Privacy
This follows the Australian Privacy Principles. Plain English version: we store as little as we can get away with, and nothing you don't already know about.
Using compare without an account
Searching a suburb and adjusting the table stores nothing on our servers. Your compare settings are saved in your browser's localStorage only, so they're there next time you visit on the same device and nowhere else.
Logging in
Signing in needs only an email address, used to send a sign-in link. There are no passwords to store or leak. Once logged in, we set a single session cookie so you don't have to log in again on that device. Logged-in accounts additionally get their compare settings and uploaded bill details saved against their account, so they follow you between devices.
Uploading a bill
You can upload a bill without logging in. We read your usage and rates off it to fill in the comparison, then delete the file. If we can't read it, we ask whether we can keep it to build a reader for that format. It is only kept if you say yes, it is never stored unencrypted, and it is deleted after 7 days.
Without logging in, we keep only a log of which retailer a bill was from and whether it could be read. If you're logged in, what we read is saved to your account so it shows on your account page. If you leave an email address to hear when an unreadable format is supported, it is used for that one message and nothing else.
Contact messages
A message sent through contact is stored with whatever you type, your email only if you choose to give it, and any files you attach, which are stored encrypted. It's read only so we can answer you, and never used for anything else.
What we don't do
No ad trackers, no advertising, and no selling of anything you give us; it goes only to the services listed below. We use privacy-respecting analytics to count page views and see which features get used. We set one cookie, for your session, and only once you log in.
Where your data is processed
Grid Rates runs on services based in the United States: Amazon Web Services (the server), Tigris (encrypted file storage), Cloudflare (network), Resend (sign-in emails), PostHog (page analytics) and hCaptcha (contact form spam checks). A bill you let us keep may also be processed by Anthropic's Claude while we build a reader for its format. The site itself uses no AI.
Deleting your data
Your account page has a delete option that removes your account and email address, saved compare settings and every bill you uploaded while logged in, extracted details included. Nothing is kept.