Privacy Policy

1. Information we collect

Account and sign-in information

If you create or use an account, we may process your email address, Supabase user identifier, email-confirmation status and basic profile information. If you choose Google Sign-In, Google may provide your name, email address, profile image and a Google account identifier. GraftTrack does not request access to your Gmail, Google Drive, contacts or other Google content.

Work information you choose to enter

GraftTrack can store information you enter to use the service, including shifts, dates and times, breaks, pay and overtime settings, sites, vehicles and plant, mileage and journeys, leave, reminders, notes and related settings. Signed-in users can synchronise this data to their GraftTrack account.

Documents and receipts

If you upload documents or images, such as checksheets, timesheets, vehicle checks or receipts, the file and its metadata may be stored in secure cloud storage when you are signed in. If you are not signed in, GraftTrack may keep only local metadata or a local preview on your device, depending on the feature used.

Feedback and support

If you send feedback or contact support, we may process your email address, message, selected category, relevant screen/app version and basic device information needed to diagnose problems. Emails sent to our support addresses may be forwarded or processed by our email providers.

Service and account activity

For signed-in accounts, GraftTrack may record limited operational information such as account creation/confirmation status, last-seen time, app version, last screen and basic device/browser information. We use this to operate the beta, support users, investigate faults and protect the service. It does not include your private shift, pay, notes, journey locations or document contents.

Basic and optional product analytics

Basic aggregate analytics are enabled by default unless you opt out. They use a temporary session identifier, app version, screen/feature names and product events such as opening a feature or completing onboarding. Basic analytics do not use a persistent browser identifier or your GraftTrack account ID. If you separately choose “Yes, help improve GraftTrack”, enhanced analytics may use a random persistent browser identifier and a simple signed-in/not-signed-in status so we can understand returning use and longer product journeys. Neither tier is designed to contain your wages, shift details, notes, journey start/end locations, receipt contents or uploaded document contents. You can turn basic analytics off and change the enhanced-analytics choice at any time from More → Legal & privacy.

2. Browser storage and similar technologies

GraftTrack uses browser storage that is necessary to remember your app data and settings, keep you signed in, maintain session state and support offline/PWA behaviour. Basic analytics use temporary session storage unless you opt out. Enhanced analytics may use local storage for a random persistent browser identifier only if you opt in. We do not use GraftTrack analytics for third-party advertising or cross-site behavioural advertising.

3. Why we use your information

• To provide the service and your account: to save, sync and display the information and features you ask GraftTrack to provide.
• To keep the service secure and reliable: to authenticate users, prevent abuse, diagnose faults, maintain backups and support users.
• To improve GraftTrack: to review feedback, basic aggregate service analytics and, where you opt in, enhanced product analytics.
• To communicate with you: for account confirmation, authentication, important service messages and replies to support requests.
• To comply with law: where we are required to keep or disclose information by law.

Where UK data-protection law applies, our lawful bases may include performance of a contract or steps you ask us to take before entering one, our legitimate interests in operating, securing and understanding aggregate use of GraftTrack, your consent where enhanced analytics rely on it, and compliance with legal obligations.

4. Who we use to provide GraftTrack

We use service providers to operate GraftTrack. Depending on the feature you use, these may include:

• Supabase — authentication, database, cloud storage and server-side functions.
• Netlify — hosting and delivery of grafttrack.co.uk.
• Resend — transactional email delivery, such as account emails.
• Google — optional Google Sign-In and OAuth infrastructure.
• ImprovMX — forwarding email sent to certain GraftTrack addresses.

These providers process information under their own security and privacy arrangements and may process data in countries outside the UK. Where required, appropriate transfer safeguards are used by us or our service providers.

5. Sharing

We do not sell your personal information. We do not provide advertisers with your GraftTrack work records. We may share information with the service providers above where needed to operate GraftTrack, with professional advisers where necessary, or with authorities when required by law.

6. How long we keep information

We keep information only for as long as reasonably necessary for the purpose for which it was collected. Local app data remains on your device until you remove it, clear browser/app storage or replace it. Account and cloud-synchronised data may remain while your account is active and until it is deleted or a valid deletion request is completed. Feedback, operational records and optional analytics are periodically reviewed and kept only while they remain useful for support, security, service operation or product improvement. Limited copies may persist for a short period in provider backups or logs.

7. Security

We use technical and organisational safeguards appropriate to a beta web application, including authenticated access, row-level database controls, HTTPS, restricted cloud-storage access and time-limited signed links for uploaded documents. No internet service can guarantee absolute security, so you should also protect your account credentials and device.

8. Your choices and rights

Depending on the law that applies to you, you may have rights to access, correct, erase or restrict personal information, object to certain processing, receive a portable copy of information you provided, and withdraw consent where processing relies on consent. Turning off basic analytics stops future analytics from that browser. Turning off enhanced analytics clears the persistent analytics identifier from that browser and stops future enhanced tracking; it does not automatically erase aggregate events already collected.

To exercise a privacy right or request account/cloud-data deletion, email privacy@grafttrack.co.uk. We may need to verify your identity before acting on a request.

9. Children

GraftTrack is designed as a work-recording and earnings tool and is not directed to young children. If you believe a child has provided personal information inappropriately, contact us so we can review it.

10. Complaints

Please contact us first if you have a privacy concern. If UK data-protection law applies, you also have the right to complain to the Information Commissioner’s Office (ICO). See ico.org.uk/make-a-complaint.

11. Changes to this policy

We may update this policy as GraftTrack develops. We will change the “Last updated” date above and, where appropriate, give users additional notice of significant changes.