Privacy Policy
Shopuler is built and run from Stanthorpe, Queensland, Australia, by Shopuler Pty Ltd. This policy explains what information the app collects, what it's used for, who else touches it, and what happens when you delete your account. We've tried to write it the way we write everything else: plainly, and without pretending to know more than we do — or collect less than we do.
The short version: we collect what we need to run a community-updated op shop finder, and nothing more. No ads, no data sale, no cross-app tracking, no third-party analytics. Your precise location never reaches our servers. The longer version, with the details and the caveats, is below.
1. Information you give us
Account details. When you sign up we store your email address, which we use to sign you in. You can sign up with email and password, Sign in with Apple, or Google — whichever you choose, we store the email that provider gives us. (If you use Apple's private relay, that's the address we get.) If you sign in with Apple or Google, we also store the account ID that provider gives us, so we know it's you next time. If you sign in with Google, Google also sends us the name on your Google account and a link to its profile picture, and we store those too. You can optionally set a display name. That's separate from the name Google sends, so turning off "show name on reviews" hides your display name but doesn't remove Google's name from our records.
Contributions. If you contribute to the community — check-ins, reviews and ratings, hours confirmations, corrections to shop details, new shop submissions, shop photos, problem reports, or (for shop operators) posts and claims — we store what you submit. Reviews show your display name only if you've turned on "show name on reviews"; otherwise they're unattributed. Saved shops and planned routes are private to you.
Optional questionnaire. The contributor questionnaire (how often you visit, areas you're interested in, preferred organisations, interests) is optional and every question is skippable. We store what you choose to answer.
We do not collect your age, your contacts, or your photo library (beyond photos you individually choose to upload).
2. Your location
Location is the most sensitive thing a shop finder touches, so here is exactly how we handle it.
Finding shops near you (foreground). When you use the app, it reads your position at roughly 100-metre accuracy. Before any coordinate is sent to our server, it is rounded to about 100 metres. Our servers never receive your precise position, and we never store your location — rounded or otherwise — as a record about you.
Nearby-shop notifications (background, opt-in). If you turn on proximity notifications, the app uses your device's background location capability so your phone can tell when you're near an op shop. This works through the operating system's geofencing: the app sets up small zones around nearby shops, and your phone notifies you locally when you enter one. All of this happens on your device. Your background location is never transmitted to our servers or to anyone else — the notification is generated on your phone, by your phone. You can turn the feature off in the app, or revoke the permission in your device settings, at any time.
The home-screen widget shows nearby shops using data the app has already prepared on your device. The widget makes no location or network requests of its own.
Where location does leave your device. Three honest caveats:
- Maps and place search. To show you a suburb label ("near Chermside") and to let you search for places, the app uses your device's built-in geocoding service — Apple's on iPhone, Google's on Android. Your coordinates (at the ~100 m accuracy tier, not rounded by us) and your place-search text go to that service, under Apple's or Google's own privacy policy.
- The map itself. The Find screen map is Google Maps on both platforms. Drawing the map sends viewport requests to Google, and while the map follows you, the viewport reflects where you are. Google's privacy policy applies: https://policies.google.com/privacy
- Planning a drive. When you plan a drive, the towns or suburbs you plan from and to go from our server to HERE, which works out the route. If you start from where you are, the app sends the centre of the suburb or town you're in, not your position. Nothing that identifies you goes with them: no account, no device ID and no network address of yours. HERE's privacy policy applies: https://www.here.com/en-gb/privacy
When you tap "Directions", we hand the shop's coordinates (not yours) to your maps app, which takes over from there.
3. Usage analytics
We collect first-party analytics about how the app's features are used — things like which screens are viewed, when the map or filters are used, and when a check-in or review is submitted. These are drawn from a fixed catalogue of 24 named events; the database itself rejects anything outside that list.
What analytics can never contain: your location, and the content of what you type. Search analytics record only a query's length and how many shops it found, never its text or which shops came back. The app cannot record free text as an event property at all.
Each event carries the app version, platform, a timestamp, and — if you're signed in — your account ID. If you use the app without signing in, events carry no identifier of any kind: no device ID, no advertising ID.
Analytics never leave our infrastructure. There is no third-party analytics service in the app; events go to our own database, and app clients can only write them, not read them. Analytics are kept for 90 days and then automatically deleted. If you delete your account, any analytics still inside that window are immediately unlinked from you (see §9).
4. Shop photos
Photos you upload to a shop's page are public — that is their purpose. Before upload, every photo is re-encoded on your device, which removes embedded metadata such as the GPS coordinates cameras sometimes store in image files.
Choose photos of the shop, not of people — and be aware that anything visible in a photo you upload is visible to everyone.
5. What we don't do
- No advertising, and no advertising identifiers.
- No sale of your data, to anyone, ever.
- No cross-app tracking.
- No third-party analytics or crash-reporting SDKs.
- No push-notification service: nearby-shop notifications are generated locally on your device, so no push token is ever requested or stored.
6. Who else touches your data
- Supabase hosts our backend: accounts, database, file storage, and the emails we send you (verification, password reset). All server-side data in this policy lives there, under our agreement with Supabase and their privacy commitments: https://supabase.com/privacy
- Apple and Google as sign-in providers. If you sign in with Apple or Google, they know you use this app. Google gives us your email, your name and a link to your profile picture. Apple gives us your email, or a private relay address if you choose one; we don't keep a name from Apple. Their privacy policies apply to their side of that exchange.
- Google Maps renders the map (§2), and Apple's or Google's geocoding service resolves suburb labels and place searches (§2).
- HERE works out routes when you plan a drive (§2).
- Expo delivers app updates: your device periodically checks Expo's update service for new versions. Those requests carry app-version and platform details, not your identity or location.
That's the complete list. Each of these operates under its own published privacy policy, linked or named above.
7. What stays on your device
The app keeps working data on-device — cached shop details, your proximity settings, draft routes, and similar — none of which is synced or transmitted anywhere. Uninstalling the app removes all of that working data.
Sign-in tokens are held in your device's encrypted system keychain. On iPhone, the keychain may retain them after you uninstall the app — that's how iOS works, not something we control. They're encrypted, usable only on your device and only by this app, and are cleared and invalidated when you sign out. If you uninstall without signing out, a retained token may sign you back in if you reinstall on the same device — signing out before uninstalling clears it.
8. How long we keep things
Everything we store server-side is kept while your account exists, with three exceptions. Analytics events are deleted automatically after 90 days regardless.
The second is request logs. Supabase, which hosts our backend (§6), keeps a technical log of the requests our app makes to it. An entry records that a request happened, which account made it, what it asked for — which shop's details, for instance — the network address it came from, the rough area that address points to, and what device made it. It does not record your email, your password, or anything you wrote or uploaded. Supabase documents a seven-day retention for these logs; in practice we have seen them kept longer. They stay within Supabase's infrastructure and go nowhere else.
The third is a short-lived record that stops the route planner from being flooded with requests. When you plan a drive, our server keeps a scrambled form of the network address the request came from — never the address itself — with a count of how many routes it has asked for that minute. It isn't linked to your account or to the places you asked about. It's usually kept for a few minutes: old entries are deleted automatically as the route planner is used, not on a timer, so if no one plans a drive for a while, the last ones wait until someone does.
9. Deleting your account
You can delete your account yourself, in the app, at any time. Deletion is immediate — there is no grace period. Four things can outlast it: our backups and our sign-in service's log, both covered below, and the request logs and the route-request record described in §8.
Deleted outright: your sign-in identity and credentials, your profile (email, name, settings), your saved shops, your planned routes, your questionnaire answers, your hours confirmations, and the text of any reviews you've written.
Kept, but permanently unlinked from you: your ratings (the stars, not the words), shop corrections you've submitted, new shops you've added, photos you've uploaded, posts, and problem reports remain in the app, with no connection to you — the link to your account is severed and cannot be restored. Analytics events still within their 90-day window are unlinked the same way.
If you're a verified shop operator: your operator status is revoked, the shop's verified-operator marking is removed, and any pending operator claims are rejected.
Our backups: We keep encrypted backups of the database for up to seven days, so we can recover if something goes wrong. A deleted account can still exist in a backup until that backup expires. We never use a backup to bring back an individual account, and if we ever have to restore the whole database, we re-apply every deletion made since that backup was taken.
Our sign-in service's log: The service that handles sign-in for us (Supabase) keeps its own log of sign-ins and account changes. Each entry records the email address involved, and if you use Google sign-in, it can also record the name Google sent. Deleting your account doesn't remove these entries: they stay for as long as that service keeps its log. We don't use this log to identify or contact anyone.
We want to be direct about this: deleting your account does not delete all of your public contributions. Your ratings, photos, shop corrections and submissions stay, anonymously, because the community relies on them — but the words of your reviews are deleted. That's a deliberate choice in both directions: your opinions in your voice are yours, and the factual record the community built together is the community's. If you want other contribution content removed as well — a photo you uploaded, or the description on a shop you added — email us at support@shopuler.com and we'll sort it out. Do that before you delete: once the link to your account is gone, we can't find your contributions to remove them.
10. Your choices
- Location and notification permissions can be revoked anytime in your device settings.
- Nearby-shop notifications are opt-in and can be switched off in the app.
- Your display name on reviews is controlled by the "show name on reviews" setting.
- Usage analytics (§3) are inherent to using the app — they contain no location and no typed content, and deleting your account unlinks them from you.
11. Children
Shopuler is a general-audience app. We don't knowingly collect any information beyond what's described here from anyone, and we don't ask for or collect ages.
12. Changes and contact
If our data practices change — for example, if a future version adds push notifications — we'll update this policy before the change ships and note the new effective date here.
Updated 21 October 2026: §2 and §6 now cover HERE, which works out routes when you plan a drive, and §8 and §9 cover the short-lived record that limits route requests. The previous version took effect on 17 October 2026.
Updated 17 October 2026: §1 and §6 now say what signing in with Apple or Google gives us: we keep the account ID each provider sends, and from Google your name and a link to your profile picture, but no name from Apple. §9 now says that our sign-in service keeps its own log of sign-ins and account changes, which deleting your account doesn't remove. The previous version took effect on 17 September 2026.
Updated 17 September 2026: §3 now covers one more search analytics event, which records a query's length and how many shops it found. The previous version took effect on 24 August 2026.
Questions, requests, or complaints about privacy: support@shopuler.com. We're a small operation based in Stanthorpe, Queensland, and a real person reads these.