Privacy

Last updated: 7 September 2026

velvet-thermostat is a private, self-hosted system run by one person on a single rented server. This page explains what it stores about you, why, how long it keeps it, and what you can ask for. It is written to meet the UK GDPR and the EU GDPR.

Who is responsible

The individual operator of velvet-thermostat is the data controller. There is no company. Contact for any privacy request, including access, correction or deletion:

CONTACT — add a real address — e.g. an email you monitor. Until this is filled in, requests can be made through the person who gave you your account.

The public front page

The page at velvet-thermostat.org collects nothing. No analytics, no advertising, no third-party scripts, no tracking pixels, no cookies. Fonts are served from this server, not a font CDN. Your browser’s normal request logs (below) are the only record that you visited.

Server request logs

The web server (Caddy) writes a standard access log: your IP address, the time, the page requested, the response code, and your browser’s user-agent string. This is used only to run and debug the site and to spot abuse. Logs rotate and are not combined with anything else or shared.

If you have a hub account

Signing in to the hub or the agent uses a small login service (“velvet-auth”). It stores:

• Your username — the one you choose.
• Your password — only as a salted scrypt hash with a server-side pepper. The plaintext is never written to disk.
• An optional note you can type when requesting access, shown to the admin who approves you.
• Two-factor data, if you enable it (required for admins): a TOTP secret encrypted at rest with AES-256-GCM, and one-way hashes of your recovery codes.
• Session records: a hash of the session cookie, your IP address, your user-agent string, and created / last-seen timestamps.
• Your most recent sign-in: IP address and timestamp, stored on your account record (overwritten each time, so only the latest is kept).
• A security audit line for events such as sign-in, failed sign-in, account approval, role change and two-factor changes: who, what, the target account, an IP address and a timestamp.

This is the minimum needed to log you in, keep you logged in, and keep the account secure. There is no profiling, no analytics on your activity, and nothing is sold or shared for marketing — there is no marketing.

Cookies

Only strictly-necessary cookies are used, all for login and form security, plus one optional display preference stored in your browser. Full detail is on the Cookies page. Because none of them are used for tracking, no consent banner is shown — this is the exemption in PECR / the ePrivacy Directive.

The agent

If you use the AI agent at agent.velvet-thermostat.org, the text you send it is passed to the model provider (OpenRouter and its upstream model host) to produce a reply, and any web-search you trigger sends your query to the search provider (Perplexity). Don’t put anything in the agent you would not want sent to those services. Conversation history is held by the agent runtime on this server.

Processors and third parties

• The VPS provider hosts the server and therefore stores the data at rest on their infrastructure.
• Let’s Encrypt issues the TLS certificate (domain name only).
• OpenRouter / Perplexity receive only what you type into the agent, as described above.

No other third party receives your data. It is not sold, rented or shared for advertising.

Legal basis

For account data: performing the service you asked for (giving you access) and the operator’s legitimate interest in running a secure private system. For request logs and the audit log: legitimate interest in security and reliability.

How long it is kept

• Session records — deleted when you sign out or the session expires (30 days idle, 180 days maximum).
• Audit log — trimmed to roughly the most recent 5,000 events.
• Account record — kept until the account is deleted. Ask and it is removed, along with its sessions.
• Server access logs — rotated by the system and not retained long-term.

Your rights

You can ask to see what is held about you, correct it, delete it, or get a copy in a portable form. Use the contact above. If you are in the UK or EU and think your data has been mishandled, you can complain to the Information Commissioner’s Office (ico.org.uk) or your national data protection authority.

Children

This is not a service for children and accounts are given out individually to people the operator knows.

Changes

If this policy changes, the new version is posted here with an updated date.