Skip to content

privacy.md

Latest commit

 

History

History
55 lines (41 loc) · 2.2 KB

privacy.md

File metadata and controls

55 lines (41 loc) · 2.2 KB
Raw

Privacy and Local Data

HelioSlate is designed so normal solar monitoring does not require a HelioSlate cloud service.

Data stored on the host

Mutable runtime data is stored beneath %LOCALAPPDATA%\HelioSlate and may include:

  • Application settings and the configured private gateway address.
  • One-minute system and panel history in SQLite.
  • Masked device identifiers and panel inventory metadata.
  • Household membership, invitations, approvals, and audit events.
  • Locally generated TLS certificates for paired access.
  • Operational logs and a small runtime-discovery file.

Credentials, private-key passwords, paired-client credentials, and optional Tailscale automation credentials are stored through Windows Credential Manager.

Network disclosure

The host contacts the configured PVS gateway on the private LAN. Optional remote access invokes the locally installed Tailscale command-line client and Tailscale control plane according to the user's Tailscale account and privacy terms.

If enabled, Tailscale Funnel makes the invitation helper publicly reachable. The helper contains instructions and signed invitation metadata, not solar telemetry. The private dashboard remains behind Tailscale Serve and HelioSlate owner approval. Tailscale HTTPS hostnames may appear in public Certificate Transparency logs.

Exports and screenshots

CSV history exports contain household energy and masked panel identifiers. They are useful for analysis but should still be treated as private household data. Sanitized diagnostics intentionally remove credentials, cookies, full serials, MAC addresses, and usernames.

Before sharing screenshots, remove:

  • Account emails and household member names.
  • Gateway, LAN, and Tailscale addresses.
  • Computer and tailnet names.
  • Invitation URLs and QR codes.
  • Certificate fingerprints and device serial fragments.
  • Any graph or tariff data the household considers sensitive.

Source publication boundary

Runtime databases, configuration, certificates, logs, captures, build output, and environment files are excluded from Git. The release build runs scripts/check_publication_safety.py and refuses to continue when common secret or personal-data patterns appear in the publication set.