Privacy policy

The short version

You can use everything on this site without an account, a name, or a phone number. Outage reports are anonymous. We collect the minimum needed to keep the map honest and stop spam, and we do not sell personal data. The data product we sell is aggregate outage statistics, never information about individual people.

What we collect, and why

• Outage reports and updates. The location or estate you submit, the time, and any note you write. Stored with a one-way hash of your IP address and browser signature, used only to de-duplicate votes and rate-limit spam (3 reports per hour per device). The hash cannot be reversed into your identity and is never shown publicly. Your IP address itself is processed in transit, as on any website (our hosting providers keep short-lived security logs), but we do not store it, display it, or attach it to reports or updates.
• Area watch. Your watched estates, alert channels, and quiet-hours preference live in your browser's local storage, on your device. If you enable push alerts, we store your push endpoint and watched area names so we can deliver notifications; the endpoint identifies your browser, not you.
• Optional sign-in. If you choose to sign in with Google, we store your email address and your watchlist so it follows you across devices. Sign-in is never required and is never linked to your outage reports, which stay anonymous. You can sign out at any time; ask us to delete the synced copy and we will.
• Presence. The "neighbours on the map" counter is an anonymous heartbeat from each open tab with no identifier stored; counts reset when you close the page.
• Analytics. We use privacy-friendly, cookie-less page analytics (Vercel Web Analytics) to count visits and pages. No cross-site tracking, no advertising identifiers.
• B2B contact. If you leave your email on the Data & API page, we use it to contact you about that and nothing else.

What we publish

The public map shows outage locations, statuses, report counts, and anonymous update text. Planned interruption data comes from publicly published Kenya Power notices, attributed as such. We never publish anything that identifies a reporter.

Retention and your rights

Outage history is kept indefinitely as an aggregate public record. Device hashes serve no purpose after rate-limiting and are not used for anything else. Under the Kenya Data Protection Act you may request access to, correction of, or deletion of personal data we hold (a synced watchlist or a lead email): write to privacy@power4.africa. Because reports are anonymous, we cannot link them to you and therefore cannot retrieve or delete them by person.

Third parties

Hosting on Vercel, database and authentication on Supabase, map tiles from CARTO/OpenStreetMap, sign-in (optional) by Google, push delivery by your browser vendor. Each receives only what is technically necessary to provide its service. We do not sell or share personal data for advertising.

Changes

We will update this page when practices change and note the effective date above. Questions: privacy@power4.africa.