Privacy policy

homebattery.ie is a personal, non-commercial project built and operated by Alessio M. as the sole data controller. There is no company behind it.

For any data-protection question, request, or complaint, contact: [email protected].

When you upload a CSV, the following is sent to the server and stored: your half-hourly meter readings (consumption in kWh), the date range of the file, your MPRN (Meter Point Reference Number), and the solar setup parameters you enter (array size, orientation, tilt, supply phase). Optional future-usage adjustments (EV, heat pump, working from home, night-rate shift) are stored alongside.

Web requests pass through Cloudflare in front of the site. Cloudflare records IP address, user agent, and request URL for each request as part of operational logging — this is not under the control of homebattery.ie itself.

The origin servers (the Express API and the nginx in front of it) do not log IP addresses, user-agent strings, or referers. The nginx access log is configured with an anonymised format that records only the timestamp, HTTP method, request path, response status, response size, and request duration. The Express application emits no per-request log line at all. Request paths are kept for operational debugging; for report views this means the report UUID (which is itself the access credential for that report) may appear in the path. Container logs are ephemeral and rotate with the container lifecycle.

No account, name, postal address, or email is collected. Reports are accessed by a random UUID in the URL.

Separately from the anonymous CSV analyser, homebattery.ie offers an invite-only EV charge tracker for authenticated account holders. This is the only part of the site that uses a login. Accounts are created by invitation only — there is no public sign-up.

For each vehicle you add, the tracker stores its make, model, an optional nickname, and its registration plate. The registration plate is encrypted at rest using AES-256-GCM and is never stored in plaintext.

For each charge you log, the tracker stores the date, energy added (kWh), cost, start and end timestamps, a location label (e.g. "Home" or "Public"), and an optional free-text note. The note is encrypted at rest using AES-256-GCM; the other charge fields are stored in clear so they can be totalled and charted.

This data is held only for the duration of your account and is tied to your login, not to any anonymous report. It is processed on the basis of your consent in using the tracker, and you can ask for your account and all its vehicles and charges to be deleted at any time by emailing [email protected].

The data is processed solely to generate your battery and inverter sizing report. The legal basis is your consent (GDPR Art. 6(1)(a)) — by uploading your file you ask for the analysis to run. You can withdraw that consent at any time by emailing [email protected] with the report URL (which contains the UUID needed to locate your record) and asking for it to be deleted. If you no longer have the URL, the report will be deleted automatically after 90 days in any case.

The site is not used for marketing, profiling, or any automated decision-making with legal or similarly significant effect.

Reports — including the uploaded readings, MPRN, and solar inputs — are automatically deleted 90 days after upload. A scheduled job runs daily and hard-deletes any record older than that.

If you want your report deleted sooner, email [email protected] with the report URL — the UUID in that URL is the only way to match the request to your record, since no name, email, or other identifier is stored. Without it, the only option is to wait for the automatic 90-day deletion.

Cloudflare's server-log retention is set by Cloudflare's own policy and is outside the control of this site.

Your MPRN is encrypted at rest using AES-256-GCM with a per-record initialisation vector. It is never stored in plaintext. A separate keyed HMAC-SHA256 of the MPRN is used for duplicate detection without exposing the value.

The CSV readings, solar input, and report payload are also encrypted at rest at the application layer.

The site is served over HTTPS only.

Cloudflare — DNS resolution, TLS termination, and reverse-proxy/CDN. Cloudflare receives every HTTP request to homebattery.ie (including IP addresses) and may route traffic through datacentres outside the EU under their Standard Contractual Clauses. See cloudflare.com/privacypolicy for their policy.

No analytics, advertising, or tracking sub-processors are used. There is no Google Analytics, Plausible, Meta Pixel, or similar.

Under the GDPR you have the right to: access the personal data held about you; have it rectified if it is inaccurate; have it erased; restrict or object to its processing; receive it in a portable format; and not be subject to automated decision-making that has a significant effect on you (this site does not do that).

To exercise any of these rights, email [email protected]. Reports are identified solely by the UUID in their URL — please include it so the request can be matched to the right record. Without the UUID there is no way to look the record up, because no name, email, or other identifier is stored alongside it. Requests will be answered within one calendar month.

If you believe your data has been handled in breach of the GDPR, you have the right to lodge a complaint with the Irish Data Protection Commission:

Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland — dataprotection.ie.

This policy may be updated as the site changes. The most recent revision date is shown at the bottom of this page. Material changes will be reflected immediately here; there is no email list to notify because no contact details are stored.