How we handle your data
Solar Forecast UK is free to use. We do not and will not sell personal data, show behavioural advertising or use your activity to build cross-site profiles.
Our privacy commitment
We do not create or store an advertising ID or persistent visitor ID, link browsing activity to your email address, record browsing sessions, or track you across other websites. We do not and will not sell personal data.
The service still receives ordinary connection data such as an IP address and browser user-agent while handling a request. We use that transiently for security, rate limiting and privacy-preserving daily aggregate statistics as described below.
Public forecast
The postcode and system details you submit are used to calculate that forecast and are not written to the account database. The server sends the postcode to Postcodes.io to resolve coordinates, then sends coordinates and panel geometry to Open-Meteo. Those weather requests do not include your email address or account ID.
Save-after-signup convenience
If an anonymous visitor chooses to save a forecast, that forecast setup is kept temporarily in that browser for up to 90 minutes so it can be recovered after email verification. It is not written to our database until the signed-in user explicitly saves it.
Saved installations
When you save an installation, the full postcode is used for the location lookup and then discarded. PostgreSQL retains the postcode district, approximate area, coordinates rounded to two decimal places and the PV configuration needed to forecast the system.
Accounts and security
Better Auth handles email/password authentication and sessions in a separate PostgreSQL schema. Passwords are hashed by the authentication library; this application does not store plaintext passwords. Email verification is required, password reset revokes existing sessions, and protected queries always include the authenticated user ID.
Anonymous service statistics
We keep aggregate counts such as page views, forecast requests and approximate daily unique visitors to improve the site. We do not build visitor profiles or link this activity to registered accounts. For daily deduplication, the server creates a one-day HMAC from coarse network/browser information; the short-lived hashes are deleted after the reporting day while only aggregate counts remain.
Appearance preference
If you choose light, dark or system appearance, that preference is stored locally in your browser as sf_theme. It is not sent to an advertising or analytics provider.
Developer API keys
API keys are generated from cryptographically random bytes. PostgreSQL stores a one-way SHA-256 hash and a short display prefix, not the usable plaintext key. A newly created key is shown once and can be revoked independently.
Forecast notifications
Forecast updates are opt-in service messages. Email is available by default. If you choose Pushover, your Pushover User Key is encrypted in our database and is sent with notification content to Pushover only when delivering a message you requested. Marketing, if ever introduced, will use a separate preference.
Feedback and issue reports
Feedback submissions are stored so administrators can review them. Signed-in submissions are linked to your account and are included in account export/deletion. Anonymous submitters can optionally provide an email address if they want a reply. Turnstile and rate limits are used to reduce automated spam.
Data sources and attribution
Forecast weather and solar-radiation data is provided by Open-Meteo under CC BY 4.0. Great Britain live solar-generation estimates are provided by PV_Live by Sheffield Solar, also under CC BY 4.0. UK postcode lookup uses Postcodes.io. Grid-demand context uses public data from Elexon. These external services receive only the data needed for the relevant request; weather requests do not receive your email address or account ID.
Your controls
The account area provides machine-readable export and self-service hard deletion. The production privacy notice still needs the controller identity/contact details, processor list, concrete retention periods, lawful bases and any international-transfer information before public launch.