Fossick Privacy Policy

1. About this policy

Fossick ("Fossick", "we", "us", "our") is an iOS app that helps thrifters and vintage resellers learn more about secondhand clothing and accessories. Fossick is operated by Mason Houlahan, a sole trader in Australia (ABN 65 597 343 830).

This policy explains what personal information we collect, why we collect it, who we share it with, how we protect it, and how you can access, correct or delete it. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy applies to the Fossick iOS app and to fossick.app. It took effect on 2 November 2026. The current version is always at fossick.app/privacy.

Contact us about privacy: support@fossick.app.

2. The short version

• We collect what we need to run Fossick: your email address, the name you choose, your quiz answers, the photos you scan and the Finds we generate from them.
• Your account, photos and Collection are stored in Sydney, Australia.
• Your photos are sent to our AI provider, Anthropic, in the United States for analysis. Usage analytics and crash reports go to providers in the United States, and sign-in emails are sent through a provider in Japan.
• We don't sell your information, show you ads, or track you across other companies' apps or websites.
• You can delete your account in the app at any time. That permanently deletes your account, photos and Finds from our systems (see section 11).

3. What we collect

Account information

• Email address. You sign in with a one-time code sent to your email, or with Sign in with Apple or Sign in with Google. If you use Apple's Hide My Email, we receive a private relay address rather than your real one.
• Name. You type it in, or it is prefilled from Apple or Google. It doesn't need to be your real name — a nickname is fine. Your name appears on any Find Card you choose to share ("Found by {name}").
• No passwords. Fossick doesn't use passwords, so we never collect or store one.
• No date of birth. We don't ask for your date of birth.
• When you agreed to our terms. We record the date and time you accepted our Terms of Use and this policy.

Onboarding quiz

When you set up Fossick we ask whether you've ever passed up something valuable, what you look for most, how often you thrift, how you decide whether something is worth buying, and your biggest thrifting frustration. From your answers we create a "thrifter profile" label. We store your answers and label with your account.

Photos and Finds

• Photos. Each scan includes up to 3 photos. Before a photo leaves your device, the app removes the image metadata — including GPS location and camera details — and resizes the image.
• Finds. We store the result of each scan (your "Find") and whether you've saved it to your Collection. Find Cards are created on your device when you share one — we don't keep a copy.
• Scans that don't produce a Find. If the item isn't something Fossick covers, we delete that scan's photos straight away and keep only a short record of the result. If a scan fails for a technical reason, or can't run (for example, because you're offline or have reached the daily limit), we keep its photos with your account so you can try again.
• People in photos. Photos sometimes capture people or surroundings, such as someone holding an item. Please avoid photographing other people where you can. We don't use photos to identify anyone.

Subscription information

Apple handles all payments, so we never see your card or bank details. Through our subscription provider, RevenueCat, we receive your subscription status (for example, whether you are in a free trial or subscribed). We store your subscription status and the date your current period ends.

Usage and device information

• Usage analytics. We record events such as onboarding screens viewed; scans started and completed (with the rarity tier, confidence level, item category and how long the scan took); items saved or shared; trial and purchase events; and account creation and deletion. These events are linked to a random internal user ID, not your name or email address. Our analytics provider also receives basic device information (such as device model, iOS and app versions, language and time zone). We've configured it not to store your IP address.
• Crash reports. If the app crashes or hits an error, we collect error details and device information (such as your device model and iOS and app versions), linked to the same internal user ID. Reports never include your email address or name, and we've configured our crash-reporting provider not to store IP addresses. We don't capture screenshots, and web address query strings are stripped.
• Scan count. We keep a count of your scans each day to apply our fair-use limit, and a record of the AI processing each scan used, so we can manage our costs.
• Technical logs. Like most online services, our providers record technical information — such as IP addresses, device type and your internal user ID — in sign-in and server logs. These logs are used for security and troubleshooting, and kept for a limited time.

When you contact us

If you email us, we receive your email address, your message and anything you attach. The in-app "Contact support" button pre-fills your email with your app version, device model, iOS version and internal user ID. You can see this information, and remove it, before you send.

Our website

fossick.app is a small set of information pages. It has no sign-up forms and doesn't use cookies or analytics. Our web host, Cloudflare, processes visitors' IP addresses to deliver the pages and protect the site.

What we don't collect

Fossick only asks for access to your camera and photo library. It doesn't use your location, microphone or Face ID. We may ask permission to send notifications, but we don't currently send any. We don't use advertising identifiers.

We don't ask for sensitive information (such as health, religious or political information). Please don't include it in your photos or messages to us.

4. How we collect it

We collect personal information:

• directly from you, when you sign up, complete the quiz, scan items or contact us;
• from Apple or Google, if you use their sign-in (your name and email address, or an Apple relay address);
• from Apple, through RevenueCat, about your subscription; and
• automatically through the app, for analytics, crash reporting and the fair-use limit.

If you don't give us your email address, we can't create your account. If you don't allow camera or photo library access, you won't be able to scan items.

5. How we use your information

We use personal information to:

• run Fossick — create your account, sign you in, analyse your photos, store your Finds and Collection, and generate Find Cards when you ask;
• manage your subscription — check whether you have access and apply the fair-use limit;
• personalise your setup — your quiz answers shape a personalised moment during onboarding;
• improve Fossick — we look at usage analytics and quiz answers in aggregate to understand how people use the app, and use crash reports to fix bugs;
• help you — respond to support requests and complaints; and
• keep Fossick safe and lawful — prevent misuse, enforce our Terms of Use and meet our legal obligations.

We don't sell your personal information, use it for advertising, or send you marketing emails. If we ever want to send you marketing, we'll ask first and every message will include an easy way to unsubscribe.

We only use your information for another purpose if you agree, or if the Privacy Act allows it (for example, where the law requires it).

6. AI and automated processing

Finds are generated by artificial intelligence. When you scan an item, your photos are sent to Anthropic's Claude AI models, which return the era, brand, rarity tier, estimated value range and other notes in your Find.

AI can get things wrong. A Find is an estimate only — not an appraisal or an authentication. See our Terms of Use for more.

Our fair-use limit is applied automatically. Fossick doesn't use automated processing to make decisions that significantly affect your rights or interests.

We don't use your photos or Finds to train AI models, or use your photos in our marketing, without your permission. Under Anthropic's commercial terms, Anthropic does not use the photos we send to train its models.

7. Who we share it with

We share personal information with service providers who help us run Fossick, only as needed for them to provide their service to us.

Apple and Google. If you use Sign in with Apple or Google, or subscribe through the App Store, Apple or Google handles that part under their own privacy policies.

Find Cards. When you share a Find Card, you choose where it goes and who sees it. The platform you share to handles it under its own policies.

We may also disclose personal information:

• where required or authorised by law (for example, to a court or regulator);
• to our professional advisers (such as a lawyer or accountant), who must keep it confidential; and
• if Fossick is transferred to another business (for example, a company set up to run Fossick), in which case the new owner must handle your information in line with this policy.

8. Sending information overseas

Your account, photos, Finds and Collection are stored in Sydney. Some personal information is disclosed to providers overseas, as set out in section 7:

• United States — Anthropic (photos for AI analysis), PostHog (usage analytics), Sentry (crash reports), RevenueCat (subscription status), Spacemail (emails you send to support@fossick.app), Cloudflare (website visitors' IP addresses) and Google (emails sent to the support address shown on Google's sign-in screen).
• Japan — Resend (your email address, to send sign-in codes).

Before we disclose personal information overseas, we take reasonable steps to make sure the recipient handles it consistently with the APPs. This includes choosing providers with appropriate security and agreeing to data protection terms with them. We remain responsible under the Privacy Act for how these providers handle your personal information.

Anthropic keeps the photos we send only for a limited period for safety and abuse monitoring, under its commercial terms.

9. How we protect it

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. These include:

• encrypting data in transit and at rest;
• storing photos privately, so only your account can access them, and showing them through links that expire quickly;
• access controls that limit each account to its own data;
• removing location and other metadata from photos on your device before upload;
• not using passwords, so there are none to steal; and
• sharing the minimum information our providers need, and keeping email addresses and names out of analytics and crash reports.

No system is completely secure. If a data breach is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

10. How long we keep it

• Account, photos, Finds, Collection and quiz answers — until you delete the item or your account. Photos from scans that failed or couldn't run are kept until you delete your account. If your subscription ends, we keep them so you can still view your Collection and pick up where you left off.
• Usage analytics — kept by PostHog only as long as we need them to understand how Fossick is used.
• Crash reports — deleted automatically by Sentry after 30 to 90 days.
• Photos sent to Anthropic — see section 8.
• Backups — deleted data may remain in our database provider's backups for a short time, until those backups expire.
• Support emails — kept only as long as we need them to help you and keep a record of our dealings with you.

We may keep some records for longer where the law requires it. When we no longer need personal information, we destroy it or de-identify it.

11. Deleting your account

You can delete your account in the app: go to Profile → Delete Account. If you haven't subscribed, use the Delete Account link at the bottom of the subscription screen. This permanently deletes your photos, scans, Collection, profile, quiz answers, subscription record, login and sign-in history.

Deleting your account doesn't cancel your Apple subscription. To stop being charged, cancel in your Apple ID's subscription settings. The app links you there.

Deleting your account doesn't delete records held by our analytics, crash-reporting and subscription providers. These records are linked only to a random internal user ID, not your name or email address. Usage analytics stay with PostHog, and subscription records stay with RevenueCat, until their retention periods end. Crash reports are deleted automatically by Sentry after 30 to 90 days; they aren't deleted individually on request. Find Cards you've already shared outside the app can't be recalled.

12. Accessing and correcting your information

You can see your Finds and Collection, and change your name, in the app. You can also ask us for access to the personal information we hold about you, or ask us to correct it, by emailing support@fossick.app.

• We'll respond within 30 days.
• Access is free.
• To protect your account, we'll ask you to email us from the address linked to your account, or verify your identity another way.
• In limited cases the Privacy Act allows us to refuse access or correction. If we do, we'll tell you why in writing and how to complain.
• If we don't correct information you think is wrong, you can ask us to attach a statement saying so, and we'll take reasonable steps to do that.

13. Questions and complaints

If you have a question or complaint about how we handle your personal information, email support@fossick.app with the details. We'll acknowledge it within 7 days and aim to respond within 30 days.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

• website: oaic.gov.au
• phone: 1300 363 992

The OAIC will usually expect you to have complained to us first.

14. Changes to this policy

We may update this policy from time to time. We'll post the new version at fossick.app/privacy with its effective date. If a change significantly affects how we handle your personal information, we'll tell you in the app or by email before it takes effect.