Privacy Policy

This policy explains what HomeGraft does with your personal data. We have tried to write it in plain English rather than legal padding. It is written for the UK and follows UK GDPR and the Data Protection Act 2018.

Who we are

HomeGraft (“we”, “us”) provides DIY guides and project tracking for UK homes. For the purposes of UK GDPR we are the data controller for the data described below. You can reach us at hello@homegraft.co.uk.

We are Mateusz Fedder trading as HomeGraft, at Flat 50/21 Hesperus Crossway, Edinburgh, EH5 1SL.

What we collect

We deliberately collect as little as we can.

• Your account. Your email address, a password (stored only as a secure hash — we never see it), and the first name you give us so we can say hello.
• Your saved projects. Which guides you have started, which steps you have ticked off, and any notes or measurements you add.
• AI usage.A count of the questions you ask the AI helper each month, so we can apply your plan's fair-use limit. We record that a question happened and what type it was.
• Payment records. If you pay us, we store your Stripe customer reference, which plan you are on, and when it renews or expires. We never see or store your card details — those go straight to Stripe.
• Technical data. Standard server logs from our hosting provider, such as IP address and browser type, kept for security and debugging.

Why we hold it, and our lawful basis

To give you an account and save your projects

Lawful basis: performance of a contract. Without this we cannot provide the service you signed up for.

To count AI questions and apply plan limits

Lawful basis: performance of a contract, and our legitimate interest in preventing abuse and runaway costs.

To take payment and manage subscriptions

Lawful basis: performance of a contract, and legal obligation for keeping financial records.

To keep the service secure and working

Lawful basis: legitimate interest in running a safe, reliable service.

Who else processes your data

We use a small number of suppliers who process data on our behalf. They are contractually bound to protect it and to use it only for what we ask them to do.

• Supabase — hosting, login and the database. Your account, projects and usage records live here.
• Vercel — hosting and delivery of the website itself, plus server logs.
• Stripe — payments. Stripe handles your card details directly as its own controller, under Stripe's privacy policy.
• Anthropic— the AI helper. When you ask the AI to explain a step, the text of that step and your question are sent to Anthropic's API to generate an answer. Please do not type personal or sensitive details into it.
• Google AdSense — the ads on the free plan. Google decides for itself what it does with the data it collects through those ads, so for advertising it acts as its own controller rather than on our behalf. See Cookies and advertising below.

Some of these suppliers process data outside the UK. Where that happens, transfers are covered by the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

Cookies and advertising

The cookies we set are strictly necessary ones: they keep you logged in and keep the payment flow secure. They are required for the site to work, so they do not need your consent under the Privacy and Electronic Communications Regulations (PECR).

Ads pay for the free plan. If you are on the free plan — or simply reading without an account — you may see ads served by Google AdSense. Google sets its own cookies and uses similar technology to show those ads, to measure them, to limit how often you see the same one, and to show personalised ads where you have agreed to that.

If you are in the UK or the EEA, Google's consent message appears first and asks what you agree to. You can change your answer at any time using the Cookie settings link at the bottom of any page.

Paid plans see no ads at all— Basic, Plus and Pro — and the advertising code is not loaded as you use the app. The one exception is these three legal pages (privacy, terms and disclosure): they are built as fixed pages that cannot tell who is visiting, so Google's script loads on them for everyone. There are no ads on them.

What Google does with what it collects is set out in how Google uses information from sites that use its services. You can review or switch off personalised ads in Google's ad settings.

Beyond advertising we run no third-party analytics or tracking pixels. If that changes we will update this page and name the provider.

How we count visits

We keep our own count of page views so we know which guides are useful. It is deliberately built so that it cannot identify you, and it does not put anything on your device — which is why there is no cookie banner asking about it.

For each page view we record:

• the page address, without anything after the “?”;
• the date and time;
• the country, worked out by our hosting provider from your connection before it reaches us;
• the domainyou arrived from, such as “google.com” — never the full address, so a search you typed is never stored;
• whether you are on a phone, tablet or computer;
• the family of browser, such as Chrome or Safari — no version or device detail;
• how long the page was open, sent when you close or leave it.

What we deliberately do not record:

• No cookies and nothing stored on your device for this.
• No visitor identifier. Two visits by you look exactly like visits by two different people. We cannot follow you from page to page, or from one day to the next.
• No IP address, not even a scrambled one.
• No full browser fingerprint.The detailed identifier your browser sends is read once to work out “phone” and “Chrome”, then thrown away.
• No link to your account. Page views are never tied to a user, logged in or not.

Because none of this identifies a person, it is not personal data, so the rights described below do not attach to it — there is nothing in it we could find and give you. Obvious robots are filtered out, and our own visits are not counted.

HomeGraft also stores data on your own device (in your browser's storage and offline cache) so the app works without a signal. That stays on your device, and signing out clears the cached pages.

Affiliate links

Where a guide lists materials, we show a short row of links to UK retailers. Some of those are affiliate links: they go through the affiliate network Awin, which sets a cookie in your browser when you click so the retailer can pay us a small commission if you buy — at no extra cost to you. The link also carries the name of the guide you clicked from, so we can see which guides help. The rest are plain searches and earn us nothing. A note beside the links says which is which, and so does our disclosure page. Clicking any of them takes you to that company, who then applies their own privacy policy and cookies. See our affiliate disclosure for the full detail.

How long we keep it

• Account and project data — for as long as your account is open, then deleted when you close it.
• AI usage records — up to 12 months, so monthly limits can be applied fairly.
• Payment records — 6 years, as UK tax law requires.
• Server logs — typically 30 days.

Your rights

Under UK GDPR you have the right to:

• ask what we hold about you, and get a copy of it;
• have anything wrong corrected;
• have your data deleted (the “right to be forgotten”);
• ask us to restrict or stop certain processing;
• object to processing we do on the legitimate-interest basis;
• ask for your data in a portable format.

To delete your account and data, email hello@homegraft.co.uk from the address on your account and say you want your account deleted. We will action it within 30 days and confirm when it is done. We will keep only what the law forces us to keep — the payment records described above.

There is no charge for any of this, and you do not have to give a reason.

Complaints

If you think we have handled your data badly, please tell us first at hello@homegraft.co.ukand we will try to put it right. You also have the right to complain to the UK regulator, the Information Commissioner's Office, at ico.org.uk.

Children

HomeGraft is not intended for under-16s and we do not knowingly collect their data.

Changes to this policy

If we change how we use data we will update this page and change the date at the top. Significant changes will be flagged in the app.