t record sessions, and we don’t use your IP address to work out where you are.

Turning it off

Turn the switch off in Me at any time. The app stops at once, deletes the random code and any counts it had not sent yet, and sends nothing more. If you turn it on again later, the app makes a new code, so the old counts and the new ones can’t be joined. Deleting your account also gives the app a new code. Counts already sent stay in our usage statistics, with no way to connect them to you: nothing links them to your account, so no one can pick out yours to delete them.

PostHog receives and stores these counts for us, in its EU Cloud in Frankfurt, Germany, inside the European Union. That is outside New Zealand: we rely on PostHog, under its data processing agreement with us, to protect them to a standard comparable to New Zealand’s, and they hold nothing that identifies you. PostHog is set to discard the IP address each count arrives from. [OWNER: sign PostHog’s data processing agreement (request it at posthog.com/dpa; PostHog sends it to you by email to sign) before you publish, or take out “under its data processing agreement with us”.] [OWNER: how long PostHog keeps the counts. Your PostHog plan sets it: 1 year on the free plan, 7 years on a paid plan, and PostHog offers no shorter period (its documentation, 21 Oct 2026).]

Who helps us

These are all the companies that hold or carry information about you when you use Spoonbill or this website, or write to us. Clerk, Convex, PostHog, our mail provider, our website host and our web app’s host do it for us, and use it only to provide their service to Spoonbill. When you sign in with Apple or Google, you deal with them directly, under their own privacy policies.

Company	What it does for us	What it gets	Where
Clerk	Runs sign-in and holds your account.	Your email address, your account number, your sign-in sessions, and what Google or Apple pass at sign-in. Its telemetry is turned off in our apps and the web app.	The United States [OWNER: confirm Clerk’s region for Spoonbill’s instance.]
Convex	Runs our server and database.	What the app sends to work out prices, plans and searches, and your price watches (see the table above), with your account number.	The United States
Apple	Sign in with Apple, on iPhone, if you choose it.	What you give Apple to sign in. Apple passes Clerk your email address (or a Hide My Email address) and a code for your Apple account.	Apple’s own servers
Apple	Delivers price-drop notifications on iPhone.	The notification, which can name the product and its price, and the code for your phone.	Apple’s own servers
Google	Sign in with Google, if you choose it.	What you give Google to sign in. Google passes Clerk your email address and a code for your Google account, and nothing else.	Google’s own servers
Google	ML Kit, the barcode scanner on Android, which runs on your phone.	Diagnostic and usage information about how the scanner is working. [OWNER: as in Barcode scanning.]	Google’s own servers
Cloudflare	Turnstile: when you make an account on the web app, Clerk may ask it to check that you’re a person, not a program.	What Turnstile reads from your browser to make that check, and your IP address. [OWNER: check Cloudflare’s Turnstile terms: what it collects and keeps, and whether it works for Clerk.]	[OWNER: where Cloudflare handles it.]
PostHog	Receives the anonymous usage statistics, only if you turn them on, in the app (see Usage statistics) or on this website (see This website).	The counts and the random codes. It is set to keep no IP address.	Frankfurt, Germany (its EU Cloud)
Our mail provider [OWNER: name it.]	Holds the emails you send to support@spoonbill.nz, and our replies.	Your email address and what you write.	[OWNER: where it holds mail.]
Vercel, our website host	Serves this website.	Ordinary server logs, such as your IP address and the pages you asked for (see This website).	[OWNER: where it keeps them.]
Our web app’s host [OWNER: name it. If it’s the website’s host, this row joins that one.]	Serves the web app at app.spoonbill.nz.	Ordinary server logs, such as your IP address and the files your browser asked for.	[OWNER: where it keeps them.]

We don’t use advertising tools. The only analytics is the anonymous usage statistics, in the app and on this website, and only if you turn them on. We don’t sell or share your data with supermarkets, brands or anyone else. Spoonbill takes no money from supermarkets or brands, and never ranks products by paid placement.

Outside New Zealand

Clerk, Convex and PostHog hold your information outside New Zealand: Clerk and Convex in the United States, and PostHog in Frankfurt, Germany. Our mail provider, our website host, our web app’s host, Cloudflare, Apple (for notifications on iPhone) and Google (for ML Kit on Android) may too, as the table says. They hold it for us, so we stay responsible for it under the Privacy Act 2020, and we rely on each of them, under its terms with us, to protect it to a standard comparable to New Zealand’s. [OWNER: accept Clerk’s and Convex’s data processing terms, if they need accepting.] We don’t send your information to anyone else, in New Zealand or overseas.

This website

This section is about spoonbill.nz, these pages. The web app at app.spoonbill.nz has its own section, The web app.

This website sets no cookies and has no advertising or tracking scripts. Vercel, the company that hosts it, may keep ordinary server logs, such as your IP address and the pages requested. [OWNER: how long Vercel keeps them, on this site’s plan.]

It can also send us anonymous usage statistics: which of its pages you open (the home page, privacy, support, terms or account deletion). This is off unless you turn it on with the button below, which needs JavaScript. Then each page you open sends PostHog which page it is and a random code made for that page alone, so no two pages can be joined. Nothing else is sent: not the full address, not where you came from, and nothing about your browser or device. PostHog is set to discard the IP address each count arrives from.

Your browser remembers that you turned it on, in this website’s own storage, and sends that nowhere. Turn it off with the same button: the website stops at once and forgets the choice.

Usage statistics are off for this website.

Getting a copy of your data

In the app, go to Me, then Export my data. You get one file with everything the app keeps on your phone, whether usage statistics are on, the email address on your account, and what our server keeps about your account, including the counts of its requests (the file’s requests). The random code used for usage statistics isn’t in it: it isn’t linked to you, and putting it in the file would link it. If you can’t use the app, email us at support@spoonbill.nz from the address on your account and we’ll send you what we hold.

In the web app, go to Me, then Export my data. The file holds what that browser keeps, the email address on your account, and what our server keeps about your account. It holds no catalogue prices. It’s made in your browser, and we keep no copy.

Deleting your account

In the app, go to Me, then Delete my account. On iPhone and on Android, this deletes:

your account at Clerk, with your email address, your sign-in sessions and anything Google or Apple passed;
everything our server keeps for your account;
the export file on your phone, if you made one;
the random code for usage statistics and any counts not yet sent, so the app starts again with a new code.

Your list, your stores, the shops you logged and the rest of What stays on your phone stay on this phone until you remove the app. If you can’t use the app, the account deletion page shows how to ask us to do it.

In the web app, go to Me, then Delete my account. This deletes your account at Clerk, with your email address, your sign-in sessions and anything Google or Apple passed. Clerk then tells our server, which deletes everything it keeps for your account. What the web app keeps in that browser stays there: to remove it too, choose Clear this browser’s data first, or clear the browser’s data for app.spoonbill.nz afterwards.

What stays after you delete: usage statistics already sent, which can’t be connected to you; Convex’s request logs until they run out; copies in Clerk’s and Convex’s backups until they are replaced [OWNER: how long, as on the account deletion page.]; and the emails you sent us, which we keep as the table above says.

Price watch

When you watch a product’s price, we keep: the products you watch, your store choices and usual store, whether you want notifications, the notices we send you, and on iPhone a code Apple gives us to send you notifications (with its app version). We still don’t keep your email, name, location, list or shopping history on our servers.

A notification can name the product and its price, so it can show on your lock screen. Apple delivers notifications on iPhone. On Android, the app checks for price drops on your phone about once a day and shows its own notification; no push service is involved.

We delete these when you stop watching or delete your account, and on a schedule: notices after 90 days, a phone we haven’t heard from in 120 days, and everything for someone we haven’t heard from in 13 months (opening the app while signed in counts, and on Android so does its daily check for price drops). Export my data includes them.

Barcode scanning

The camera is used only to read a barcode’s number, on your phone. No photo or video is kept or sent: no image leaves the camera. When you scan or type a barcode, the app sends the code, your store choices, usual store and memberships to our server to look up prices, as it does for any priced call. We don’t store anything about a scan on our servers, beyond the count of requests (see How often your account asks). The scanned products stay on your phone until you tap Done or Start again.

On Android, the barcode scanner uses Google’s ML Kit, which runs on your phone. ML Kit may send Google diagnostic and usage information about how the scanner is working. [OWNER: confirm against Google’s ML Kit terms before scanning ships, and match the Play data safety form.] On iPhone, scanning uses Apple’s own tools on the phone.

Your rights, questions and complaints

Under the Privacy Act 2020 you can ask to see the personal information we hold about you, and ask us to correct it. The export and deletion steps above are the quickest way. Or email us at support@spoonbill.nz, from the address on your account so we know it’s you. We’ll answer within 20 working days, as the law requires. [OWNER: confirm the reply time you want to promise.] If we don’t agree to correct something, we’ll say why, and you can ask us to keep a note of the correction you asked for with it.

If something goes wrong with your information in a way that is likely to cause you serious harm, we’ll tell you and the Privacy Commissioner as soon as we can.

If you’re not happy with our answer, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Who we are

Spoonbill is run by [OWNER: the company’s registered name and its registered office in New Zealand, once the company is registered (Q582)]. You can reach our privacy officer at support@spoonbill.nz. Supermarket names in Spoonbill are used only to say which store a price is for; Spoonbill is independent of the supermarkets.