Privacy

Your home, your data

What we hold, what we cannot hold, and why the difference is in the design rather than in a promise. This page changes when the product does, and it is written from how the product is built today.

What never leaves your house

Who is home, and when. Presence is worked out on the panel and stays there. Our side is built to refuse it: a panel that tried to send when the house was empty would get an error, not a row.
The names of the people who live with you.
What your devices are doing, moment to moment. The panel keeps ninety days of its own readings on the wall, and those readings are never sent.
Your Wi-Fi password. It is not in a backup, which is why a replacement panel asks for it again.
What the panel has learned about your house — except sealed inside a backup, which we cannot open.

What we hold

Your name, email address, telephone number if you gave one, your account reference, and which panels are yours.
The address your panel was sent to, and its postcode.
What you told us about your energy: your electricity and gas suppliers, your tariffs and their rates, and when your cheap rate runs — so your panel arrives knowing what it costs to run your home.
Your MPAN and MPRN, if you gave them. They identify your electricity and gas supply points, and therefore your building. Both are optional. Neither is ever sent to your panel.
Your encrypted backups — as bytes we cannot open — and counts from them so you can tell one from another: 8 rooms, 14 devices, 6 automations. Never a name.
A record of when your panel last spoke to us, and which version it is running.

What your panel tells us, four times a day

Two things, and you can read exactly what was sent on your Panel page:

That it is learning: how many things it is watching, and since when. A count and a date, about the panel, not about you.
Any fault it has found with its own equipment — hall.sensor has not reported for 3 days. This is the one place a device name leaves the house, because a dead sensor is useless news without knowing which one.

It does not tell us how warm your rooms are, what your devices are doing, what a day cost, or what it suggests. Those are made on the panel and shown on the panel. We decided not to hold a summary of how you live any more than the detail, and our side refuses a panel that tries to send one.

We cannot read your backups

Each one is sealed on your panel before it is sent, with a key derived from a recovery key that we never see. There is no column in our database that could hold that key and no process here that has it. Since the backup now carries everything the panel has learned, that is the one copy of your house’s history outside your house — and it is as unreadable to us as it is to anybody who steals it.

This is not a policy we could quietly change. It is what the data is: a database stolen from us is a pile of bytes nobody can open.

What we write down about you

When you sign in, from which internet address, and whether it worked. The same for anybody who tries and fails, which is how we slow them down.
That you changed your details, never what you changed them to. When you change your sign-in address, the old one is kept only as a hint: r…n@example.com.
When a member of our staff did something to your account — assigned a panel, issued a password link — and which member of staff. Staff can see everything on this page. Staff cannot see or set your password, ever: there is nothing to see, because we keep only a hash of it.

What we do not do

No advertising, and no sharing with anybody who does it.
No analytics on this website. No cookie banner, because the only cookie is the one that keeps you signed in, and it is set only after you do.
No selling, ever. If that changes, we will have become a different company and you should leave.

Things we have not done yet

What we hold is not encrypted at rest. Your backups are — they are sealed on your panel with a key we never see — but your name, address, telephone number and tariff sit in an ordinary database. That mattered less when all we held was an email address. It matters more now, and it is the next thing to fix.

You cannot yet delete your account from this site. If you want it gone, ask us and a person will do it, including your backups. That should be a button, and it will be.

We do not send email. Password links and reset links are shown on a screen, to you or to a member of staff who then gives it to you.

This page describes how the product is built. It is not yet a formal privacy notice, and one is needed before we take anybody’s money. If you need the legal version today, ask us and you will get a straight answer about what exists.