Privacy Policy

This policy explains what HomeGraft does with your personal data. We have tried to write it in plain English rather than legal padding. It is written for the UK and follows UK GDPR and the Data Protection Act 2018.

Who we are

HomeGraft (“we”, “us”) provides DIY guides and project tracking for UK homes. For the purposes of UK GDPR we are the data controller for the data described below. You can reach us at hello@homegraft.co.uk.

What we collect

We deliberately collect as little as we can.

• Your account. Your email address, a password (stored only as a secure hash — we never see it), and the first name you give us so we can say hello.
• Your saved projects. Which guides you have started, which steps you have ticked off, and any notes or measurements you add.
• AI usage.A count of the questions you ask the AI helper each month, so we can apply your plan's fair-use limit. We record that a question happened and what type it was.
• Payment records. If you pay us, we store your Stripe customer reference, which plan you are on, and when it renews or expires. We never see or store your card details — those go straight to Stripe.
• Technical data. Standard server logs from our hosting provider, such as IP address and browser type, kept for security and debugging.

Why we hold it, and our lawful basis

To give you an account and save your projects

Lawful basis: performance of a contract. Without this we cannot provide the service you signed up for.

To count AI questions and apply plan limits

Lawful basis: performance of a contract, and our legitimate interest in preventing abuse and runaway costs.

To take payment and manage subscriptions

Lawful basis: performance of a contract, and legal obligation for keeping financial records.

To keep the service secure and working

Lawful basis: legitimate interest in running a safe, reliable service.

Who else processes your data

We use a small number of suppliers who process data on our behalf. They are contractually bound to protect it and to use it only for what we ask them to do.

• Supabase — hosting, login and the database. Your account, projects and usage records live here.
• Vercel — hosting and delivery of the website itself, plus server logs.
• Stripe — payments. Stripe handles your card details directly as its own controller, under Stripe's privacy policy.
• Anthropic— the AI helper. When you ask the AI to explain a step, the text of that step and your question are sent to Anthropic's API to generate an answer. Please do not type personal or sensitive details into it.

Some of these suppliers process data outside the UK. Where that happens, transfers are covered by the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

Cookies and analytics

We use strictly necessary cookies only. These keep you logged in and keep the payment flow secure. They are required for the site to work, so they do not need your consent under the Privacy and Electronic Communications Regulations (PECR).

We do not currently run any third-party analytics, tracking pixels or advertising cookies. If that changes we will update this page, name the provider, and ask for your consent first where the law requires it. That includes advertising on the free plan: ad providers set their own cookies, and we will obtain consent before switching them on.

HomeGraft also stores data on your own device (in your browser's storage and offline cache) so the app works without a signal. That stays on your device, and signing out clears the cached pages.

Affiliate links

Some links to retailers such as Screwfix, B&Q, Toolstation and Amazon UK may be affiliate links, meaning we could earn a small commission if you buy something — at no extra cost to you. Clicking one takes you to the retailer, who then applies their own privacy policy and cookies. See our affiliate disclosure for the full detail.

How long we keep it

• Account and project data — for as long as your account is open, then deleted when you close it.
• AI usage records — up to 12 months, so monthly limits can be applied fairly.
• Payment records — 6 years, as UK tax law requires.
• Server logs — typically 30 days.

Your rights

Under UK GDPR you have the right to:

• ask what we hold about you, and get a copy of it;
• have anything wrong corrected;
• have your data deleted (the “right to be forgotten”);
• ask us to restrict or stop certain processing;
• object to processing we do on the legitimate-interest basis;
• ask for your data in a portable format.

To delete your account and data, email hello@homegraft.co.uk from the address on your account and say you want your account deleted. We will action it within 30 days and confirm when it is done. We will keep only what the law forces us to keep — the payment records described above.

There is no charge for any of this, and you do not have to give a reason.

Complaints

If you think we have handled your data badly, please tell us first at hello@homegraft.co.ukand we will try to put it right. You also have the right to complain to the UK regulator, the Information Commissioner's Office, at ico.org.uk.

Children

HomeGraft is not intended for under-16s and we do not knowingly collect their data.

Changes to this policy

If we change how we use data we will update this page and change the date at the top. Significant changes will be flagged in the app.