Privacy

Who we are

Snugdays is run by Rob Hutchin, a sole trader trading as Snugdays, at [business address to confirm]. Snugdays is the controller of your personal data. Registration with the Information Commissioner's Office is [pending — number to confirm], and the number will be shown here. Contact us about anything on this page at info@cosydays.co.uk.

Independent app. Not affiliated with or endorsed by Octopus Energy. Octopus is a separate controller of the data it holds about you, under its own privacy notice.

What we collect and why

UK GDPR needs a lawful basis for each use. Ours are contract (we need it to provide the app you signed up for), legitimate interests (keeping the service secure and working, balanced against your rights), consent (which you can withdraw at any time) and legal obligation.

Your account Contract

Your email address, and your Google or Apple sign-in ID if you use one, held by Amazon Cognito. Used to sign you in and to contact you about your account. Snugdays never sees your password or your Google or Apple credentials.

Your Octopus connection Contract

Your Octopus Energy account number and API key. The key is encrypted before it is stored and is used only to call Octopus Energy's own API on your behalf — to read your heat pump and meter, including overnight, and to send the changes you make. It is never shown to anyone, including people you link.

Heat pump and meter readings Contract

Collected on a schedule for as long as your account is connected:

• Half-hourly snapshots — flow and return temperatures, room temperature and target per zone, hot water, mode, COP and the controller's own status.
• Half-hourly electricity use from your smart meter.
• Octopus Energy's hourly heat-pump history — electricity in, heat out and outdoor temperature — which reaches back roughly thirteen months.
• Your schedules, settings, unit rates and standing charges, so costs are your real costs rather than an average.

Outdoor temperature comes from your heat pump's own sensor, through Octopus. We don't use a weather service, and we don't take your address or postcode from Octopus. Smart meter readings can show when a home is occupied, so we treat all of this as personal data.

Changes you log Contract

Changes you record — "turned the flow temperature down to 40°" and the like — with any note you add. These are what every verdict is worked out from.

Linked people Contract · legitimate interests

The email of anyone you invite to use your home, and their sign-in. Used to give them access. Please only invite people who have agreed to it.

Written checks Contract

When you ask for one, your daily figures for the period you chose — energy, heat, COP, cost, temperatures — and any question you type are sent to Anthropic's Claude model, which runs on Amazon Bedrock in AWS's Ireland region. Your name, email, address, account number and API key are not part of it. Amazon Bedrock does not use what is sent to train models.

Security and support records Legitimate interests

Sign-in times, errors, and a log of admin actions on your account. Used to keep accounts safe and to answer your queries. If error reporting is switched on, errors go to Sentry, scrubbed first, with personally identifying data switched off and session replay and screenshots disabled.

"Tell me when it opens" Consent

If you give your email on the landing page's Tell me when it opens form, it is kept only to tell you when Snugdays opens. It is held in a Google Sheet, with Google as our processor, alongside the time and which form you used, and each signup sends one notification email to info@cosydays.co.uk. We send one email when Snugdays opens and then delete your address unless you sign up. We delete it sooner if you ask — email info@cosydays.co.uk.

Payments, once checkout opens Contract · legal obligation

There is no checkout today, and no card details are collected. When one opens, your plan, dates and payment records will be kept, and card details will be held by our payment provider, never by us — [Stripe, to confirm]. We will name it here before checkout opens.

Comparing with similar homes, coming later

Not offered in the app and not collected for new homes today. If we add it, it will be off unless you turn it on. What we plan.

Who else handles it

We use a small number of suppliers (processors) who handle data only on our instructions, under a written contract:

• Amazon Web Services — hosting and storage in the London region (eu-west-2), sign-in (Amazon Cognito), and account emails (Amazon SES, London).
• Anthropic, through Amazon Bedrock — written checks, by language model, run in AWS's Ireland region (eu-west-1).
• Google — Sign in with Google, and the "Tell me when it opens" sheet.
• Apple — Sign in with Apple.
• Sentry — error reports, if switched on for the deployment you use. [region to confirm]
• OpenAI — [to confirm] named for written checks in the draft notice; the app does not send anything to OpenAI today.
• Stripe — payments, once checkout opens. [to confirm]

We also exchange data with Octopus Energy through its API, using the key you give us. Beyond that, we only share personal data if the law requires it, or with a buyer or successor if Snugdays were sold or became a company, who would have to keep to this notice.

Outside the UK. Your data is stored in the UK. Written checks are processed in Ireland, which UK law treats as adequate. Google and Apple may handle sign-in and waiting-list data in other countries, including the US. Where they do, we rely on the safeguards UK law requires: the UK–US data bridge, or the UK International Data Transfer Agreement or Addendum.

Security. Data is encrypted in transit and at rest, and your Octopus key is encrypted separately. Only a small number of named people can reach accounts, and every admin action is logged. If a breach puts your rights at risk, we will tell you and the ICO as the law requires.

How long we keep it

Account and readings

While your account is open

After you delete your account

Deleted straight away

Backups

Roll off within 35 days, and nothing is restored from them for a deleted account

After you disconnect Octopus

Key deleted at once; readings kept so your history survives a reconnection

Admin audit log

An account ID and the action only, never your email. [6 years, to confirm]

Payment records

None today; 6 years for tax once checkout opens

"Tell me when it opens" email

Until the launch email, then deleted — sooner on request

Readings are kept while your account exists because the point of the app is comparison across seasons and years — a history deleted after ninety days cannot answer "is this winter better than last".

[to confirm] Planned, not yet automated: if you don't use Snugdays for 18 months, we email you twice, then close the account if you don't reply. Today an account stays until you delete it.

Your rights

• See it. Ask for a copy of the personal data we hold about you.
• Correct it. Fix anything that's wrong. Most of it you can change in Settings.
• Delete it. Delete your account in the app, or ask us to.
• Take it with you. Get your readings in a standard file, whatever your plan.
• Object or limit. Object to any use based on legitimate interests, or ask us to pause using your data while a query is settled.
• Withdraw consent. Turn off notifications in Settings, or ask us to remove your waiting-list email, any time.
• Disconnect Octopus. Remove the key in Settings → Octopus connection, or revoke it in your Octopus account, and we stop reading straight away.
• Complain. Tell us first and we'll put it right if we can. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Snugdays is for people aged 18 and over, and we don't knowingly collect data from children. If this notice changes in a way that matters, we will tell you before the change takes effect.

How to delete or download your data

Download it

1. On Snugdays+, open Trends, choose Export, pick the period and share the file.
2. On any plan, for everything we hold including account details, tap Settings → Privacy & about → Email me a copy of my data, or email info@cosydays.co.uk. We send it within one month, free.

Delete it

1. Download anything you want to keep first. Deleting can't be undone.
2. Go to Settings → Account → Email & sign-in → Delete your account, and confirm. Or email us and we will do it for you.
3. It happens straight away: your Octopus key, readings, changes and comparisons are erased, anyone linked to your home loses access, every sign-in attached to the account is removed, and you are signed out.

What stays: an account ID in the admin audit log, and, once checkout opens, payment records we must keep for tax. Nothing else is kept.

Linked people can leave a home from their own Settings. That removes their access, not the holder's data.

Figures used to improve estimates

What we plan to take out before any figure is used:

• Your name, email and Octopus details.
• Your address, meter and device IDs.
• Your full postcode. At most the area would be kept, for example SW1.
• Exact times that could show when you're home. Figures would be rounded to the day.
• Costs, tariff, bills and payment details.

What would be left: daily electricity in, heat out and COP (heat out divided by electricity in), with the outdoor temperature, flow settings and heat pump model, under a random code. Only we would hold the link between that code and your account, so we could delete the figures when you leave. It would be used to make our estimates better, never sold, and nothing built from it would be shown to anyone unless it drew on at least 10 homes.

Because the code could be linked back to your account, these figures would still be personal data, protected as such and used under legitimate interests, which you could object to at any time — by switching it off in Settings → Privacy & about or by emailing us.

Comparing with similar homes (coming later)

We may later let you see how your heat pump compares with similar homes. It isn't offered in the app today. If we add it, it will be off unless you turn it on, only monthly figures would be shared — COP, electricity in and heat out, never cost — and no group figure would be shown until enough homes are in it that yours can't be picked out. We will update this page and email you before it opens.

Where Settings → Privacy & about offers Compare with similar homes (off by default), switching it on records your consent ahead of time. Nothing is shared for it until the comparison opens, and switching it off withdraws that consent.

An earlier version of the app offered a similar-homes comparison. If you joined it, your contribution is still held until you leave, and deleting your account removes it. Email us and we will remove it for you.

Cookies

Under PECR, storage that is strictly necessary doesn't need your consent, which is why there's no cookie banner. If we ever add anything that isn't essential, we will ask first, with an equally clear choice to say no, and list it here.

Sign-in session

Up to 7 days, or until you sign out

A signed-in marker, so the app knows to refresh the session

The same as the session

Sign-in handshake with Google or Apple

This browser tab, only while you sign in

Display choices, such as the period and room you last looked at

On your device, until you clear it

Last readings in the phone app, so it opens fast

On your phone, for up to a day

Changes to this page

If what Snugdays does with your data changes, this page changes with it and the date at the top moves. A change that widens what is collected or where it goes will be announced in the app rather than made quietly.

Terms of use · Guides