← Back to Sunstead

Privacy Policy

Effective date: October 1, 2026 (previous version: September 30, 2026) · Stillridge Labs · Calgary, Alberta, Canada

Short version: Sunstead exists to show you your own solar system and, if you have one, your home energy monitor. We collect only what that takes, we never sell or license your data to anyone, there are no ads and no third-party analytics, and you can delete your account and everything in it from inside the app at any time.

1. Who we are

Sunstead is operated by Stillridge Labs ("Stillridge Labs", "we", "us", "our"), a sole proprietorship registered in Alberta, Canada. Stillridge Labs is a registered trade name; the legal entity behind it is its sole proprietor, Todd Zmetana. Questions about this policy: [email protected].

2. What we collect

2.1 Account information. When you create a Sunstead account we collect your email address, a display name you choose, and a password. The password is stored only as a one-way hash (scrypt); we never store or see the password itself. Your email address is used to confirm the account, to send password resets, and to send the household notifications you choose to enable. Nothing else.

2.2 Your solar system. To show you your system, Sunstead stores what you tell it about it: its name, approximate location (latitude and longitude, used to fetch local weather), size, panel count, and how the panels are grouped. If you connect an APsystems account, the API credentials you enter are encrypted at rest (AES-256-GCM) and used only to read your inverter data from APsystems on your behalf. They are never shown again in full, never shared, and are deleted with your system. Those credentials are yours: you create them in your own APsystems account, you control what they can access, and you can revoke or rotate them on the APsystems side at any time, which immediately ends Sunstead's ability to read your data whether or not you also remove them here.

If a home energy monitor is set up for your household, Sunstead stores its address on your home network, its model, device and network identifiers, its firmware version, and the names and roles of its circuits. If the monitor has a password, it is encrypted at rest (AES-256-GCM), used only to read the monitor, never shown in any app or page, and deleted with your system.

If you connect your household's Home Assistant, so that Sunstead can read smart plugs through it, we store its address on your home network and the long-lived access token you create there. The token is encrypted at rest (AES-256-GCM), used only to read that Home Assistant, never returned to any app or page, and deleted with your system. That token is yours: you create it in your own Home Assistant, and revoking it there immediately ends Sunstead's ability to read anything, whether or not you also remove it here. For each plug we store what Home Assistant reports about it: its name, its maker and model, and the identifiers of its power and energy sensors.

2.3 Readings and generation data. Meter readings you enter, inverter output fetched from APsystems, and daily weather fetched from Open-Meteo for your location. This is the data the app is for. It is visible to you and to the household members you invite, and to no one else.

2.3a Home energy monitor readings. If your household has a monitor, Sunstead reads it about once a minute over your home network, or, if you connect it over MQTT, the monitor sends the same readings to Sunstead itself, over the internet on an encrypted connection: each circuit's power, voltage and current, and its energy for the day, plus a minute-by-minute record. From those it works out what each circuit used and cost, finds runs of an appliance, and checks the alerts you set. Circuit readings show when things in a home are used, and so when people are likely home, up, cooking or away. We treat them accordingly: they are visible only to you and the household members you invite, never shared with anyone, and never used for anything but showing them to you. Minute readings are kept for 30 days; each circuit's daily totals and the runs you keep are kept until you delete them or your household. Sunstead only reads a monitor or receives what it sends; it never changes its settings, erases its data or sends it a command.

2.3b Smart plug readings. If your household has plugs connected through Home Assistant, Sunstead reads them about once a minute: each plug's power and its energy counter. From those it works out what the device a plug is plugged into used, and what it cost. A plug's readings say when one particular thing is switched on, which can be more telling than a whole circuit: a television, a kettle, a bedroom heater. They are treated exactly as circuit readings are: visible only to you and the household members you invite, never shared, never used for anything but showing them to you. Plug readings are kept for 30 days; each plug's daily totals, and which device it was measuring when, are kept until you delete them or your household. Sunstead only reads Home Assistant; it never switches a plug, changes a setting, or writes anything to it.

2.4 Bills. If you enter or upload an electricity bill, we store only the figures needed to reconcile it: the service period, the kilowatt-hours delivered and received, the charges by category, and the meter reads it states. To be explicit about what we do not store from a bill:

The one identifying thing a bill contains that Sunstead keeps is the meter's cumulative dial reads, which it needs to check your own readings against; those are numbers on a meter, not personal details.

The one exception, and only with your consent: if you upload a bill from a retailer Sunstead cannot read yet, it will ask whether it may keep that file for up to 30 days so support can build a parser for that format. If you say yes, the file (which contains your name, address, and account details) is stored encrypted, is visible only to Stillridge Labs support, and every time it is opened is logged. It is deleted when the parser is done or after 30 days, whichever comes first. If you say no, it is discarded immediately as usual.

2.5 Device and technical information. If you turn on notifications in the app, we store a device-specific push token so we can deliver them; it is removed when you turn notifications off or delete your account. Notifications are sent through Expo's push service, which receives that token and the text of each notification (for example, that a reading was entered, or that a circuit you chose went above a limit) in order to pass it to Apple. The app's evening reading reminder is scheduled on your phone itself and never involves our servers, and a reading entered while your phone has no connection is kept on the phone only until it can be sent. Our servers sit behind Cloudflare, which sees your IP address in order to serve the site and to limit abusive traffic; we use your IP address only for that rate limiting and do not build any profile from it. We do not use third-party analytics or crash-reporting SDKs.

2.6 Camera. The app asks for camera permission only to turn on your phone's flashlight so you can read a meter in the dark. No image is ever captured, displayed, or stored.

3. How we use it

Any estimate, projection, or recommendation Sunstead shows is computed from your own data for your own information. It is not sold, aggregated, or licensed to anyone.

4. What we never do

5. Who else sees data, and why

Sunstead runs on a small number of services, each for one narrow job:

None of these is given access to anything beyond what its job requires.

6. Household sharing

If you invite someone to your system, they can see that system's readings, generation, bills, and settings at the role you give them (viewer or editor). Invitations are sent to a specific email address and can only be accepted by an account with that address. You can remove a member at any time; they lose access immediately.

7. Storage and security

Sunstead's data is stored in Canada, on hardware Stillridge Labs owns and operates, not in a public cloud. Connections use TLS. Passwords are hashed with scrypt. APsystems credentials, energy monitor passwords and Home Assistant tokens are encrypted at rest; the login a monitor uses to send its readings over MQTT is kept only as a scrypt hash, and is shown to you once when it is issued. On iOS the app stores its session token in the device Keychain. Sign-in, sign-up, and password-reset endpoints are rate limited.

The database is backed up nightly so that a failure does not lose your data. Backups stay in Canada, on storage we control, and are never sent to a third party. The encryption key that protects credentials is kept out of the backups, so a backup on its own cannot be used to reach your APsystems account, your monitor or your Home Assistant. No system is perfectly secure; if a breach affects your personal information we will notify you as required by applicable law, including PIPEDA.

8. Retention and deletion

9. Your rights

As a resident of Canada you have rights under PIPEDA, and we extend the same to everyone: to access the personal information we hold about you, to have it corrected, to have it deleted, and to withdraw consent by deleting your account. Write to [email protected] and we will respond within 30 days. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada.

10. Children

Sunstead is a household utility tool and is not directed at children. We do not knowingly collect personal information from anyone under 13.

11. Changes

If we change this policy in a way that matters, we will tell you by email or in the app at least 14 days before the change takes effect. The effective date at the top is the date of the current version.

12. Contact

Privacy questions: [email protected]
Everything else: [email protected]