Last updated 24 August 2026
Your energy supplier credentials never reach us. OctoMAX is built so that your Octopus Energy API key, Ohme login and Tesla authorisation stay on the machine you run the collector on. Only figures already computed from them are sent to your dashboard.
OctoMAX is a personal energy dashboard operated from the United Kingdom. For anything in this notice, including requests to see or delete your data, contact privacy@octomax.uk.
Everything below lives in a database on our hosting provider's UK servers.
| Data | Why |
|---|---|
| Your email address | It identifies your account and is where sign-in links are sent. It is the only personal detail we ask for. |
| Sign-in and session tokens | To keep you signed in. Stored only as SHA-256 hashes — the values themselves are never written down. |
| Collector tokens and the name you give a collector | So your collector can prove it belongs to your account. Also stored only as a hash. |
| Computed energy snapshots | The figures your dashboard shows: electricity and gas usage and cost, cheap-rate periods, EV charging sessions, smart plug readings and bill reconciliation. |
This website, the dashboard and the iOS app contain no analytics, no advertising and no third-party tracking scripts of any kind. Nothing you do here is shared with anyone for marketing, and we do not sell data.
The dashboard sets a single cookie, octomax_session, after you sign in.
It is strictly necessary — without it you cannot stay signed in — so no cookie banner
is required. It contains a random session identifier and nothing else, is marked
HttpOnly and Secure so scripts cannot read it, and expires after 30 days. The iOS app
does not use cookies; it stores the same session identifier in the device's own secure
storage, and removing the app removes it.
We do not transfer your data outside the UK.
Snapshots accumulate for as long as your collector keeps sending them, so you can look back over time. Sign-in links expire after 15 minutes and sessions after 30 days. If you ask us to delete your account, everything above is removed.
Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, or stop using it. Email privacy@octomax.uk and we will respond within one month. Deleting your account removes your email address, your tokens and every snapshot we hold, and cannot be undone.
If you think we have handled your data badly you can complain to the Information Commissioner's Office at ico.org.uk.
OctoMAX is not intended for children and we do not knowingly collect their data.
If this notice changes materially we will update the date above and, where it affects you, tell you by email.