Shop

Privacy Policy

Last updated: 21 June 2026

1. Who We Are

Graft is a fitness tracking and community application developed and operated by We Discovr Ltd, a company registered in England and Wales ("We Discovr", "we", "us", or "our"). References to "Graft" throughout this Privacy Policy refer to We Discovr Ltd and its Graft product.

Our website is available at trygraft.net. If you have any questions about this policy or your data, contact us at: privacy@trygraft.net

2. What Data We Collect

2.1 Account Data

When you register for Graft, we collect:

  • Name and email address
  • Authentication credentials (password hash, or OAuth token if you sign in with Apple or Google)
  • Profile information you choose to provide (username, profile photo)

2.2 Fitness & Health Data

As a fitness application, Graft collects data you actively input, including:

  • Workout logs, exercise selections, sets, reps, and weights
  • Training streaks and milestone history
  • Personal records and progress metrics
  • Goals, programmes, and workout plans you create or follow

This constitutes health-related data under UK GDPR. We collect it solely to provide the core functionality of the app. We do not sell this data. We do not use it for advertising profiling.

2.3 Community & Social Data

If you participate in Clubs or community features, we collect:

  • Posts, comments, and content you publish within the app
  • Club membership and activity
  • Interactions with other users' content (likes, replies)

2.4 Clothing & Order Data

When you redeem streak rewards or purchase items from the Graft clothing line, we collect:

  • Shipping name and address (including international addresses)
  • Order history and redemption records
  • Clothing size preferences

Payment transactions are processed by third-party payment processors (such as Stripe or Apple Pay). We do not store full card details on our servers.

2.5 Technical & Usage Data

We automatically collect:

  • Device type, operating system, and app version
  • IP address and approximate location (country/region level)
  • Crash reports and error logs
  • Feature usage patterns (which screens you visit, which features you use)
  • Session duration and frequency

This data is used solely to maintain, improve, and debug the application.

2.6 AI Interaction Data

When you interact with the Graft AI coach, the content of your queries and the AI's responses may be processed and temporarily stored to provide the service. We do not use your AI conversations to train third-party AI models without your explicit consent.

3. Legal Basis for Processing (UK GDPR)

Graft is operated from the United Kingdom. We process your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For users in the European Economic Area (EEA), we also comply with EU GDPR requirements. Our legal bases for processing are:

  • Contract performance: processing your account data, fitness logs, and order data to deliver the services you have signed up for
  • Legitimate interests: processing technical and usage data to maintain app security, fix bugs, and improve performance
  • Consent: processing health-related fitness data and any optional marketing communications. You may withdraw consent at any time
  • Legal obligation: retaining certain transaction records as required by applicable UK law

4. How We Use Your Data

We use your data to:

  • Provide, maintain, and improve the Graft application and its features
  • Process clothing orders and manage reward redemptions linked to training streaks
  • Power the AI coach and exercise library features
  • Enable Club creation, community interaction, and social features
  • Send transactional communications (order confirmations, account notifications)
  • Send optional product updates and newsletters, only where you have opted in
  • Detect and prevent fraud, abuse, and violations of these policies
  • Comply with legal obligations

We do not sell your personal data to third parties. We do not use your data for targeted advertising.

5. Data Sharing

We share your data only in the following limited circumstances:

5.1 Service Providers

We use trusted third-party providers to operate Graft. These include:

  • Firebase / Google Cloud — authentication, database, and cloud infrastructure
  • RevenueCat — subscription and in-app purchase management
  • Print-on-demand fulfilment partners (e.g. Apliiq) — clothing production and shipping
  • Payment processors (e.g. Stripe, Apple Pay) — transaction processing
  • Analytics providers — aggregated, anonymised usage analytics

All service providers are bound by data processing agreements and may only use your data to perform services on our behalf.

5.2 Legal Requirements

We may disclose your data if required to do so by law, court order, or governmental authority, or where we believe disclosure is necessary to protect our legal rights or the safety of our users.

5.3 Business Transfers

If We Discovr Ltd is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you via email or prominent in-app notice before your data is transferred and becomes subject to a different privacy policy.

6. International Data Transfers

Graft is operated from the United Kingdom and serves users globally. Your data may be transferred to and processed in countries outside the UK, including the United States (where many of our cloud service providers operate). Where such transfers occur, we ensure appropriate safeguards are in place, including the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as applicable.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with services. Specifically:

  • Account and profile data: retained for the lifetime of your account, and deleted within 90 days of account deletion request
  • Fitness and workout data: retained for the lifetime of your account; exported or deleted upon request
  • Order and transaction records: retained for 7 years as required by applicable financial and tax regulations
  • Technical logs and crash reports: retained for up to 12 months
  • AI interaction data: retained for up to 30 days unless you have explicitly saved a session

8. Your Rights

Depending on your location, you have the following rights regarding your personal data:

  • Right of access: request a copy of the personal data we hold about you
  • Right to rectification: request correction of inaccurate or incomplete data
  • Right to erasure ('right to be forgotten'): request deletion of your personal data, subject to legal retention obligations
  • Right to restriction: request that we limit how we process your data
  • Right to data portability: receive your data in a structured, machine-readable format
  • Right to object: object to processing based on legitimate interests
  • Right to withdraw consent: withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at privacy@trygraft.net. We will respond within one calendar month as required by UK GDPR. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with your local data protection authority if you are located in the EEA.

9. Children's Privacy

Graft is not directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will delete that data promptly. If you believe we have inadvertently collected data from a child, please contact privacy@trygraft.net.

10. Security

We implement industry-standard security measures to protect your data, including encrypted data transmission (TLS), encrypted storage for sensitive fields, and access controls limiting who within our team can access user data. No system is completely secure; in the event of a data breach that affects your rights, we will notify you and relevant authorities as required by applicable law.

11. Cookies & Tracking

The Graft mobile application does not use cookies. Our website (trygraft.net) may use essential cookies for functionality and analytics cookies where you have consented. You can manage cookie preferences through your browser settings or our cookie consent tool on the website.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 14 days before the changes take effect. Continued use of Graft after that date constitutes acceptance of the updated policy.

13. Contact

For any privacy-related questions or to exercise your rights:

  • Email: privacy@trygraft.net
  • Website: trygraft.net

We Discovr Ltd — Graft Application — trygraft.net

Last updated: 21 June 2026