PRIVACY POLICY

Last updated: 2 August 2026

Graft League is a daily calisthenics and HIIT competition app. This policy explains what personal data we collect, why we collect it, and what you can do about it. We have tried to write it in plain English.

Who we are

Graft League is operated by DJH Associates Ltd ("we", "us"). We are the data controller for the personal data described in this policy. You can contact us about anything in this policy at privacy@graftleague.com.

What we collect

We deliberately collect as little as possible. When you use Graft League we hold:

• Your email address. Used to identify your account and to let you log back in.
• Your nickname. This is public — it appears on the leaderboard and to other members of your squad.
• Your PIN. Stored only as a one-way encrypted hash. We cannot see your PIN and cannot recover it for you.
• A login token. A random string that keeps you signed in on your device. It expires after 30 days.
• Your workout records. Which exercises you marked complete, and on what date.
• Your squad. Which squad you belong to, and whether you created it.
• Subscription status. If you subscribe to Pro, we store whether your subscription is active, along with reference identifiers provided by Stripe.

We do not collect your name, address, date of birth, location, or any health or fitness measurements beyond which exercises you ticked off. We do not use advertising trackers or analytics cookies.

Card payments

Payments for Graft League Pro are handled entirely by Stripe. Your card details are entered on Stripe's own checkout page and are never sent to or stored on our servers. We receive only a confirmation that a subscription has started, changed or ended, together with reference identifiers. Stripe's handling of your data is covered by Stripe's privacy policy.

What is stored on your device

We do not use cookies. We do store a few items in your browser's local storage, which stay on your device and are not shared with anyone:

• Your login token and nickname, so you do not have to sign in every time.
• Your chosen training plan and difficulty level.

Clearing your browser data, or logging out, removes these.

What other people can see

Graft League is a competition, so some information is shared by design:

• Your nickname, workout counts and streak appear on the leaderboard.
• Members of your squad can see your weekly and all-time totals.
• If the founder of your squad opts it into the public Squad League, the squad's name, number of members and weekly participation figures become publicly visible. Individual members are not named in the league table. Squads are private unless a founder chooses otherwise.

Your email address is never shown to other users.

Other services we rely on

• Google Fonts — our pages load fonts from Google's servers, which means Google receives your IP address as part of that request.
• Cloudflare CDN — used to load one library that generates your downloadable stats card. Same position: your IP address is visible to that request.
• Stripe — as described above.
• UKHost4u — our web hosting provider, whose servers store the database.

Where your data is held

Your account and workout data are stored on servers in the United Kingdom. Stripe and Google may process data outside the UK; both operate under safeguards intended to provide an equivalent level of protection.

How long we keep it

We keep your account and workout history for as long as your account exists, because your streak and all-time totals depend on it. If you ask us to delete your account, we remove your email address, nickname, PIN hash and workout records. Records we are required to keep for accounting purposes, such as payment references, are retained for six years.

Your rights

Under UK data protection law you have the right to ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. To exercise any of these, email privacy@graftleague.com and we will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.

Children

Graft League is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, please contact us and we will remove it.

Changes to this policy

If we change how we handle your data we will update this page and change the date at the top. Significant changes will be flagged in the app.

← Back to Graft League