1
What we collect
We collect the minimum data needed to make Sunvia useful to you. That is:
Account information — your email address, name, and a password (the password is hashed by our authentication provider and never stored or visible in plain text).
Home profile — city, household size, and the heavy appliances you indicated during onboarding (e.g. geyser, water pump, air conditioner).
Inverter credentials — if you connect a SolarMan-compatible inverter (Inverex, Solis, Knox, Crown, Primax, MaxPower or similar), we encrypt your inverter-vendor login email and password using AES-256-GCM before storing them. The encryption key never leaves our backend.
Inverter readings — every few minutes we record your current solar generation, battery state of charge, household load, and grid import or export. This time series powers your dashboard and the suggestion engine.
Notification preferences and history — your quiet-hours, per-rule on/off toggles, and a log of suggestions we have sent you.
Push notification token — a device-specific token issued by Expo, Google Firebase Cloud Messaging, or Apple APNs, used to deliver alerts to your phone.
We do not collect contact lists, location data, photos, calendar, microphone audio, or any data unrelated to managing your solar energy.
2
How we use it
To show your dashboard and history.
To poll your inverter (using your encrypted credentials) and record readings so you have a usable time-series.
To evaluate our suggestion rules (for example, “good time to run the water pump”) and send a push notification when one fires.
To debug issues, prevent abuse, and improve the product. We may look at aggregated, non-identifying patterns — for example, how often a rule fires across all users.
We do not sell your data. We do not show advertising of any kind in the Sunvia app. We do not share your inverter readings with other users or third parties for marketing.
3
Who we share data with (service providers)
Sunvia is built on a small number of trusted infrastructure providers. Each only receives the data they need to do their job:
Supabase (database and authentication) — hosted in Singapore. Stores your account, profile, readings, and encrypted inverter credentials.
SOLARMAN / IGEN Co. Ltd. — we send your decrypted inverter-vendor credentials to SolarMan's API servers (operated from China) only at the moment we poll for a reading, so that SolarMan can return your inverter's data. SolarMan's handling of that data is governed by their own Privacy Policy.
Google Firebase Cloud Messaging (FCM) and Expo Push — used to deliver push notifications to your phone. They receive your device push token and the notification text, but nothing about your readings.
Apple APNs — the equivalent on iOS, where applicable.
We never share your raw inverter password with anyone other than SolarMan, and only at the moment of the API call. We do not give access to your data to advertisers, data brokers, insurers, or government bodies unless legally compelled by a valid court order.
4
Security
All data in transit uses HTTPS / TLS.
Inverter credentials are encrypted at rest using AES-256-GCM. Only our backend can decrypt them, and only at poll time.
The database enforces Row-Level Security: each user can only read or modify their own rows.
Supabase's authentication provider stores your password hashed with bcrypt. We never see your password in plain text.
We will inform you within a reasonable time if we become aware of a security breach that exposes your data.
5
Where your data lives
Your account and readings are stored in Singapore (Supabase). Your inverter data, when polled, transits via SolarMan's servers in China. Push notifications transit via Google (FCM, United States) or Apple (APNs). By using Sunvia you understand and agree to this international transfer.
6
How long we keep your data
We keep your readings, notifications, and profile for as long as your account is active. If you ask us to delete your account, we will permanently delete your profile, encrypted credentials, and push token within 30 days, and your readings and notifications within 90 days (slight delay so we can honour any pending refunds or disputes).
7
Your rights
Access — you can see your profile and readings inside the app, or request an export by emailing us.
Correction — edit any field in your profile from the Settings tab.
Deletion — email us and we will delete your account within 30 days.
Withdraw consent — you can disconnect your inverter or turn off any notification rule at any time. You can also revoke notification permission entirely in your phone's system settings.
8
Children
Sunvia is not directed at children under 18. We do not knowingly collect data from anyone under 18. If you believe a child has signed up, please email us and we will delete the account.
9
Cookies and trackers on this website
Our landing page is hosted on Vercel and uses Vercel's default request logs (IP address, user-agent, response time) for security and performance, retained for 30 days. We also use Vercel Web Analytics to count page views and which pages people visit. It sets no cookies, does not track you across other websites, and identifies visits only by a hash that resets every day, so it cannot be used to recognise you. We do not deploy third-party advertising trackers, advertising pixels, or social media trackers on the landing page.
10
Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes that affect how we collect or use your data, we will let you know in the app and via email at least 14 days before the change takes effect.