Privacy Policy
This page is a plain description of what this site does with your data. It is short because the site does little: it signs you in with your existing LuxPower account, reads your own solar readings from the LuxPower portal, keeps a copy so the history survives an outage, and shows it back to you.
The short version
- There is no account to create here. You sign in with the LuxPower username and password you already have.
- Your LuxPower password is never written to our database. It is held only for the life of your session and discarded when you sign out.
- We store your solar readings so the dashboard has a history to draw. That is the bulk of what we hold.
- Nothing is sold, shared for advertising, or handed to anyone for their own purposes.
- This dashboard only ever reads. It never changes a setting on your inverter and never edits anything in your LuxPower account.
- You can delete every reading we hold for your account yourself, at any time, from App config › Your data.
Who runs this site
This site is operated by vayoweb.com. It is an independent project
and is not affiliated with, endorsed by, or connected to LuxPower
Tek. LuxPower and the portal at luxpowertek.com are
theirs; this is a different front end onto your own data in it.
Your LuxPower password
This is the part worth being exact about, because a vague answer here is worth nothing.
When you sign in, your username and password are sent to the LuxPower portal to confirm the account is yours. If the portal accepts them, we keep the password in your server-side session for as long as that session lasts. We keep it because the portal's own session can lapse mid-visit, and re-sending your password is the only way to recover it without throwing you back to a sign-in form.
What that means precisely:
- It is never written to our database. There is no column for a password anywhere in the schema, and there never will be.
- It is held only for your session, in session storage on the server, in a directory outside the public web root.
- A session lasts up to four hours, and signing out ends it immediately and discards the password with it.
- It is never sent anywhere except the LuxPower portal, and it is never written to a log, an error message, or anything the browser can read.
We deliberately do not say “we never store your password”, because that would be untrue: PHP writes session data to disk, so for the life of your session it exists on the server. What we can say, and mean, is that it is never written to our database and never outlives your session.
If you would rather it were never held at all, the honest answer is that this dashboard cannot work that way — the LuxPower API has no token or app-password to use instead.
What we store
All of it is keyed to your account and read back only for you. Every query the site makes is scoped to your own account.
| What | Why |
|---|---|
| Your LuxPower username, plant ID, inverter serial number, time zone, and when you last signed in | To know whose readings are whose, and which day “today” is at your plant |
| Daily and monthly energy totals, and five-minute power samples — solar, house, grid, battery, state of charge | The history every chart on the site is drawn from. The portal only serves a limited window; this is what makes the long view possible |
| The most recent live reading from your inverter | So the dashboard has something to show before the first fresh reading lands |
| Settings you enter yourself: panel count and wattage, battery pack size, reserve floor, install cost, and your electricity rate card | Figures only you know. Without them the numbers that depend on them stay blank rather than guessed |
| Cached copies of portal responses, and weather forecasts for your plant's location | So the same question is not asked of someone else's server twice, and so an outage degrades instead of blanking |
| An activity record: sign-ins, saved settings, history fetches, with the time and a hashed IP address | So you can see what happened on your account, and so repeated failed sign-ins can be slowed down |
IP addresses are stored only as a one-way hash with a secret salt. They are used to rate-limit failed sign-ins and for nothing else — not analytics, not profiling, and they cannot be turned back into an address.
What we do not do
- No writes to your inverter. Every request this site makes upstream is a read. The inverter-settings page is a reference table describing what the official portal can change; it changes nothing itself.
- No edits to your LuxPower account. We do not change your portal password, your plant details, or anything else there.
- No sign-up, no email collection, no newsletter. We never asked for your email address, and there is no password-reset flow here because there is no password of ours to reset.
- No advertising, no third-party analytics, no tracking pixels, no cross-site cookies.
- Nothing is sold or shared. Your readings are not pooled, resold, or used to train anything.
Who else is involved
Three outside services are touched, and it is worth knowing which of them your browser reaches directly and which it does not.
- The LuxPower portal (
sea.luxpowertek.com). Contacted by our server, not by your browser. It receives your LuxPower credentials, because it is the thing that verifies them. Your use of it is governed by LuxPower Tek's own terms. - Open-Meteo, for the weather forecast. Contacted by our server and proxied, so your browser never calls it and your IP address is never exposed to it. It receives your plant's approximate latitude and longitude — nothing identifying.
- Google Fonts. This one is loaded by your
browser, from
fonts.googleapis.comandfonts.gstatic.com, so Google can see your IP address and which page requested a font. Nothing else is sent. The charting library is served from this site rather than a CDN specifically so that it is not a second such request.
Cookies and browser storage
- One cookie, the session cookie, which identifies your signed-in session. It is strictly necessary — without it there is no way to stay signed in — and it carries nothing but an opaque session ID. It expires with the session.
- Two values in your browser's own local storage: the theme you chose (light, dark, or follow the device) and whether the side drawer was left open. They never leave your browser and we cannot read them.
- No advertising or tracking cookies of any kind.
How long it is kept, and how to delete it
Readings are kept for as long as your account exists, because a history that quietly drops its oldest years is not a history. Your session, and the password in it, last at most four hours and end the moment you sign out.
You can delete the readings at any time, yourself, from App config › Your data. That removes your stored totals and samples, the cached portal responses and the weather forecasts. Your settings and your activity record are kept, so the record of the deletion itself survives it. It cannot be undone, and past days can be fetched again afterwards because the portal still has them.
To have the account itself removed as well, ask us — see below. Deleting anything here has no effect on your LuxPower account, which keeps its own copy of everything regardless.
Security
- Everything is served over HTTPS.
- Session files live outside the public web root, so they are not reachable over the web even if the server is misconfigured.
- Repeated failed sign-ins are throttled, per username and per hashed IP.
- Any request that changes something must prove where it came from, and the site never follows a cross-site form post.
No system is perfect. If you find a security problem, please report it rather than testing it further — see below.
Your data, your call
You can see everything we hold about you from inside the site: the readings on every page, the cached responses under App config › Your data, and the activity record under App config › Activity. You can correct the settings you entered, and you can delete the stored data. If you want a copy in a file, or want the account erased entirely, ask and we will do it.
Changes to this policy
If this policy changes in a way that matters, the date at the top of this page changes with it and the change is listed in the site's changelog. We will not quietly widen what is collected.
Contact
Questions about this policy, a request to delete an account, or a security report: vayoweb.com.