Privacy Policy

1. Introduction

Shoe Sherlock is a service operated by Origae as a sole trader based in Victoria, Australia ("Shoe Sherlock", "we", "us", or "our"). We are committed to protecting your privacy and handling your personal information in an open and transparent manner.

This Privacy Policy applies to all personal information collected by Shoe Sherlock through our website at shoesherlock.com (the "Website"), our mobile application, and any related services (collectively, the "Services").

By using our Services, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use our Services.

2. Information We Collect

We collect different types of information depending on how you interact with our Services.

2.1 Information You Provide Directly

When you use our Services, you may provide us with:

• Account Information: When you create an account, you sign in using a third-party provider (currently Google or Apple). We receive your name and email address from that provider. We do not create or store passwords ourselves; your sign-in credentials are managed by your chosen provider.
• Quiz and Preference Data: Information you provide through our shoe finder quiz, including:
  • Activity types (e.g., running, walking, gym, HYROX)
  • Activity frequency and distance preferences
  • Terrain preferences
  • Shoe feature preferences (cushioning, stability, etc.)
  • Brand preferences
  • Budget range
• Physical Characteristics: Information you voluntarily provide such as:
  • Body weight range
  • Foot characteristics (arch type, width, etc.)
  • Gait patterns
  • Any injury history you choose to disclose
• Foot Photographs (Fit Scan): If you choose to use Fit Scan, you take three photographs of one foot — top-down, side-on, and the sole. We ask for your agreement before the camera opens, and the photos are sent to an AI provider for analysis. We never keep them. Section 4 sets out in full what happens to these photos, who sees them, and for how long.
• Payment Information: When you purchase a subscription on our website, payment information is collected and processed by our payment processor, Stripe. Purchases made within our iOS app are processed by Apple through In-App Purchase. In both cases we do not collect or store your complete card details on our servers.
• Communications: Information you provide when you contact us, including email correspondence and support requests.

2.2 Information Collected Automatically

When you use our Services, we automatically collect certain information, including:

• Device Information: Device type, operating system, browser type and version, unique device identifiers.
• Usage Information: Pages visited, features used, time spent on pages, click patterns, search queries, shoes viewed, and recommendations received. This includes session recordings of how you move through the screens (see section 3.4).
• Location Information: General location information derived from your IP address (country, state/region, city).
• Log Data: IP address, access times, referring URLs, and other standard server log information.

2.3 Cookies and Similar Technologies

We use cookies and similar technologies to collect information about your browsing activities. These technologies help us:

• Remember your preferences and settings;
• Understand how you use our Services;
• Improve our Services and user experience;
• Provide relevant content and recommendations;
• Analyse traffic and usage patterns.

You can control cookies through your browser settings. However, disabling cookies may affect the functionality of our Services.

PostHog and Vercel Analytics stay off, on the Website and in the app, until you accept analytics in the banner we show on first use. Declining, or not answering, leaves them off. Essential cookies, such as signing in and remembering your free Fit Scan, are not part of this choice and are always on. See section 10.1 for how long we remember your analytics choice itself.

When you start a payment after accepting analytics, we keep a short-lived marker in a MongoDB collection named purchase_links. Each marker is a SHA-256 hash of the Stripe Checkout Session id, the Stripe subscription id, or the App Store original transaction id, plus a granted flag and the time it was written. Markers are deleted after 90 days. They are used only to decide whether our servers may send a PostHog event for that payment. They hold no email, card number, or raw transaction id.

3. How We Use Your Information

We use your personal information for the following purposes:

3.1 Providing and Improving Our Services

• To provide personalised shoe recommendations based on your preferences;
• To analyse your Fit Scan photographs into an estimate of your foot shape, and to feed that estimate into your recommendations (see section 4);
• To create and manage your account;
• To process payments and provide premium features;
• To respond to your enquiries and provide customer support;
• To improve our recommendation algorithms and Services;
• To develop new features and services.

3.2 Communication

• To send you service-related notifications;
• To respond to your enquiries and requests;
• To send you marketing communications (with your consent, where required);
• To notify you of changes to our Services or policies.

3.3 Analytics and Research

We use PostHog (PostHog Inc., US cloud) for product analytics. It records pages viewed and app actions such as scans, results viewed and subscription steps, linked to a random or account id. It doesn't receive names, emails or photos, and IP addresses are anonymised. Section 3.4 explains how we use PostHog's session recording.

• To analyse usage patterns and trends;
• To conduct research and analysis to improve our Services;
• To generate aggregated, anonymised statistics;
• To understand user preferences and behaviour.

3.4 Session Recordings

We record some visits to the Shoe Sherlock website and app using PostHog's session recording. A session recording is a replay of how you moved through the screens: the pages you opened, where you tapped or clicked, how you scrolled, and what was on screen at the time. We use recordings only to improve the app, for example to see where people get stuck.

A recording starts only when we show you a Pro offer or paywall, and it covers the screens you view after that in the same visit. Visits that never reach a Pro offer are not recorded.

Some details are hidden on your device before a recording is sent, so they never appear in it:

• anything you type into a form field;
• your name, email address and profile picture;
• the physical characteristics you tell us about, including any foot issues or injuries;
• your Fit Scan photos and your Fit Scan results.

A recording can still show the other shoe finder answers you tap, such as activity, distance, location, budget and shoe preferences, and the shoes you look at.

Signing in happens on Google's or Apple's own screens, which we do not record.

If you are signed in, a recording is linked to your Shoe Sherlock account id. This is the id Google or Apple gives us for your account, not your name or email address. Because of this link, recordings are not anonymous. If you are not signed in, a recording is linked to a random id stored in your browser or app. If you later sign in on the same device, earlier recordings may become linked to your account.

PostHog stores recordings in its United States cloud and keeps them for 30 days, then deletes them. We do not sell recordings or use them for advertising.

There is no setting to turn recording off. You can ask us to delete your recordings at any time by emailing support@shoesherlock.com.

3.5 Security and Compliance

• To protect the security and integrity of our Services;
• To detect and prevent fraud or abuse;
• To comply with legal obligations;
• To enforce our Terms of Service.

3.6 Legal Basis for Processing

We process your personal information on the following legal bases:

• Consent: Where you have given us explicit consent;
• Contract: Where processing is necessary to perform our contract with you;
• Legitimate Interests: Where processing is necessary for our legitimate business interests, provided those interests do not override your rights;
• Legal Obligation: Where we are required to process your information by law.

4. Artificial Intelligence

One part of Shoe Sherlock uses artificial intelligence: the Fit Scan feature. This section explains what it does, because it involves photographs of your body and we think you should be able to understand it without a lawyer.

4.1 What Fit Scan Does

Fit Scan is optional. You photograph one foot three times — from above, from the side, and the sole. We send those three images to an AI model, which looks at the shape of your foot and estimates three things: your arch type (low, normal, or high), your foot width (narrow, standard, or wide), and your likely pronation. If you place a sheet of paper in the shot as a size reference, it may also estimate your foot length. We use that estimate to narrow down which shoes we recommend to you.

4.2 Which AI Provider We Use

We use OpenAI, a US based AI company. Your photos are sent to OpenAI's API over an encrypted connection. We make two requests: the first asks only whether the images actually show a human foot, and the second asks for the fit estimate. OpenAI is the only AI provider that receives your photographs or any other personal information from Shoe Sherlock. We also use AI tools on our own computers to read public shoe product pages when we build our shoe catalogue. Those tools are never given your photographs, account details or anything else you give us.

4.3 What Happens to Your Photos

This is the part that matters most, so we will be precise about it:

• We never keep them. Your photos exist in our server's memory only for the few seconds the analysis takes. They are never written to a database, a file, or any storage bucket, and we have no way to look at them afterwards.
• Once they reach OpenAI, OpenAI's terms apply, not ours. OpenAI receives your photos in order to analyse them. Per OpenAI's documentation, API data is not used to train its models by default. OpenAI may keep API data for up to 30 days for abuse monitoring, and flagged content may be retained longer. We do not control that retention and we cannot delete data from OpenAI's systems on your behalf. You can read OpenAI's current practices on its API data usage page, and we encourage you to do so before using Fit Scan.
• We do not train AI models on them. We do not build, train, or fine-tune any AI model of our own, not on your photos, and not on anything else you give us. Per OpenAI's documentation, data sent to its API is not used to train its models by default. See the API data usage page linked above.
• The result is not stored on our servers. The arch, width, and pronation estimate is returned to your device and kept in your browser for that session only. It is not saved to your account.

4.4 Fit Scan Is an Estimate, Not Medical Advice

Fit Scan is a guess made from three photographs. It is not a measurement, not a diagnosis, and not medical, podiatric, or health advice. It cannot detect an injury or a condition, and it should never be used in place of advice from a qualified health professional. Like any AI, it can be wrong. Treat the result as a starting point for choosing shoes, and trust how a shoe actually feels on your foot over anything our software tells you.

4.5 Your Choice

We ask for your agreement before the camera opens, and nothing is sent anywhere until you give it. Saying no is a real option, not a dead end: the ordinary shoe finder asks you questions instead of taking photos, and works well without a scan.

4.6 Automated Decision-Making

Our shoe recommendations themselves are not produced by AI. They are generated by our own scoring code, which compares your answers against published shoe specifications. We do not use automated processing to make any decision about you that has a legal effect or a similarly significant effect on you.

5. Information Sharing and Disclosure

We do not sell your personal information, and we do not share it with advertisers. We may share your personal information in the following circumstances:

5.1 Service Providers

We rely on a small number of third-party companies to run the service. Each one receives only what it needs to do its job. This is the complete list:

• OpenAI (United States) — receives your three Fit Scan photographs, and nothing else. It does not receive your name, email address, or account details. See section 4.
• MongoDB Atlas (cloud database) — stores your account record and your saved shoes. The account record holds your email address, your name, your subscription status, your payment provider reference, and counters we use to apply your monthly allowance. Your quiz answers and Fit Scan results are not stored here.
• Stripe — processes subscription payments made on our website. Stripe receives your payment details directly and your email address. We never receive or store your full card number.
• Apple — provides Sign in with Apple on the website and in the iOS app, processes subscription payments made inside the iOS app through In-App Purchase, and distributes the app. When you sign in with Apple we receive your name (only the first time you agree), an email address or a private relay address, and Apple's stable user id. We do not receive a profile picture from Apple. For purchases, Apple handles the transaction end to end; we receive only a reference confirming that a subscription is active.
• Google — provides sign-in on the web (Google OAuth). When you sign in this way, Google confirms your identity to us and gives us your name, email address, and profile picture.
• Vercel — hosts the website and runs our server code, so it processes anything that passes through the site, including your IP address and request logs. Vercel also provides our analytics, which measures page views without using cookies or building a profile of you.
• PostHog (United States): provides our product analytics and session recordings. It receives app events and session recordings, linked to a random id or your account id, with the details listed in section 3.4 hidden. It does not receive your name, email address or photos. See sections 3.3 and 3.4.
• Resend — sends our outbound email. It receives the recipient address and the contents of the message. If you use our contact form, Resend receives the name, email address, and message you typed into it.
• Zoho Mail — hosts the support mailbox that receives your email. If you write to us, the contents of that correspondence are stored in that mailbox.

These providers are bound by their own terms and privacy policies to protect your information and to use it only to provide their service to us.

5.2 Business Transfers

If Shoe Sherlock is involved in a merger, acquisition, sale of assets, or bankruptcy, your personal information may be transferred as part of that transaction. We will notify you of any change in ownership or uses of your personal information.

5.3 Legal Requirements

We may disclose your personal information if required to do so by law or if we believe that such action is necessary to:

• Comply with a legal obligation, court order, or legal process;
• Protect and defend our rights or property;
• Prevent or investigate possible wrongdoing;
• Protect the personal safety of users or the public;
• Protect against legal liability.

5.4 With Your Consent

We may share your information with other parties with your explicit consent.

5.5 Aggregated or De-identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify you with third parties for research, marketing, analytics, or other purposes.

6. Third-Party Services

Our Services may integrate with or contain links to third-party websites, products, or services. This Privacy Policy does not apply to those third parties. We are not responsible for the privacy practices of third parties, and we encourage you to read their privacy policies.

These are the third parties we use, and where to read what they do with data:

• OpenAI - For Fit Scan photo analysis. OpenAI Privacy Policy
• MongoDB Atlas - For account and saved shoe storage. MongoDB Privacy Policy
• Stripe - For payment processing on the web. Stripe Privacy Policy
• Vercel - For website hosting and privacy-friendly analytics. Vercel Privacy Policy
• PostHog: for product analytics and session recordings. PostHog Privacy Policy
• Apple - For iOS app distribution, In-App Purchase processing, and Sign in with Apple. Apple Privacy Policy
• Google - For account sign-in (Google OAuth). Google Privacy Policy
• Resend - For sending email. Resend Privacy Policy
• Zoho - For receiving support email. Zoho Privacy Policy

6.1 Sign in with Apple and Hide My Email

If you sign in with Apple, you can choose to hide your real email address. When you do, Apple gives us a relay address ending in @privaterelay.appleid.com instead. We store that relay address in place of your real one. It is a working address — email we send to it is forwarded to you by Apple — but we never see your real email address, and we cannot recover it.

Apple also gives us your name only once, the very first time you authorise the app, and never again. If your name is missing or wrong on your profile, you can set it yourself in your account settings.

We do not combine an Apple sign-in with a Google sign-in, even when the email addresses match. A private relay address is not your Google address, and we do not use it to find any other account. If the email Apple gives us is already used by another Shoe Sherlock account, we create a separate account and do not store that email address on it. If you then subscribe from that account, the email used at checkout is held by Stripe, our payment processor, and used for receipts and renewal reminders. Accounts created before we linked sign-ins to Apple or Google ids may be matched by email so that an existing subscription is not lost.

7. Data Storage and Security

7.1 What We Actually Store

We store less than you might expect. Our database holds exactly two things:

• Your account record: your email address, your name, a profile picture URL if your sign-in provider gave us one, a display name if you set one, your subscription status, a reference to your subscription at Stripe or Apple, and counters tracking how many tailored searches you have used this month.
• Your saved shoes: a list of which shoes you have saved, and when.

Some things are deliberately not stored on our servers. Your quiz answers, including any foot problems or injuries you tell us about, which is health information, are kept in this browser tab for your current visit and cleared when you close the tab. Your Fit Scan photos and the resulting estimate are never written to our database at all. We do not store passwords, because we do not have any: sign-in is handled entirely by Google or Apple.

Your personal information is stored and processed both in Australia and overseas. Section 12 sets out exactly where, and why.

7.2 Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using SSL/TLS;
• Encryption at rest of any personal information we store, where such data is retained;
• Delegating account authentication to established providers (Google and Apple) so that we do not hold your sign-in passwords;
• Access controls limiting who can access personal information;
• Ongoing review of our security practices.

At present we use token-based (JWT) sessions and rely on our infrastructure and payment providers (Vercel, Stripe, Apple, Google) to store and protect data on our behalf. However, no method of transmission over the Internet or electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

7.3 Data Retention and Deletion

We keep different things for different lengths of time. Here is how long each one lasts:

• Fit Scan photographs — never kept by us. They are held in memory for the few seconds the analysis takes and are never stored on our systems. OpenAI may keep that API data for up to 30 days for abuse monitoring, and flagged content may be retained longer. We do not control that retention. See section 4.3.
• Your account and saved shoes — until you delete them. We keep these for as long as your account exists. Delete your account and they go with it.
• Quiz answers: kept in this browser tab for your current visit and cleared when you close the tab. They are not stored on our servers. A session recording can show some of the answers you tap, but never your physical characteristics, foot issues or injuries (see section 3.4).
• Payment records — around 7 years. Stripe and Apple hold transaction records, and Australian tax law requires business records to be kept for five years from the date of the transaction. These survive account deletion because we are legally required to keep them.
• Support emails — as long as the mailbox holds them. If you write to us, that correspondence stays in our support mailbox unless you ask us to delete it.
• Server logs and website analytics: short term. Our hosting provider keeps these for its own standard periods, and they are not linked to your account.
• Product analytics: 1 year. PostHog keeps app events linked to a random id or to your account id (see section 3.3).
• Session recordings: 30 days. PostHog keeps session recordings for 30 days, then deletes them (see section 3.4).

7.4 How to Delete Your Account

You can delete your account yourself, at any time, from inside the app or website — you do not need to email us and wait. Open your profile and choose to delete your account.

When you do, we immediately and permanently:

• Delete your account record, including your email address and name;
• Delete every shoe you have saved;
• Cancel any active subscription you took out through Stripe;
• Sign you out and clear your session.

This cannot be undone, and we cannot restore a deleted account. Two things to be aware of: if you subscribed inside our iOS app, Apple manages that subscription, so you must also cancel it in your Settings → Apple Account → Subscriptions on your device — deleting your Shoe Sherlock account does not cancel an Apple subscription. And as noted above, payment records we are legally required to keep are retained.

Analytics events and session recordings held by PostHog are not deleted straight away when you delete your account. Session recordings are deleted after 30 days, and analytics events at the end of the period in section 7.3. If you would like them removed sooner, email us at support@shoesherlock.com and we will action it.

If you would rather we did it for you, or you want us to delete support correspondence as well, email us at support@shoesherlock.com and we will action it.

8. Your Rights Under the Privacy Act

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have certain rights regarding your personal information:

8.1 Access

You have the right to request access to the personal information we hold about you. We will respond to your request within a reasonable period (generally within 30 days). We may charge a reasonable fee to cover the cost of providing access.

8.2 Correction

You have the right to request that we correct any personal information we hold about you that is inaccurate, out-of-date, incomplete, irrelevant, or misleading. You can update much of your information directly through your account settings.

8.3 Complaints

If you believe we have breached the Australian Privacy Principles or mishandled your personal information, you have the right to lodge a complaint with us. We will investigate your complaint and respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

8.4 Opting Out of Marketing

You may opt out of receiving marketing communications from us at any time by:

• Clicking the "unsubscribe" link in any marketing email;
• Updating your communication preferences in your account settings;
• Contacting us at support@shoesherlock.com.

Please note that even if you opt out of marketing communications, we may still send you service-related messages that are necessary for the provision of our Services.

8.5 Account Deletion

You can delete your account and its data yourself, from inside the app or website, at any time. Section 7.4 explains exactly what happens when you do. You can also email us at support@shoesherlock.com if you would prefer we handled it.

9. Children's Privacy

Our Services are not intended for children under the age of 18. We do not knowingly collect personal information from children under 18. If you are under 18, you may only use our Services with the involvement and consent of a parent or legal guardian.

If we become aware that we have collected personal information from a child under 18 without parental consent, we will take steps to delete that information. If you believe we have collected information from a child under 18, please contact us immediately at support@shoesherlock.com.

10. Cookie Policy

This section provides additional information about our use of cookies and similar technologies.

10.1 Types of Cookies We Use

10.2 Managing Cookies

Most web browsers allow you to control cookies through their settings. You can:

• View what cookies are stored on your device;
• Delete all or specific cookies;
• Block all cookies or only third-party cookies;
• Set preferences for certain websites.

Please note that blocking or deleting cookies may affect the functionality of our Services and your user experience.

11. Do Not Track Signals

Some browsers send a Do Not Track or Global Privacy Control signal. The website and the app honour those signals: PostHog and Vercel Analytics stay off when either is present, even if you had previously accepted. There is no in-app analytics settings screen yet. To be asked again, clear this site's local storage, or wait up to six months for the stored choice to expire.

12. Overseas Disclosure

Australian Privacy Principle 8 requires us to tell you which countries your personal information is likely to go to. Shoe Sherlock is run from Victoria, Australia, but every company we rely on is based overseas, so your information does leave the country. Specifically:

• United States: OpenAI, which analyses your Fit Scan photographs. Also Stripe, Vercel, Apple, Google, Resend and PostHog (product analytics and session recordings, stored in PostHog's US cloud). Zoho Mail is a US-headquartered company; our mailbox is hosted in its Australian datacentre.
• United States and elsewhere — MongoDB Atlas, which hosts our database. Atlas operates datacentres in many regions, and your account record may be stored in or replicated to any region we have configured.

Some of these providers may in turn process data in other countries where they maintain infrastructure. Where we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it in a way consistent with the Australian Privacy Principles — in practice, by using established providers whose own terms commit them to comparable standards.

Please be aware that once your information is overseas it may be subject to that country's laws, including lawful access by its authorities, and Australian privacy law may not be enforceable against a recipient in every case. By using our Services and providing your personal information, you consent to this disclosure.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

• We will update the "Last updated" date at the top of this policy;
• For material changes, we will notify you by email or through a prominent notice on our Website;
• Your continued use of the Services after any changes constitutes your acceptance of the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your personal information.

On 18 October 2026 we changed the AI provider used for Fit Scan photographs to OpenAI, a US based AI company. Sections 4.2, 4.3, 5.1, 6, 7.3 and 12 now describe OpenAI. Per OpenAI's documentation, API data is not used to train its models by default. OpenAI may keep API data for up to 30 days for abuse monitoring, and flagged content may be retained longer.

On 10 October 2026 we updated section 5.1 and section 6.1 for Sign in with Apple on the website. Section 5.1 lists the name, email or private relay address, and user id we receive. Section 6.1 says that when an address is already on another account we create a separate account and do not store that email address on it, and that older accounts can still be matched by their email address. A notice at the top of this page records that update.

On 9 October 2026 we added section 3.4 (session recording), corrected our location to Victoria, removed marketing cookies we do not use, and stated that quiz answers are kept in this browser tab for your current visit and cleared when you close the tab. A notice at the top of this page records that update.

14. Notifiable Data Breaches Scheme

We comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988. In the event of a data breach that is likely to result in serious harm, we will:

• Assess the breach as soon as practicable;
• Notify affected individuals and the OAIC if required;
• Take steps to contain the breach and mitigate harm;
• Review and improve our security measures.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact our Privacy Officer:

We aim to respond to all privacy-related enquiries within 30 days.

16. Definitions

In this Privacy Policy:

• "Personal information" has the meaning given in the Privacy Act 1988 (Cth) and means information or an opinion about an identified individual, or an individual who is reasonably identifiable.
• "Sensitive information" means personal information about racial or ethnic origin, political opinions, religious beliefs, health information, or other categories specified in the Privacy Act.
• "Australian Privacy Principles" or "APPs" means the privacy principles set out in Schedule 1 of the Privacy Act 1988 (Cth).