Legal · LUKI by AFT

Privacy Policy

Last updated: 29 August 2026

LUKI is AFT's health and rewards app. This policy explains how AFT Group Australia handles information when you use LUKI, AFT Points features, or the AFT website.

LUKI uses health information only to provide movement and rewards features. We do not sell personal information, and we do not send Apple Health or Health Connect data to advertisers for advertising or targeting.

1. Scope and who we are

This policy applies to the LUKI mobile app (also described as “LUKI by AFT”), related AFT Points services, and the AFT Group Australia website. In this policy, “AFT”, “we”, “us” and “our” refer to AFT Group Australia and the service operators acting on its behalf.

AFT Points are in-app loyalty and rewards points. They are not money, a bank deposit, cryptocurrency, an investment, or a cash-withdrawal product.

2. Information we collect

Account and profile information

When you create or use an account, we may process your email address, display name, contact details, account identifiers, authentication and security records, language and notification preferences, and information you submit to customer support.

Health and activity information

With your permission, LUKI reads step and activity information from Apple HealthKit on iOS or Health Connect on Android. This may include step totals and the date and time associated with activity. LUKI uses this information to show movement progress, determine eligible walking rewards, prevent duplicate claims, and maintain the AFT Points ledger.

You can refuse or revoke health access in your device settings. LUKI does not write health data unless a feature clearly requests and obtains the required permission.

Rewards, invitations, redemptions and payments

We process AFT Points balances and ledger entries, walking and advertising reward claims, invitation codes and referral status, product redemption orders, delivery or collection choices, approved-merchant QR payment records, transaction identifiers, timestamps, status and fraud-prevention information.

Identity verification and camera information

If you choose or are required to complete identity verification, we may process your legal name, date of birth, address, identity-document details and images, and a selfie for manual review, account security and fraud prevention. Camera access may also be used to scan approved merchant QR codes. Photo and camera access are requested only when needed for these features.

Device, notification and technical information

We and our service providers may process device and app identifiers, push-notification tokens, operating system and app version, IP address, request times, diagnostic logs, crash information, security events and limited interaction information needed to operate, protect and improve the service.

Website and communications

If you contact us, we receive the information you provide, such as your name, email address and message. Our website host may process standard security and access logs. The current AFT website does not use advertising or cross-site tracking cookies.

3. How we use information

Provide and secure accounts and manage active device sessions.
Read eligible steps, display activity progress and issue walking rewards.
Maintain an accurate AFT Points balance and transaction ledger.
Provide optional rewarded advertisements and record completed rewards.
Operate invitations, product redemptions, orders and approved-merchant QR payments.
Deliver requested push notifications and service messages.
Review identity submissions, prevent abuse, investigate errors and protect users.
Respond to support and privacy requests and meet legal obligations.

4. Health information

Health information is used only for health, activity, app functionality, rewards integrity and related user-facing features. We do not sell health information, use it for advertising, or share it with advertising providers for targeting.

Health information is kept logically separate from advertising data. You control Apple HealthKit or Health Connect permissions through your device and may revoke them at any time. Revoking access may limit movement and walking-reward features.

5. Rewarded advertising

Watching a rewarded advertisement is optional. Google AdMob provides the advertising service and may process device, advertising, consent and ad-interaction information according to Google's terms and privacy practices. AFT records a reward only after the advertising service reports a completed eligible view. Health information is not provided to AdMob for advertising or targeting.

6. Service providers and disclosure

We do not sell personal information. We may disclose information to service providers only as needed to operate, secure and support LUKI and the AFT website, including:

Supabase for authentication, database, server functions and secure storage.
Expo for app build, update and push-notification services.
Google for AdMob rewarded advertising and Android Health Connect integration.
Apple for HealthKit, App Store and TestFlight services on iOS.
Cloudflare for website hosting, delivery and security.

We may also disclose information when required by law, to protect users or the service, or in connection with a business reorganisation subject to appropriate safeguards.

7. International processing

LUKI is intended for users in multiple countries. AFT and its service providers may process information in Australia, New Zealand, the United States, the European Economic Area and other locations where they operate. Where required, we use appropriate contractual, organisational and technical safeguards for international processing.

8. Retention and security

We keep information only for as long as reasonably necessary to provide the service, preserve the accuracy and integrity of the AFT Points ledger, prevent fraud, resolve disputes and meet legal obligations. Retention periods may differ by record type. Identity documents are retained only for the period required for review, security and applicable legal obligations.

We use reasonable technical and organisational safeguards, including access controls and protected network transmission. No internet transmission or storage method is completely secure.

9. Your choices and rights

You may refuse or revoke Health, camera, photo and notification permissions in your device settings. You may request access to, correction of, or deletion of personal information we hold, subject to identity verification and applicable legal exceptions.

You can request account deletion from the LUKI Security settings or contact us. When an account is deleted, some transaction, security or legal records may be retained where necessary, while access to the account is removed.

10. Children

LUKI and the AFT website are not directed to children under 13, and we do not knowingly collect personal information from children under 13. Where local law requires a higher minimum age or parental consent, those requirements apply.

11. Changes to this policy

We may update this policy as LUKI, our service providers or legal obligations change. The latest version will be published on this page with an updated date. Material changes may also be communicated in the app or through another appropriate channel.

12. Contact

For privacy questions, complaints, or requests to access, correct or delete information, email info@ausaft.com.