What Sunpatch keeps

Using the app

Your gardens

Saved in your browser’s local storage, on your device. They aren’t sent to Sunpatch. A few settings are kept there too: whether the side panel is open, which tips you’ve seen, the postcodes you’ve looked up, the weather you picked, and map answers, so they aren’t asked for twice. Clearing this site’s data in your browser removes all of it.

Visits

Sunpatch’s server only sends the app’s files. It sets no cookies. The web server keeps a standard access log (the IP address, the page asked for and the time), rolled over and deleted within 90 days.

Share links and reports

A share link carries the whole garden after the # in the address. Browsers don’t send that part to a server, so sharing a garden uploads nothing, but anyone with the link can open it. The sun report page is made in your browser from the same link.

Services your browser asks directly

To draw your garden, the app fetches from these services itself. Each one sees your IP address and what was asked.

postcodes.io

The postcode you type, or the point you pick on the map, to find its postcode.

OpenStreetMap

Map tiles for the area on screen, from tile.openstreetmap.org.

Overpass API

The buildings, fences and gardens in a box around the place: overpass-api.de, or if it’s busy, overpass.private.coffee, maps.mail.ru or overpass.kumi.systems.

Open-Meteo

The place’s latitude and longitude, for its weather record and its height above the sea.

Google Fonts

The typefaces. Google sees your IP address and your browser.

When an assistant uses Sunpatch

AI assistants such as Claude can build a garden through Sunpatch’s MCP server. Your photos never reach Sunpatch: the assistant looks at them and sends only what it concluded.

The garden

Kept on Sunpatch’s server as a file, with each version saved: the place and its name, the house, the neighbours, the boundary, trees and structures. There’s no automatic deletion yet; ask and it’s deleted.

The address

An address or postcode the assistant sends is looked up from the server with Nominatim (OpenStreetMap’s search), OpenStreetMap’s address data through Overpass, and postcodes.io. The answers are kept for 30 days, so the same address isn’t looked up twice. While the garden is worked on, the server’s own browser asks the services above for the place; they see the server, not you.

Links and reports

A short link (/g/…) is the garden’s full share link, kept on the server so the short one works; it doesn’t expire. A full sun report is kept on the server as a PDF and as text; the download link the assistant gives you works for 7 days.

Accounts

The full report needs a free account, made with your email address through the assistant. The server’s database keeps:

Your email address

And when the account was made.

Codes, keys and password

The 6-digit code we email is stored only as a hash and works for 15 minutes. API keys are stored only as hashes, with their first few characters so you can tell them apart, a label (usually the assistant’s name), and when each was made, last used and revoked. A password, if you set one, is stored as a scrypt hash.

Your gardens and their credits

Which gardens are yours, and who made each: your name if you gave it to the assistant, the assistant’s name and the app it ran in (“Made by Robin with Claude”).

Limits on codes

Each code request records the email address and the IP address it came from, to stop anyone sending a flood of codes. These records are deleted after an hour.

The email

Sent through a mail provider, Resend, which receives your email address and the message. No copy is kept on the server.

Who runs it, and your say

Sunpatch is made by Robin Metcalfe (Solarise), in Edinburgh. To see, correct or delete what’s kept about you or your garden, or to ask about any of this, get in touch.

Last changed 30 September 2026.