Privacy policy

The short version

We collect what’s needed to run Possum: your sign-in, the things you watch and list, and how the app is used.
We don’t sell your data, and there are no third-party advertising trackers in Possum.
Our servers are in Sydney, Australia. Apple handles sign-in, push notifications and payments.
You can see, correct or delete your information. You can delete your account from inside the app.

Who we are

Possum is made by The IT Dept Pty Ltd (ABN 12 665 405 505), “we” or “us” in this policy. We’ve chosen to be covered by the Privacy Act 1988(Cth), opting in under section 6EA, so we handle personal information in line with it and the Australian Privacy Principles (APPs).

This policy covers the Possum iPhone app, the Possum website and the Possum waitlist.

What we collect

Your account

Sign in with Apple: a unique identifier Apple gives us for your account, and the email address Apple shares. If you choose “Hide My Email”, that’s a private relay address that forwards to you. We never see your real address in that case. If you share your name with us, we keep that too.
Guest account: if you start without signing in, Possum creates a guest account for your device. It has no name or email address attached.
Sign-in sessions: a record of the devices you’re signed in on, so you stay signed in and can be signed out.

What you put into Possum

Your watchlist and favourites, and the alert settings and target prices you choose.
Shopping lists and what’s on them, shops you mark as done, and the receipts Possum works out from them.
Your pantry, recipes and meal plans.
Your household: its name, who’s in it, and invites you create (including an email address, if you add one to an invite).
Your settings, such as your roundup time, quiet hours, time zone and appearance.

Notifications

A push token for your iPhone, which lets us send it notifications through Apple. You can turn notifications off in iOS Settings at any time.
A record of the alerts and roundups we’ve sent you, which is what your in-app inbox shows.

Subscriptions

If you subscribe to Possum Plus, Apple sends us records of your transactions: which plan, transaction identifiers, dates, whether you’re in a free trial, renewals, cancellations and refunds, along with a random account token that links the purchase to your Possum account. We use these to switch Plus on and off for you and your household.
We never see your card or bank details. Apple handles payment.

How the app is used

Possum records its own usage events, such as “opened a product” or “added a watch”, with the app version, the platform and a random install identifier created by the app. Once you sign in, these are linked to your account.
These are first-party only: no third-party analytics or advertising SDKs, no advertising identifiers, and we don’t store IP addresses with them.
Like any online service, our servers keep short-lived technical logs (for example, request times and IP addresses) to keep Possum secure and working. We keep these for 30 days.

The waitlist

If you join the waitlist on our website: your email address, and your first name and the supermarket you shop at most, if you choose to give them.
To stop spam and abuse of the form, a one-way scrambled (salted hash) version of your IP address, not the address itself, and your browser’s user agent, which says which browser and device you used.

When you contact us

Whatever you send us, such as your email address and your message.

What we don’t collect

Your location, contacts or photos.
Camera images. If you use the barcode scanner, your iPhone reads the barcode, and only the barcode number is sent to us to look up the product.
Your card or bank details.
Anything from your Coles, Woolworths or ALDI accounts. Possum never asks you to sign in to them.

How we use it

To run Possum: signing you in, saving your watchlist and lists, and syncing them to your devices.
To check prices on the things you watch and send you the roundups and alerts you’ve asked for.
To share lists with your household, and give Plus to the people you invite.
To manage your subscription and free trial.
To understand which parts of Possum are used, so we can fix and improve them.
To keep Possum secure, and to prevent misuse and fraud.
To answer you when you contact us.
To email waitlist members when Possum launches. That’s all the waitlist is used for.
To meet our legal obligations.

We don’t use your information for advertising, and we don’t build advertising profiles.

Overseas disclosure

Possum’s own servers are in Australia, but some of the services above process information overseas:

Apple, for sign-in, push notifications and purchases, in the United States and other countries where Apple operates.
Anthropic, for recipe reading, in the United States.
Microsoft, for email. Our Microsoft 365 data is stored in Australia, but Microsoft may access or process it in other countries, including the United States, to support and secure the service.

We take reasonable steps to make sure these providers handle your information in line with the APPs.

Where it’s stored and how it’s protected

Your Possum data is stored on servers in Sydney, Australia. It’s encrypted in transit, passwords and sign-in tokens are stored only as hashes, and access is limited to the people who need it to run Possum.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we’ll tell you and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires.

How long we keep it

Account data: for as long as you have an account.
When you delete your account, we delete your account data, including your watchlist, lists, pantry, recipes, notifications and usage events, within 30 days.
Subscription transaction records: for as long as tax and accounting laws require (usually 5 to 7 years), even after you delete your account.
Technical logs: 30 days.
Waitlist emails: until Possum launches and we’ve told you, plus 12 months, or until you ask us to remove you.

Access, correction and deletion

See or correct your information: most of it is right there in the app. For a copy of everything we hold about you, or to correct something you can’t change yourself, email [email protected]. We’ll respond within 30 days.
Delete your account: in the app, go to Account, then Delete account. This deletes your account and the data linked to it, as described above. Deleting your account doesn’t cancel an App Store subscription. Cancel that in iOS Settings (see the subscription terms).
Leave the waitlist: use the unsubscribe link in any waitlist email, or email us.
Stay anonymous: you can use Possum with a guest account, with no name or email. If you sign in with Apple, “Hide My Email” keeps your real address to yourself.

Children

Possum is made for adults doing the grocery shopping. It isn’t directed at children under 16, and we don’t knowingly collect their personal information.

Changes to this policy

We’ll update this policy when Possum changes. We’ll change the effective date at the top, and if a change is significant we’ll tell you in the app or by email before it takes effect.

Contact and complaints

For privacy questions, requests or complaints, contact us:

The IT Dept Pty Ltd
Email: [email protected]

We’ll acknowledge your complaint and try to resolve it within 30 days. If you’re not happy with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.