Privacy Policy

Last updated: 2026-07-26

1. Overview

dtu.app is a self-hosted telemetry dashboard for solar inverters that publish over MQTT. This policy explains what data we collect, how we use it, and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR).

2. Data controller

The data controller is the operator of the dtu.app instance you are using. For the official hosted instance, see the project's issue tracker for contact details. For self-hosted deployments, the controller is whoever operates the server on which this instance runs.

3. What data we collect

3.1 Account data

When you register, we store your email address and a hashed version of your password. The email address is used to log you in and (if enabled) to send transactional emails such as magic-link sign-in or account-change confirmations.

3.2 Telemetry data

When you add a DTU, the system generates a unique username and password for the device's MQTT connection. As your DTU publishes readings (power output, energy counters, status flags), the system stores them in the database to render your dashboard charts and statistics.

3.3 Session and security data

To keep you signed in, we store a session token in an HTTP-only cookie. We log basic request metadata (timestamp, status, route) for security and debugging.

4. How we use your data

• To render the dashboard, charts, and statistics you request.
• To authenticate you and protect your account.
• To send transactional emails you have triggered (magic-link login, email-change confirmation).

We do not sell or rent your data to third parties. We do not use your data for advertising or profiling.

5. Third-party services

When email delivery is enabled, the app calls a third-party transactional email provider to send magic-link emails. That provider sees your email address, the email subject, and the message body — typically only the magic-link URL. The current default in this open-source project is Resend; you may self-host with a different provider or disable email delivery entirely.

6. Data retention

• Account data is stored until you delete your account.
• Telemetry readings are stored indefinitely so your historical charts keep working; you may delete them individually from each DTU's settings page.
• Server logs are retained for at most 30 days unless required to investigate a security incident.

7. Your rights (GDPR)

You have the right to access, rectify, erase, restrict the processing of, object to the processing of, and port your personal data. You may exercise these rights directly from the user-settings page or by contacting the data controller. You also have the right to lodge a complaint with your local data-protection authority.

8. Security

Passwords are stored using Argon2id. Sessions are signed with a server-side secret and transmitted only over secure cookies. Telemetry connections use per-device usernames and passwords with the option to add TLS via a reverse proxy (e.g. Traefik) in front of the broker.

9. Changes to this policy

We may update this policy to reflect changes in our practices or applicable law. The current version is always available at this URL; material changes will be announced via the project repository.