We measure the basket, never the shopper

When a shopper submits a photo, the index records one thing: an item, a price band, a coarse area and a time. It is a property of a grocery line at a moment, not a record of who bought it. The shopper’s identity, loyalty number, payment method and full basket are never fields the schema carries, so they never enter the system.

A capture is of a shelf label or a total line, not a document about a person. Names on a receipt, card last-digits, loyalty and membership numbers, and any face or body in frame are masked at ingest, and image metadata (EXIF, precise GPS, device id, exact timestamp) is stripped before anything is kept. A payload that looks like an un-redacted personal document is refused at the validation boundary, not quietly stored.

What the ministry and the public see is a price band for an item in an area, computed across many independent submissions. No output ties a price to a named individual, and no submission is ever published as “this person paid this.” Contributor reports are tagged to a rotating, time-windowed pseudonym, so a shopper’s separate receipts cannot be strung into a profile — by anyone, including the operator.

An area only publishes a band once enough independent observations clear a k-anonymity floor. Below that floor it reads nothing — never a single store’s lone price that could effectively name and accuse one shop. The index describes where prices sit nationally; it is not evidence against a specific merchant, and enforcement due process is deliberately a separate, human track. Thin or lone data is designed to collapse to silence.

The reference implementation and any production instance are Malaysia-hosted and structured to satisfy the Personal Data Protection Act 2024 by construction rather than by clause: shopper identities are not collected, receipt personal data is redacted at the edge, and no cross-shop join key exists, so there is no consumer profile to disclose. Where the law asks for purpose limitation and minimisation, the architecture answers it before a policy has to.

During scoping and any first state-level reference basket, participating ministries, merchant chains and consented supply partners — and any early coverage or density figures — are named only with their consent. Area bands and merchant ground-truth feeds are reported without identifying any organisation that has not agreed to be named. Anonymity for the pilot cohort is a rule of the index, not a courtesy.

To ask how any field above is enforced in code, or to raise anything about the data the index handles, write to anharga@antrex.app or use the Antrex contact desk at antrex.app/contact.