Privacy Policy

Last updated: August 2026

Overview

This site has no accounts, no sign-in and no analytics. You can give it a postcode for a transient region lookup. If public rate alerts are operationally enabled, you can separately choose to supply an email address for that feature. This page explains what happens to each.

Postcode Lookups

Your browser sends the postcode transiently in a POST request body to identify its Great Britain Grid Supply Point (GSP) group. It never enters this site's browser-visible URL, storage, cache, logs, or response. Only the resulting canonical region may be remembered locally for tariff tools.

To use Octopus Energy's authoritative mapping, the site then sends a transient, no-store request to Octopus. That upstream request uses the compact postcode in its URL and is discarded after the lookup finishes. This is separate from the browser-visible and site-controlled boundary above.

What This Site Stores In Your Browser

There are four categories of browser-held data: theme, remembered canonical region, versioned optimiser preferences and appliance plans, and an optional private account connection for the Phase 3b usage tools. There are no cookies, and no postcode is stored. Local and session storage are readable only by this site in this browser; unlike a cookie, they are not automatically attached to requests.

• octopus-theme — written when you press one of the light, dark or system buttons in the header. It holds one of those three words, so the page does not flash the wrong colour scheme the next time you visit.
• octopus-region — the only result of a postcode lookup that may be remembered locally. It holds a canonical region slug such as london, never the postcode. It is not a profile or identifier: it is one of fourteen public electricity regions.
• octopus-optimiser-v1 — versioned optimiser preferences and appliance plans, including the chosen tariff, canonical region, objective, and plan settings. It is never a postcode, price payload, carbon payload, account identifier, or key.
• octopus-agile.account-session.v1 and octopus-agile.account-local.v1 — the private account tools store an account number and API key in the current browser session by default, and only store a durable copy when you explicitly choose “Remember on this device”. No consumption payload is stored.

When interactive scheduling tools request published data, they send the selected canonical tariff and region to this same-origin site. Appliance names, runtimes, objectives, and plans remain local. You can clear this site's data at any time through your browser's settings for site data (in Chrome, Edge and Firefox this is the “cookies and site data” section; in Safari, “Manage website data”). Clearing this site's data removes the theme, remembered region, optimiser preferences and plans, and any remembered private account connection. Forget account clears both private connection stores immediately, while no consumption payload is stored in either place. If your browser blocks storage — private browsing, or a full quota — the site carries on working and simply forgets those local preferences.

Private Account Tools

The private usage tools mean the browser connects directly to Octopus Energy over HTTPS. This site never receives your API key, account number, MPAN, meter serial numbers, account payload, or consumption payload.

When you request a tariff comparison for those tools, the same browser separately requests published comparison data from this same-origin site using only the selected region and London date bounds. That published comparison data contains no account or consumption payload.

If the switchable comparison does not contain your supply's exact current product, the browser requests that tariff's published rates directly from Octopus without sending the API key or account details with the public-rate request. Those rates are used only as the current-cost baseline and are not added to the switchable ranking.

Those tools require JavaScript because the private account interaction stays inside the browser. Baseload and tariff-cost figures are estimates, not device measurements, bills, or quotes. They use complete London days only and carry stated limits including the standing-charge scalar approximation plus excluded discounts, dispatch overrides, exit fees, export credits, and billing adjustments.

Public Rate Alerts

When public rate alerts are operationally enabled and you choose one, we collect your normalized email address, one of fourteen public electricity regions, the selected public alert kind, and an optional price threshold. Signup uses double opt-in, so no alert is active until you use the confirmation link sent to that address. Every alert includes a no-sign-in unsubscribe link.

Alert data is used only to evaluate published public rates and send the requested email. It is never combined with Octopus private-account data because this site still never receives the API key, account identifiers, meter details, or consumption used by the browser-held private tools. Unverified signups are removed after seven days, unsubscribed records after 30 days, and minimal delivery bookkeeping after 90 days.

Server Logs

Our hosting provider (Netlify) collects standard web server logs including IP addresses, browser types and requested addresses for system administration, security and performance monitoring. The region finder keeps postcode input out of requested addresses and its handler does not log request bodies.

Data We Do NOT Collect

• Names or contact details other than the email address supplied specifically for a public rate alert
• Octopus Energy account credentials on this site's server — the private tools keep them in the browser
• Your actual electricity consumption on this site's server — the private tools keep it in the browser and do not persist it
• Your custom tariff definitions on this site's server — they stay in this browser's local storage until you clear them
• Payment information
• Tracking cookies or third-party analytics — there are no cookies of any kind

Third-Party Services

Our Own Database

Every price on this site is read from a Postgres database we run, hosted on Supabase, which a separate process fills with Octopus's published tariffs and rates. The retail data remains read-only to this web application. Public rate alert subscriptions are the one separate, tightly scoped exception: a managed upstream service stores only the email and public condition described above and owns every state transition.

Octopus Energy

The postcode finder uses the transient mapping request described above. A separate browser-side fallback request to Octopus for tomorrow's published rates can occur only when a tomorrow page has no database result. Separately, the private usage tools let the browser connect directly to Octopus Energy and keep the account and consumption payloads out of this site. Neither route creates a supported public data API or download. Please refer to Octopus Energy's privacy policy for information about their data practices.

Netlify Hosting

This site is hosted on Netlify. Please refer to Netlify's privacy policy for information about their data practices.

Your Rights

Browser-held categories are under your control and can be cleared through your browser settings or the private tools' own Forget account action. Public rate alert emails have a no-sign-in unsubscribe link; using it stops evaluation and starts the 30-day deletion window described above. Custom tariff definitions have their own clear action, and no postcode or consumption payload is among the stored items.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date.

Contact

If you have questions about this privacy policy, email hello@octotariffs.co.uk. Email is handled by the sender's and recipient's email providers; this site does not add the message to an application contact database.