Privacy Policy
Last updated 11 October 2026
This policy explains what WattOps collects, why, and what you can do about it. WattOps is operated by PHENEX TECHNOLOGIES INC., a British Columbia corporation based in Vancouver, British Columbia, Canada ("we", "us"). We are responsible for your personal information and handle it under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia's Personal Information Protection Act (PIPA) and, where they apply, the GDPR and the UK GDPR.
What we collect
| Data | Why | Where it is kept |
|---|---|---|
| Email address, and your password hash if you use one | To create your account and sign you in | Supabase Auth |
| Your GitHub or Google profile email, ID, name and profile picture address, if you sign in with them | To sign you in and show your name and picture in the app | Supabase Auth |
| The display name and preferences (theme, currency, grid) you set in Settings | To show them on every device you use | Supabase Auth |
| Who the account is for, asked when you create it: your name, your country, what you want to measure first, whether the account is just for you or for an organisation and, if you say, how you heard about us. For an organisation, also its name and type, your role, its size, roughly how many GPUs it runs and where, and whether you want us to contact you about a demo; and, if you give them, its website, your job title and a phone number | To set up your account, and for organisations to offer the right plan, academic pricing or a pilot. You can change the answers in Settings → Profile. | Supabase database |
| Runs you choose to save: calculator inputs and results | To show them back to you | Supabase database |
| API keys: name, first 12 characters and a SHA-256 fingerprint | To recognise your key. The full key is never stored. | Supabase database |
| Counts of your API calls per month and per minute | To apply plan limits | Supabase database |
| Leaderboard measurements you share: model, hardware, energy per token, speed, average power, joules version | To publish the leaderboard | Supabase database |
Runs you track with joules --track (or joules proxy --track): project name, a short label (the program and script name, or your own label), hardware, time, energy, carbon, cost, operations and Landauer gap | To show your Tracking page and build energy reports | Supabase database |
| Teams: the team name, who is in it, invite email addresses, and which member's key sent each team run | To run team workspaces | Supabase database |
| Alerts: your alert rules, the webhook address you give, and a record of each alert and whether it was delivered | To tell you when a run uses much more energy than usual | Supabase database |
| Stripe customer ID, subscription status and renewal date | To run Pro billing | Supabase database and Stripe |
Live heartbeats from joules agent on the Max plan: machine name, power, idle GPUs, and the jobs running on it (job name, user name, power) | To show the Live page | Supabase database |
| Contact form messages: your name, email address, message, the page you sent it from, and a scrambled (hashed) form of your IP address used only to limit abuse | To answer you | Supabase database |
We do not collect card numbers. Payments are handled by Stripe, which has its own privacy policy.
joules sends nothing unless you ask it to: --share (or joules share) sends the leaderboard fields above, and --track sends the tracked-run fields above. It never sends prompts, outputs, command arguments, inline code, host names, file paths or file contents.
Teams. If you join a team, its members see your email address, your role, when you joined, and the team runs sent with keys you made. Your own runs, keys and settings stay private to you.
Alert webhooks. If you give a webhook address (for example a Slack or Discord channel), we send each alert to it: the project, the run's label, its energy and the usual energy. That service then handles the message under its own terms.
What we do not do
- No advertising, and no selling or renting of your data.
- No analytics or tracking scripts, and no third-party cookies.
- The leaderboard never shows names or emails. It only shows medians, run counts and the number of people. The public home page shows the three lowest-energy rows of it, the same way.
Why we use your data
For people in the European Union, the United Kingdom and other places with similar laws, these are our legal bases:
- To provide the service you signed up for (performance of a contract): your account, saved and tracked runs, API keys, teams, alerts, Live and billing.
- Because you choose to (consent): sharing measurements to the leaderboard. You can withdraw it at any time by removing the measurement.
- Our legitimate interests: keeping the service secure, limiting abuse (for example the hashed IP address on the contact form), answering messages you send us and, for accounts made for an organisation, offering it a plan, academic pricing or a pilot that fits.
- The law (legal obligation): keeping billing records for tax.
Data your organisation sends
When a company or university uses WattOps for its team or fleet, it decides what its machines send, such as job and user names in Live heartbeats or invite email addresses. For that data we act on the organisation's behalf, as its processor. Our Data Processing Agreement applies to that data automatically, and we can countersign a copy on request.
Your browser
The site uses your browser's local storage for your sign-in session, theme, calculator inputs, dismissed tips and a team invite link you opened before signing in. Nothing in local storage is used for tracking.
Services we use (sub-processors)
| Service | What it does for us | Where |
|---|---|---|
| Supabase | Database and sign-in | United States (us-east-1) |
| Vercel | Website and API hosting. Vercel keeps standard request logs (IP address, browser) for a short time. | United States and Vercel's global network |
| Stripe | Payments | United States and other countries |
| jsDelivr | Serves the sign-in library | Global network |
| Google Fonts | Serves the typefaces. Your browser fetches them from Google. | Global network |
| GitHub and Google | Show your profile picture, if you signed in with them. Your browser fetches it from them. | United States |
These providers process data only to run their part of the service, under their own data processing terms. We will update this list when we add or change a provider that handles your data.
Where your data is stored, and transfers. We are based in Canada. Our database and sign-in run on Supabase in the United States (us-east-1), and the providers above may process data in the United States and other countries. For personal data from the European Economic Area, the United Kingdom or Switzerland, transfers to Canada rely on Canada's adequacy decision, and transfers to the United States rely on the providers' data processing agreements, which include the European Commission's standard contractual clauses (and the UK addendum). While your information is in another country, it may be accessible to courts and authorities there under their laws.
How long we keep data
- Your account data is kept until you delete your account.
- Usage counters older than the current month are kept only as monthly totals.
- Revoked API keys are kept as records, without the key itself, so that old usage still adds up.
- Billing records are kept as long as tax law requires (in Canada, generally six years).
- Live heartbeats are deleted automatically after 6 hours.
- Contact form messages are kept as long as we need them to help you and to keep a record of the conversation.
Your choices and rights
- Saved runs: delete them on the Saved runs page.
- Tracked runs: remove them on the Tracking page.
- API keys: revoke them under Settings → API keys.
- Leaderboard measurements: remove them on the Leaderboard page.
- Teams: leave a team, or as its owner close it, under Settings → Team. Alerts: switch them off under Settings → Alerts.
- A copy of everything: download it under Settings → Your data.
- Your whole account: delete it under Settings → Delete account. Your saved runs, tracked runs, keys, usage, measurements, alerts and any team you own are deleted with it, and a paid subscription is cancelled first.
- Copy, correction or deletion: depending on where you live (for example under the GDPR, the UK GDPR, PIPEDA or the CCPA), you can ask for a copy of your data, a correction, or deletion. Under the GDPR and the UK GDPR you can also ask us to restrict or stop using your data, object to our legitimate interests, receive your data in a portable format (Settings → Your data gives you a JSON file), and withdraw consent. Contact us as below and we will reply within 30 days. You can also complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, your local data protection authority in the European Union, or the Information Commissioner's Office in the United Kingdom.
Security and breaches
We store API keys only as fingerprints, keep the database behind server-side functions, and use encrypted connections. If a breach of your information creates a real risk of significant harm to you, we will tell you and report it to the Privacy Commissioner of Canada as the law requires.
Children
The service is not meant for anyone under 16.
Changes
We will post changes here and update the date below.
Contact
Our privacy officer answers questions about this policy. Use the contact form at wattops.dev/#contact=privacy (choose "My data and privacy"). Only we see what you send there, and we reply by email.
PHENEX TECHNOLOGIES INC., Vancouver, British Columbia, Canada.