Privacy Policy

Effective date: September 5, 2026 · Stillridge Labs · Calgary, Alberta, Canada

Short version: Sunstead exists to show you your own solar system. We collect only what that takes, we never sell or license your data to anyone, there are no ads and no third-party analytics, and you can delete your account and everything in it from inside the app at any time.

1. Who we are

Sunstead is operated by Stillridge Labs ("Stillridge Labs", "we", "us", "our"), a sole proprietorship registered in Alberta, Canada. Stillridge Labs is a registered trade name; the legal entity behind it is its sole proprietor, Todd Zmetana. Questions about this policy: [email protected].

2. What we collect

2.1 Account information. When you create a Sunstead account we collect your email address, a display name you choose, and a password. The password is stored only as a one-way hash (scrypt); we never store or see the password itself. Your email address is used to confirm the account, to send password resets, and to send the household notifications you choose to enable. Nothing else.

2.2 Your solar system. To show you your system, Sunstead stores what you tell it about it: its name, approximate location (latitude and longitude, used to fetch local weather), size, panel count, and how the panels are grouped. If you connect an APsystems account, the API credentials you enter are encrypted at rest (AES-256-GCM) and used only to read your inverter data from APsystems on your behalf. They are never shown again in full, never shared, and are deleted with your system. Those credentials are yours: you create them in your own APsystems account, you control what they can access, and you can revoke or rotate them on the APsystems side at any time, which immediately ends Sunstead's ability to read your data whether or not you also remove them here.

2.3 Readings and generation data. Meter readings you enter, inverter output fetched from APsystems, and daily weather fetched from Open-Meteo for your location. This is the data the app is for. It is visible to you and to the household members you invite, and to no one else.

2.4 Bills. If you enter or upload an electricity bill, we store only the figures needed to reconcile it: the service period, the kilowatt-hours delivered and received, the charges by category, and the meter reads it states. To be explicit about what we do not store from a bill:

not the bill itself: an uploaded PDF is read in memory on the server and discarded, never written to disk or to the database;
not your name as printed on the bill, your service address, your mailing address, or your postal code;
not your utility or retailer account number, site ID, or meter serial number;
not any payment, banking, or credit card information;
not the bill's barcode, invoice number, or any other identifier that ties the bill to you at the utility.

The one identifying thing a bill contains that Sunstead keeps is the meter's cumulative dial reads, which it needs to check your own readings against; those are numbers on a meter, not personal details.

The one exception, and only with your consent: if you upload a bill from a retailer Sunstead cannot read yet, it will ask whether it may keep that file for up to 30 days so support can build a parser for that format. If you say yes, the file (which contains your name, address, and account details) is stored encrypted, is visible only to Stillridge Labs support, and every time it is opened is logged. It is deleted when the parser is done or after 30 days, whichever comes first. If you say no, it is discarded immediately as usual.

2.5 Device and technical information. If you turn on notifications in the app, we store a device-specific push token so we can deliver them; it is removed when you turn notifications off or delete your account. The app's evening reading reminder is scheduled on your phone itself and never involves our servers, and a reading entered while your phone has no connection is kept on the phone only until it can be sent. Our servers sit behind Cloudflare, which sees your IP address in order to serve the site and to limit abusive traffic; we use your IP address only for that rate limiting and do not build any profile from it. We do not use third-party analytics or crash-reporting SDKs.

2.6 Camera. The app asks for camera permission only to turn on your phone's flashlight so you can read a meter in the dark. No image is ever captured, displayed, or stored.

3. How we use it

To sign you in and keep your data in sync between the app and the website.
To show your generation, consumption, costs, and earnings, and to estimate bills and rate-switch timing.
To fetch your inverter data from APsystems and local weather from Open-Meteo.
To send transactional email: account confirmation, password reset, and household invitations.
To send the alerts you enable, such as an inverter fault or a rate-switch reminder.

Any estimate, projection, or recommendation Sunstead shows is computed from your own data for your own information. It is not sold, aggregated, or licensed to anyone.

4. What we never do

We never sell your personal information, your readings, or your energy data.
We never license aggregated or de-identified data derived from your account to any third party.
We never share your information with advertisers, and there are no ads.
We never use your data to train AI models for any third party.
We never access your APsystems account for any purpose other than reading your own inverter data.

5. Who else sees data, and why

Sunstead runs on a small number of services, each for one narrow job:

APsystems receives your API credentials and returns your inverter data, under APsystems' own terms and privacy policy.
Open-Meteo receives your system's approximate coordinates and returns daily weather. No account information is sent.
Resend delivers our transactional email and therefore sees your email address and the contents of those emails.
Cloudflare fronts the website and API and sees your IP address and request metadata.
Apple (Apple Push Notification service) delivers notifications to iOS devices.

None of these is given access to anything beyond what its job requires.

6. Household sharing

If you invite someone to your system, they can see that system's readings, generation, bills, and settings at the role you give them (viewer or editor). Invitations are sent to a specific email address and can only be accepted by an account with that address. You can remove a member at any time; they lose access immediately.

7. Storage and security

Sunstead's data is stored on servers located in Canada. Connections use TLS. Passwords are hashed with scrypt. APsystems credentials are encrypted at rest. On iOS the app stores its session token in the device Keychain. Sign-in, sign-up, and password-reset endpoints are rate limited. No system is perfectly secure; if a breach affects your personal information we will notify you as required by applicable law, including PIPEDA.

8. Retention and deletion

Account data is kept for as long as your account exists.
You can delete your account at any time from inside the app (Settings → Delete account) or on the website (Settings → Account). Deletion is immediate and cannot be undone.
Deleting your account removes your account, your sessions, and your memberships. If you own a household, it goes with you: readings, inverter data, bills, settings, and credentials are all deleted, and anyone else in it keeps their own account but is left without a household. The app tells you how many people that affects before you confirm.
If you entered readings into a household you only belonged to, those readings stay with the household as its record of the meter, with your name removed.
An account left without a household for 90 days is deleted automatically.
An account with no sign-in or other authenticated activity for one year is deleted automatically, along with any household it owns. To make that possible we record the date of your last authenticated request, at most once a day; nothing else about the request is kept.
You can also request deletion by emailing [email protected].

9. Your rights

As a resident of Canada you have rights under PIPEDA, and we extend the same to everyone: to access the personal information we hold about you, to have it corrected, to have it deleted, and to withdraw consent by deleting your account. Write to [email protected] and we will respond within 30 days. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada.

10. Children

Sunstead is a household utility tool and is not directed at children. We do not knowingly collect personal information from anyone under 13.

11. Changes

If we change this policy in a way that matters, we will tell you by email or in the app at least 14 days before the change takes effect. The effective date at the top is the date of the current version.

12. Contact

Privacy questions: [email protected]
Everything else: [email protected]