Privacy

Effective 26 October 2026.

AllWise is the sign-in for GroceryWise (grocerywise.com.au), and will also be the sign-in for PetoWise (petowise.com.au) when PetoWise accounts launch. This policy covers your AllWise account: what we store, who processes it for us, and how to delete it. This site is run by AllWise (a registered business name).

What we store

• Your email address, and whether it's verified. We only create an account for a verified address: either you opened the link we emailed you, or Google confirmed it.
• Your name: the one Google gives us if you sign up with Google, or the one you set on your GroceryWise account page. It appears in the household invites you send.
• The web address of your Google profile picture, if you signed up with Google.
• Your sessions: one for each browser you're signed in on, with its IP address, browser user agent and expiry. A session lasts 7 days, and using the site extends it.
• If you sign in with Google, a record linking your Google account, with the tokens Google issues at sign-in. We ask Google only for your name, email address and profile picture (the openid, email and profile scopes), and we don't use these tokens to read anything else from your Google account.
• Households: each household's name, its members and their roles, and its invitations. An invitation holds the invited person's email address, who sent it, and when it expires (7 days). Members of a household see each other's name and email address.
• Sign-in links: while a link we emailed you is waiting to be used, a record of it that holds your email address. The link works once and for 2 hours, and the record is deleted when the link is used.
• Google sign-in in progress: a record of the attempt, so Google's reply can be matched to it. It expires after 10 minutes.
• Google sign-in hand-off: a one-use token that passes your sign-in from AllWise to the site. It expires after 3 minutes and is deleted when used.
• Rate-limit counters, which stop our sign-in and invite emails being abused: up to 3 sign-in emails per address every 10 minutes, and 10 invite requests per account an hour. The sign-in counter is keyed by a one-way hash of your email address, never the address itself, and the invite counter by your account id. Each one expires at the end of its window.

AllWise has no passwords, and stores none.

If you contact us

If you use the contact form on the AllWise home page, we keep your name, email address, organisation if you give one, what your message is about, and the message, so we can reply. Only we read them, and we delete them after 12 months. We don't keep your IP address with them. To stop the form being abused, Upstash counts messages for an hour per email address and for up to a day per IP address, each keyed by a one-way hash, never the address itself.

Error reports

When something breaks on AllWise, an error report goes to Sentry: what went wrong, where in our code, the page address without anything after the ? in it, and the type of browser and device you're using. It never includes your email address, your IP address, cookies or what you typed. Sentry stores these reports in the United States and keeps them for up to 90 days.

What GroceryWise handles

Each session records the IP address and browser user agent of the device you signed in on. With a sign-in link, GroceryWise passes them to us. With Google sign-in, your browser comes to accounts.allwise.com.au directly, and we take them from that request.

AllWise gives GroceryWise a signed token, valid for 15 minutes, holding your account id, your email address and whether it's verified. GroceryWise uses it to keep its own data for you, such as your price alerts.

GroceryWise's server and its sign-in proxy also pass your account details between your browser and AllWise: your name, email address and profile picture, your household's members, and each of your sessions with its IP address and browser. The account pages show your name, email address, household and the devices you're signed in on.

Who processes it

• Vercel runs AllWise. Its server code runs in Vercel's Sydney region.
• Neon hosts the database that holds your account.
• Resend delivers our emails. It receives the recipient's address and the email itself: a sign-in link, an invite naming the inviter and the household, or a contact form message sent on to us.
• Upstash holds the rate-limit counters described above.
• Sentry receives the error reports described above, and stores them in the United States.
• Google, if you choose to sign in with Google.

AllWise and its data are hosted in Sydney, Australia, except error reports (Sentry) and email delivery (Resend), which are processed in the United States.

Emails

Sign-in links and household invites come from an address at accounts.grocerywise.com.au. AllWise sends no other email: a contact form message comes to us, and we reply from our own inbox.

Cookies

AllWise uses no analytics or advertising cookies. On https, the better-auth cookies below carry a __Secure- prefix.

On GroceryWise, when you sign in:

• better-auth.session_token: your session. It lasts as long as the session, up to 7 days after you last used it.
• better-auth.session_data: a short-lived copy of your session so pages load faster. It lasts 5 minutes and is renewed as you browse.
• gw_signed_in: holds only the value 1, so pages know to show your account. It lasts as long as your session and is cleared when you sign out.
• gw_google_…: set only while a Google sign-in is in progress. It holds a random value and the page to return to, and expires after 10 minutes.

On accounts.allwise.com.au, only if you sign in with Google:

• better-auth.state: ties Google's reply to your browser. It expires after 5 minutes.
• better-auth.session_token: set when Google sends you back, so AllWise can hand your sign-in to the site. It lasts as long as the session, up to 7 days.
• better-auth.session_data: set at the same time. It lasts 5 minutes.

Signing out on GroceryWise ends the session, but doesn't remove the cookies on accounts.allwise.com.au. Those expire on their own, within 7 days.

When PetoWise accounts launch, PetoWise will set the same cookies, named pw_ instead of gw_.

Deleting your account

Sign in to GroceryWise and go to localhost:3093/account/delete. That sends us a deletion request, which our team reviews and processes within 30 days.

Until it's processed, the request holds your account id, your email address, the site you asked from, and your household choice, including the account id of the member you chose to hand it to.

When we process the request, we remove:

• your AllWise account: your sessions, your Google link and its tokens, your household memberships, the invitations you sent, and invitations addressed to your email;
• your households, as you chose when you asked: one you're the only member of is deleted; one you own with other members is handed to the member you picked or deleted, whichever you chose; otherwise you're removed and the household stays;
• your data on GroceryWise: your profile and your price-alert subscriptions, with their alerts and the record of alerts sent, including subscriptions on the email address you had verified.

We keep a record that the request was completed, with your account id, the site and your household choice but not your email address, so an old sign-in can't recreate your data. Any sign-in link we emailed you that hasn't been used is cancelled too.

Access, correction and complaints

To get a copy of what we hold about you, correct it, or make a privacy complaint, contact us using the form on our home page. For a request about your account, choose "Something else" and use the email address you sign in with, so we can find your account. If you're not satisfied with our answer, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

If this policy changes, we'll update this page and its effective date.