PROPOSED PRIVACY DRAFT · au-privacy-draft-v3 · 2026-08-16
Proposed privacy policy.
The au-privacy-draft-v3 document is Tare's proposed privacy policy draft, pending Australian privacy counsel review and approval. It is published for review only, is not an approved public policy and is not currently in force.
Tare is operated by SSPC HOLDINGS PTY LTD (ACN 655 413 273, ABN 85 655 413 273).
The draft explains how we propose to collect, use, store and disclose personal information in connection with the app, website and support channels.
We seek to handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
1. Scope and eligibility.
If approved and brought into effect, this policy will apply when you use Tare, create an account, submit a request, contact support or use a feature that sends data to a service provider.
You must be at least 18 years old. The App is not available to anyone under 18. If we learn that an account belongs to someone under 18, we will disable the account and delete associated personal information unless we must retain it by law.
2. What we collect.
- Account and profile data — name, email, phone if provided, account identifier, authentication records and requested service messages.
- Saved shopping data — favourites, pantry items, custom lists, settings and related product interactions when you choose an account-backed sync feature.
- Usage and device data — app interactions, diagnostic and security logs, app and operating-system version, device identifiers and IP-derived region where generated by the service or an enabled diagnostic feature.
- Search and shopping context — the current query, selected product identifiers, list counts, favourite categories and a limited set of recent item names when needed for a feature you use.
- User content — support requests, feedback, product photos, OCR text, prices and product-update report details you submit.
- Address and matched coordinates — an address, suburb, or postcode you submit, the matched address label and coordinates, and any preferred store or store region you save. Tare does not request device-location permission or collect GPS location in this build.
- Voice search transcript — the text returned by Apple or Google speech-recognition services after you invoke voice search. Tare receives the transcript, not the microphone recording.
- Future transaction data — subscription status, billing metadata and transaction identifiers supplied by an app store or payment provider if paid features are introduced.
3. How we collect and use information.
We collect information directly from you, through necessary security and service operation, through optional features you enable, from our identity and service providers, and from public or licensed sources where lawful.
We use it to provide accounts and app features, match nearby stores, return searches and comparisons, personalise shopping insights where enabled, answer support requests, improve reliability, detect abuse or security incidents, comply with law and send marketing only where permitted.
Nothing is sent for address matching while you type. Voice-search audio is processed only after you invoke voice search and grant the required microphone or speech-recognition permission.
4. Providers and feature processing.
- Supabase provides authentication, database, private storage and Edge Function infrastructure. Account-backed shopping data may be stored there when you use sync.
- Address matching sends the address, suburb, or postcode you submit through Tare's geocoding service to its configured provider, currently OpenStreetMap's Nominatim service. Tare or the provider may cache a matched result for up to 24 hours. Saving a match stores its label and coordinates in your Tare settings. Saved coordinates are not sent to Gemini.
- Voice search uses Apple or Google speech-recognition services. They process microphone audio; Tare receives and may use the transcript for your search but does not receive or store the microphone recording.
- Website requests use our hosting and mail providers to process waitlist, support and account-deletion submissions so we can receive and respond to them.
- App stores and payments may process subscription and transaction information under their own terms if paid features are introduced.
We may also disclose information to security, diagnostic and support providers; professional advisers; regulators, courts or law enforcement where required; and a buyer or investor in a confidential corporate transaction.
5. Tare AI and Gemini.
Product photos selected for AI reading, together with compact shopping context, pass through a Tare-controlled Supabase Edge Function to the Google Gemini API. We do not send your email address or Tare account ID to Gemini. Tare does not use Gemini Files, caching or Interactions storage for these requests.
User-facing Tare AI uses a billing-enabled Gemini API project. Under Google's paid-service terms, Google does not use prompts or responses to improve its products. Google may retain prompts, contextual information and outputs for up to 55 days for abuse monitoring and legal or regulatory obligations. Tare does not claim zero data retention or zero provider retention. See Gemini API terms and abuse-monitoring information.
6. Privacy settings, cookies and tracking.
Necessary cookies, tokens, logs or SDK functions may be used for authentication, security, diagnostics and service operation. Usage analytics and personalised ads are off by default. We are not adding website analytics, advertising pixels or brokered tracking tags for the closed-beta launch.
Personalised recommendations are off by default. If you turn that setting on and use AI photo reading, a compact selection of favourites, lists and recent shopping activity may be included with the AI request. You can turn personalised recommendations off again in Privacy settings.
Recent search history is stored locally on your device by default. Purchase insights use local purchase history to generate trends and savings summaries.
Personalised ads are unavailable during the closed beta, and sponsored products are hidden. If Tare introduces sponsored placements later, we will clearly identify them and update the relevant controls and disclosures before enabling them.
7. Overseas processing.
Some providers and their subprocessors may process information outside Australia, including in the United States and other countries where they maintain facilities. Provider locations can change. We take reasonable steps required by applicable law when disclosing personal information overseas. Contact support@tare.net.au for the current provider list.
8. Retention and deletion.
- AI requests — Tare's application database does not save AI-reading photos or responses merely because they were sent for an AI request.
- Address matching — submitted queries and matched results may be cached by Tare or its provider for up to 24 hours. A matched address label and coordinates remain in your Tare settings only when you save them.
- Product update reports — private photos and report records remain until the report or account is deleted, or Tare removes them under its moderation lifecycle.
- Account deletion — after identity verification, an authorised owner reviews the request, applicable retention requirements and fulfilment scope. Tare confirms the next steps and any applicable timing during that review. Report records and storage objects must be removed before the account record. Data stored only on your device is cleared by deleting the app or clearing its local app data.
- Operational and provider retention — we and our providers may retain limited security, fraud-prevention, request, abuse-monitoring, legal-compliance and tax/accounting records where permitted or required.
9. Security and data incidents.
We use reasonable technical and organisational safeguards, including encryption in transit, access controls, least privilege, monitoring and secure development practices. No system is completely secure.
If an eligible data breach occurs, we will follow our incident-response process and make notifications required under Australia's Notifiable Data Breaches scheme.
10. Access, correction and deletion rights.
You may ask to access or correct personal information we hold about you. We will respond within a reasonable time, subject to lawful exceptions.
- Request access or correction by emailing support@tare.net.au.
- Request deletion from Settings → Login & security → Delete account, through the public deletion form, or by email.
- Delete the app or clear local app data to remove information stored only on your device.
- Turn optional personalisation, analytics and advertising controls off in Privacy settings.
11. Complaints.
Send a privacy complaint to support@tare.net.au. We will investigate and respond. If you are not satisfied, you may contact the Office of the Australian Information Commissioner.
12. Aggregated data and sale of personal information.
We do not sell personal information for money. We share it only as described in this policy to operate, secure and improve Tare or where law requires.
Tare may in future license aggregated product-level market analytics derived from public retailer price data. Those analytics would not include personal information or user-level dimensions. We do not currently license or publish app-usage analytics. Before considering an app-usage analytics product, we would update this policy and apply safeguards designed to prevent individuals being identified.
13. Changes and contact.
We may revise this draft before approval. If a privacy policy is approved and brought into effect, material changes will be notified in the app, on this website or by email. The version and date at the top identify the draft presented for review.
Privacy Officer
SSPC HOLDINGS PTY LTD
Email: support@tare.net.au
Postal address: available on request by email.