Privacy policy
Who we are
SunHarvest connects to your Tesla Powerwall, with your consent, through Tesla's Fleet API. It shows you what your home energy system is doing and runs the automations and AI plans you set up. SunHarvest is the data controller for the information described below.
What we collect
- Account: your email address and a hashed password (never the password itself), plus your two-factor secret if you enable 2FA.
- Powerwall data: live power flows, battery level, system settings and their change history, and your site's daily energy ledger. These are collected continuously while your Tesla account is connected.
- Site location: latitude/longitude and solar-array geometry, only if you enter them. They are used to fetch local weather and solar forecasts and are stored encrypted.
- Tariffs and automations: the tariff presets, electricity price sources and automation rules you create.
- AI mode: your written goal, the plans generated from it, the daily scores of how those plans performed, and the AI provider keys you add, stored encrypted.
- EV charger, only if you link one: the sign-in details its maker requires (stored encrypted), the charger's name and its latest reading.
- Local gateway (Android app, Powerwall 3, optional): a key your phone uses to read the Powerwall on your home network, the phone's name, the gateway's identifier and local address, and per-string solar readings. To find the gateway, the app looks for it on your home network. The gateway password stays on your phone.
- Preferences and suggestions: your language, currency and dashboard layout, and any suggestions you send us from the app.
- Subscription: if you subscribe to Pro, the Stripe customer and subscription references and the subscription's status and renewal date. Card details go to Stripe, never to us.
- Consents: a record of when you accepted this policy and the Tesla connection notice.
What we do with it
Everything above exists to run the product for you: the dashboard, history and money views, forecasts, automations and AI planning.
We do not sell your data, we do not use it to target advertising, and we do not build profiles beyond what the features you use require. The ads that Free and trial accounts see (below) are chosen without any of it.
Who else sees data
- Tesla: the connection works through Tesla's Fleet API under the Tesla Privacy Notice. You can revoke SunHarvest's access at any time from your Tesla account.
- Weather service: Open-Meteo receives only your site coordinates, to return local weather and solar-radiation forecasts. SunHarvest then estimates solar output itself; your array details go to no one.
- AI provider: when AI mode runs a plan, a summary of your site is sent to the model provider you configure with your own API key: recent energy data, the Powerwall's settings, tariff prices, your rules and past plans, forecasts, the EV charger's state and your goal text. That can be Google Gemini, Anthropic Claude, OpenAI or a compatible service of your choice. AI mode does nothing until you add a key. That provider processes the data under your own agreement with them, and free tiers may use it for model training. Your email, location and account details are never included.
- EV charger maker: if you link a charger, its sign-in details go only to its maker (myenergi, Easee or Zaptec), to read the charger about once a minute.
- Electricity prices: price lookups (e.g. Octopus Agile) are public queries that carry nothing personal.
- Payments: Pro subscriptions are handled by Stripe, which receives your email address and an account reference to set up the subscription. SunHarvest never sees or stores your card details.
- Email: account emails (confirming your address, resetting your password) are sent through our email provider, Resend, which receives your email address to deliver them.
- Hosting and network: traffic to SunHarvest passes through Cloudflare, which sees your IP address as any website's network provider does.
Advertising
Accounts on the Free plan see a small ad on each screen and, now and then, one between screens. Trial accounts see only the small ones, and Pro accounts see none. On this website, the articles under Learn show ads as well, to every reader; the other public pages, like this one, show none.
On the web, and on this website, every ad is SunHarvest's own card for SunHarvest Pro: no advertising network is involved, no advertising code is loaded and nothing is set or read on your device for it. In the Android app the ads are served by Google AdMob, under Google's advertising policy. Google may read device identifiers to serve and measure ads and, only with your consent, to personalise them. Nothing SunHarvest holds about you, not your email and not your energy data, is passed to Google.
In the UK, the EEA and Switzerland, Google asks first in the Android app with its own consent dialog, and you can decline personalised ads there. To change your answer later, open the privacy policy from inside the app, which has a link that reopens the consent dialog. Pro accounts, which see no ads, load no advertising code inside the app at all.
Stored on your device
None of these is a tracking cookie:
- your sign-in session, removed when you sign out;
- your appearance, language and currency choices, which stay on the device;
- on Android, the home-screen widget's settings and the last figures it showed, and, if you use the local gateway, its password and your phone's key.
On the web, Google's advertising code may add its own cookies inside the signed-in app and on the articles under Learn, as described above.
Logs
Like any web service, our servers keep technical logs to run and secure SunHarvest. They include IP addresses and, for account events such as signing in or deleting an account, the email address involved. They are used only for security and troubleshooting.
Retention and deletion
- Your data is kept while your account exists, so history and comparisons keep working.
- Disconnecting Tesla stops collection from your Powerwall immediately; existing history stays until you remove it. A linked EV charger is read until you unlink it under Settings › Site.
- Delete history (Settings › Data) permanently removes recorded data for any date range, at any time. Days in roughly the last week are fetched again from Tesla while your Powerwall is connected.
- Delete account (Settings › Data) permanently removes your account and everything in it, immediately. One billing record survives, with no energy data in it: every email address the account used, when the trial was used, the Stripe customer reference, and the identifiers of every Powerwall site that was connected, with the dates each was first seen. It exists so a trial cannot be taken twice and payments can be accounted for. Stripe also keeps its own record of any payments. The delete your account page has the full list of what goes and what stays, and how to ask by email if you can no longer sign in.
Security
All traffic is encrypted in transit (TLS). Tesla tokens, site coordinates, AI provider keys and EV charger sign-ins are encrypted at rest, and passwords are stored only as hashes. Access to the server hosting your data is restricted to the operator.
Your rights
You can access your data in the app, correct your account details, and delete anything, ranges or everything, yourself, without asking. UK/EU data-protection law also gives you rights of access, correction and erasure, and the right to complain to the ICO or your local authority.
Contact
Questions or requests: [email protected]. See also Contact and the terms of service.
If this policy changes materially, the version number and date above change.