Privacy policy
Last updated 22 October 2026
GreenWindow is a free, non-commercial portfolio project run by Nivesh Kannan Elangovanraaj (“we”). The forecast pages store nothing about you. This policy mainly covers the optional assistant and accounts.
Who is responsible
Nivesh Kannan Elangovanraaj, who runs GreenWindow, is the data controller. Contact details are under Contact.
What is stored
- Account: your e-mail address and name from Google, if you sign in. Guests get a random ID only.
- Messages: what you type to the assistant and its answers.
- Profile: display name (filled in from your Google name when you sign in; you can change it in Settings), default risk mode and quiet hours. The assistant sees your display name so it can address you.
- Devices: names and power ratings you save.
- Plans and impact rows: the job plans the assistant makes and their estimated outcomes.
- Notifications: if you turn them on, your browser's push subscription (an endpoint address and encryption keys) and any reminders you set are stored until you turn notifications off, cancel the plan, or delete your data. Calendar files and links are made in your browser; we do not receive them.
- Feedback: thumbs and comments you send.
- Traces: which tools ran, timings and token counts for each assistant turn, used to debug and measure quality.
- Abuse limits: a salted one-way hash of your IP address, used to cap how many guest sessions and messages one network can start. We do not store the IP address itself.
Please don't type sensitive personal information into the assistant. It doesn't need any.
Why we use it (legal basis)
- To provide the assistant and your account when you choose to use them (performing the service you asked for).
- To keep the service secure, stop abuse and keep costs under a fixed budget (legitimate interests).
- To debug and improve answer quality from traces and feedback (legitimate interests).
- To send reminders only after you turn notifications on (consent, which you can withdraw at any time).
We do not sell your data, show ads, or use it to profile you for marketing.
Cookies and browser storage
There are no advertising or analytics cookies. If you use the assistant, your browser keeps a sign-in session in local storage and a guest token in session storage. Cloudflare Turnstile may set its own cookies to tell humans from bots. Clearing your site data removes what we store in your browser.
How long
Data is kept for 90 days. Guest (anonymous) users who have been idle for 30 days are deleted sooner.
Who processes it
- Google Gemini API. Generates assistant answers. Your message and the tool results it needs are sent to it. On the free tier, Google may use prompts to improve its products where its terms allow.
- Vercel AI Gateway, routing to Anthropic. Fallback model provider for assistant answers when the primary model is unavailable.
- TypeSafe (Jev). Evaluates the safety rules that check requests and answers.
- Supabase (EU, Ireland). Stores accounts, conversations and the data below.
- Vercel. Hosts this site and the assistant API. Like any web host, it sees your IP address and browser details when you load a page.
- GitHub. Serves the published forecast files your browser downloads, so it sees the same request details.
- Cloudflare Turnstile. Checks that a first-time visitor is human before a guest session starts.
- Langfuse (EU). Receives a sample of assistant traces for debugging: message text shortened to 500 characters, with e-mail addresses and long numbers removed. Linked to your account ID, not your name or e-mail.
Some of these providers process data outside the UK and EU, under their own standard data protection terms.
Google sign-in
Signing in with Google requests the email and profile scopes only. Nothing else in your Google account is read.
Your rights
Under UK and EU data protection law you can ask to access, correct, delete or export your data, object to how it is used, or withdraw consent. Signed-in users can delete their account and all data from Settings (Delete my data). Guests can clear their browser data; guest records are removed after 30 idle days. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local regulator.
Children
The assistant is not meant for children under 13, and we do not knowingly collect their data.
Changes
If this policy changes, the date at the top changes too. The full history is public in the source repository.
Limits of the service
Great Britain national grid only. Everything shown is an estimate of average grid intensity from a forecast, not a guarantee. See also the Terms of service.
Contact
Open an issue on the GitHub repository. Please don't post personal data in a public issue; ask for a private contact instead.