Privacy: what data we store and how to delete it

In short

For Telegram reminders: a Telegram chat id and your queue subscriptions.
For browser notifications: your browser’s technical subscription address and the queue you picked.
For a home power sensor: a secret token and a queue.
For discussions, likes and reports: an anonymous device identifier in a cookie.
The address you type to find a queue is not stored.
We do not ask for a name, phone number, e-mail, address or location.
Public data is aggregated to queue and region level. Nobody sees individual people’s signals.
Everything in Telegram is deleted with /forget.

What we store

If you use the Telegram bot

A Telegram chat id. Without it the bot cannot write to you.
Settings: language, quiet hours, whether you want restoration and emergency notices.
Subscriptions: operator, queue, reminder times. Optionally a label and a settlement. If you create a subscription from the site it may also carry free text you typed yourself. Do not put an exact address there: it is not needed.
A log of sent messages (so the same notice is not sent twice).
The single-use link from the site to the bot lasts 30 minutes and carries none of your data. The site does not learn who you are on Telegram, and the bot learns nothing about your browser.

If you switch on browser notifications

A Web Push subscription: the endpoint and keys your browser creates, the queue you picked, how many minutes before to warn you and quiet hours. It is not a name or an e-mail, but the subscription endpoint is a unique technical identifier of your browser.
The subscription is kept until you turn the switch off in the “Your home” block or the browser cancels it.
Your browser’s localStorage holds only a marker of which queue notifications are on for.

If you connect a power sensor

The sensor token (a secret shown once), the queue and the ping interval. The time of the latest pings is needed to notice when they stop.
We do not ask for an address, name or location. Individual sensors are never shown publicly, only aggregates of five or more sensors of one queue.
A sensor can be deleted by its token on the “Power sensor” page.

If you look up a queue by address

The region, city, street and house are sent only to work out the queue. We do not write them to the database or link them to you. Your browser stores only the queue number, exactly as with a manual choice.
To work out the queue our server asks an operator’s address service (currently Yasno for Kyiv and Dnipro). So the request passes through a third-party service with its own privacy policy.

If you use the website

An anonymous device cookie (sp_dev), HttpOnly. It is set the first time you write something: a post, a like, a complaint or a power report. The database holds only its hash and an internal “reputation” of the device used against spam.
Posts, likes and complaints in discussions, tied to that anonymous identifier.
“Power on” / “Power off” reports. Stored as a signal for a queue together with the device identifier, so that one device cannot “vote” many times.
Rate limits are counted per IP address, in server memory, to limit abuse, not in your profile.
Reading the map and pages needs no cookie.

What we publish

Queue and region states: aggregates built from operator schedules.
Signals only in aggregate, with a delay of at least 30 minutes and when at least five independent sources sent them. A single report is never shown on its own.
Discussions: posts under an arbitrary anonymous name. The system rejects posts about strikes or impacts, coordinates, phone numbers and links.
There are no substation or power line layers.

What we do not collect

A name, phone number, e-mail or payment details.
Device location.
Your home address (the address lookup only works out a queue and remembers nothing; everyone else simply picks a queue).
Advertising identifiers. The site has no advertising trackers.

How long we keep it

Signals used for the estimate (reports, sensor readings) are deleted automatically after 48 hours.
The bot’s sent-message log is deleted automatically after 14 days.
Single-use bot links are deleted after they expire.
Subscriptions and settings are kept until you delete them. The same goes for a Web Push subscription and a sensor token.
The history of queue and region states is aggregated, contains no personal data and is kept for the “time travel” feature.

How to delete your data

In the Telegram bot send /forget and confirm. Your subscriptions, settings, chat id and message log are deleted. If you change your mind, just write /start to the bot again. Single subscriptions can be removed in /my.

Browser notifications are switched off with the switch in the “Your home” block: the subscription is removed from our server and from the browser. A sensor is deleted by its token on the “Power sensor” page. If the token is lost and you no longer need the sensor, you can only replace it with a new one: the old one stops mattering once its pings stop.

You can delete the anonymous device cookie in your browser settings. After that, your earlier posts stay anonymous and no longer connected to you. We cannot link a post to a specific person, so there is no “delete my posts” button yet.

If you think a post breaks the rules (for instance it contains someone’s personal data), use the complaint button next to it: after a few complaints it is hidden automatically.

Third parties

Telegram. Bot messages travel through Telegram, which has its own privacy policy.
Your browser’s push service (Google, Mozilla, Apple or Microsoft). Browser notifications are delivered through it, so it sees that a message reached your browser and has its own privacy policy.
An operator’s address service (currently Yasno) handles the lookup of a queue by address.
The site’s fonts and scripts load from our own domain, with no external CDNs.
We do not sell data or hand it to advertisers.

Changes and questions

If the rules change, we will update this page. Questions about data are fastest solved with /forget and the “FAQ” page.