Privacy

Every page, tracker and article is readable without an account. If you never sign in, EVH holds an anonymous page count and, if you use Ask EVH, the questions you asked. Neither carries your name.

You can also file a report on any of the trackers without an account. Those are covered below, under What happens to a report.

EVH asks for the minimum that makes it work:

• Your email address, to sign you in and to send only what you have asked for.
• Your building, so a heating report can be counted in the right place.
• A display name, which can be a first name and an initial.

What is actually stored

Accounts live in EVH's database (Supabase, hosted in the United Kingdom: AWS London, eu-west-2), which is encrypted at rest. Against your account EVH holds:

• A stable account id EVH generates. You sign in with Google, a one-time email link or code, or Patreon, and EVH records which of those you have linked and the id each one gives back.
• Your email address. Only the parts of EVH that sign you in or send you something read it, and it is never shown to anyone else.
• Your display name, building and the topics you follow, and a postcode if you added one in settings (EVH no longer asks for it).
• Your colour and theme choice, and the seed for your generated initials avatar.
• Your choices about email, such as whether you get the weekly email.
• A one-time sign-in link and code when you ask for one, both stored hashed. The link expires after 24 hours, the code after 20 minutes, and both are cleared once used.
• Timestamps: when the account was created, verified, and last seen.

Lawful basis: contract, for the account itself; consent, for digest emails.

Saves, follows and notifications

• Saves: the type, slug and title of each thing you save.
• Follows: the type and key of each tracker or topic you follow.
• Helpful marks: the articles and pages you mark as helpful. Your display name and initials can appear beside that article, among the people who found it helpful.
• Notification preferences: which channels you want (on-site inbox, email, and browser push if you turn it on), how often, and which topics.
• Your inbox: the notifications shown to you, and whether you have read them.

Apart from helpful marks, only you ever see any of it. Lawful basis: contract. If you turn on browser push EVH also stores the endpoint your browser gives it and the two encryption keys needed to reach it, plus your user-agent and when it was last used, so failing subscriptions can be retired. Push is off until you turn it on, and the subscription is deleted the moment you turn it off. Lawful basis: consent.

Patreon, if you link it

Linking Patreon gives EVH your Patreon user id, your current tier, and a token that lets EVH re-check that tier. It is used to work out your access level and nothing else: no advertising, no profiling beyond EVH features. Lawful basis: contract, and legitimate interest in keeping tiers accurate.

Posting under your own name

A verified resident can tick "post this under my display name" when filing a report. If you do, your display name is published beside that report and the report is linked to your account so it appears in your dashboard. It is opt-in per submission, anonymous is the default, and deleting your account strips the name and the link while the report itself stays in the public record anonymously. Lawful basis: consent.

Your public profile

Once you finish signing up, your account has a profile page showing your display name, your initials avatar, when you joined, a count of some of the tracker reports you have filed while signed in, and a badge if you are a supporter or an administrator. Your Patreon tier is shown only if you chose to show it. It never shows your email, your building or what the reports said. Lawful basis: contract.

Comments

A comment stores your account, the text, and whether it was approved. Before it appears, the text is sent to Anthropic's Claude, which publishes comments that are clearly fine, rejects ones that clearly break the guidelines, and holds everything in between for me to read. A rejection by Claude happens without a person seeing it first, so if you think it got yours wrong, tell me and I will look at it myself. Your display name is shown beside a published comment. Lawful basis: contract.

The audit log

Significant account actions (signup, verification, profile updates, exports, deletion requests) are logged privately with the action, the field names involved (never their values), and a hashed IP for deletion requests. It is kept for 24 months and included in your data export. Lawful basis: legitimate interest in account security.

A report is published as part of a count, a breakdown or a map area. Your display name is beside it only if you chose to post it under your name. Locations on a map are rounded to roughly 110 metres before anything is drawn.

I see the text of a report and the building, so I can check it. Your email address is not shown alongside it.

What a report carries depends on the tracker:

• Phone and bag snatch: the incident date and time of day, the rounded location, an optional street name, whether you told the police, and an optional device type.
• Parcel theft: the drop point, the courier, whether you reported it, when, and any detail you add.
• District heating: the building, and the outside temperature and wind speed at the time, fetched from a public weather API for the fixed E20 location. Nothing about you.
• Sippi parking: your landlord, the issue, and an optional description. For a permit issue: the outcome and whether a PCN was issued. For a bay blocked with no enforcement: the car park or street, whether you reported it and what Sippi did, and whether it has happened before. Never the bay number, because an allocated bay identifies a household. If you give a name, email or postcode for the formal escalation, those are stored apart from the report, never published, and only used in correspondence with your MP or councillor.
• Foxtail sightings: the spot you describe, whether a dog was affected, your photograph, and an email address if you give one so I can ask about it. The email is never published. The description becomes the public map label, so keep it about the place.
• Hyperoptic: the building, and whether the whole building or just your flat is down. Never your flat number.

To stop the same device filing the same thing twice, EVH keeps a one-way hash of your IP address for a short time (see rate limiting below). Sippi reports and foxtail sightings keep that hash with the report. The raw address is never stored. Lawful basis: legitimate interest in giving residents accurate community information, except Sippi, where you tick a consent box, and that is consent.

Offer claims

Claiming a resident offer code stores a one-way hash (SHA-256) of your email, so the same person cannot claim twice and you can retrieve your code on return, plus the date it was claimed and redeemed. It also stores your email address, encrypted, so EVH can email you your code, a receipt when you use it and a reminder before the offer ends. It is never shown to the business. Lawful basis: legitimate interest in preventing duplicate use and in sending you the code you asked for.

Forms and submissions

The contact form collects your name, email and message. It is emailed to me, kept in EVH's review queue, and sorted and passed on in the same way as a tip (below), so I can follow it up. Community submissions (events, recommendations, dog profiles, group listings) go into the same queue, with your email kept apart from anything that could be published, and any photo held in EVH's file storage. If I approve one, the listing is published as part of the site's content, without your email address. Claiming a business listing collects your name, email and role, and creates a Business Portal account if approved. Lawful basis: legitimate interest, and contract for the portal account.

The tip line

A tip stores what you sent, a place if you gave one, any photo you sent on WhatsApp, and how it reached us: the form, email or WhatsApp. A form tip is anonymous unless you leave a contact. An email tip keeps your email address, and a WhatsApp tip keeps your number, so we can reply; WhatsApp tips get one automatic thank-you. Photos are kept privately and never published without asking you. Claude reads each tip to sort it (a story, a report, a question) and, if it could be a story, passes it to the agent that drafts EVH's articles, which checks it against a public source before writing anything. Nothing is published until we've checked it, and your contact details never are. Tips reach us in a private Slack channel, which shows whether you left a way to reply but not the address or number itself; the Slack copy stays until we delete it. Lawful basis: legitimate interest.

Contributions and memberships

Giving once goes through Stripe's checkout. Stripe takes your card details and email under its own privacy policy. EVH never sees your card. It records the amount you chose and whether the contribution was started and completed, as part of its own count below. Lawful basis: contract.

If you become a supporter through Stripe, EVH also keeps your Stripe customer and subscription references and whether you pay monthly or yearly, so your tier and its perks follow your payments. Deleting your account cancels the membership and removes those references; Stripe keeps its own payment records under its own policy. Lawful basis: contract.

Rate limiting and bot protection

A one-way hash of your IP is held briefly to stop automated abuse: a few minutes for offer claims, 30 minutes for heating and Hyperoptic reports, 24 hours for snatch, Sippi and parcel reports. Raw addresses are never stored and the hashes expire on their own. The offer claim form also uses Google reCAPTCHA v3, which sends browser and usage signals to Google. Lawful basis: legitimate interest.

Ask EVH and search

Your question is sent to Voyage AI to find relevant pages and to Anthropic's Claude to write the answer from them, with no access to the open web. Neither uses it for training. Arize, a monitoring service in the United States, gets a copy of the question and the answer so I can check the AI is giving good answers; it carries no account or IP address. EVH stores each question and the answer it gave, with a one-way hash of your IP address (and your account, if you are signed in), so I can check the answers are right and see what residents need. Questions many people ask can appear as suggestions for others, without anyone's details. If you add your own figure to an "is this normal?" answer, EVH stores the number, your building and flat size to build the comparison, never your name. Lawful basis: legitimate interest.

Analytics

Only with your consent, and there are two separate choices. Counting visits turns on Google Analytics, with IP anonymisation and no cross-site tracking. Recording sessions turns on replays of taps and scrolling, with typing masked: Microsoft Clarity, processed by Microsoft and possibly outside the UK. “Yes” on the cookie bar turns on both, and you can switch either off at any time. Everything is off until you say yes, and saying no deletes the cookies. Until 10 October 2026 EVH also used PostHog, hosted in the EU, which was sent the email and display name of residents who signed in. EVH no longer uses it, and everything it held was deleted on 10 October 2026. Lawful basis: consent. See the cookies page for the exact list.

Separately, EVH counts a few moments on its own server, such as a supporter request being shown or dismissed, a tap on supporting, signing up or Ask EVH, a visit to the support pages, linking Patreon, and the amount if you give once. Each one carries the page, a random id that lasts until you close the tab, and a one-way hash of your IP address, kept with the count. There is no cookie, and none of it goes to Google or Microsoft. Lawful basis: legitimate interest.

Nothing is kept because it might be useful one day.

• Snatch, Sippi and foxtail reports: 12 months, then deleted.
• Parcel theft reports: 24 months, then deleted.
• District heating reports: kept indefinitely. The timestamp, building and weather are an independent performance record of the network, and they contain nothing about you.
• Sippi contact details: 12 months, or sooner if you ask.
• Offer claim records: the length of the offer plus 30 days. Your encrypted email address goes then too, or 12 months after you claim if the offer has no end date.
• IP rate-limit hashes: a few minutes to 24 hours, depending on the feature.
• Contact form messages: 12 months in the review queue.
• EVH's own counts and their IP hashes: 24 months, then deleted.
• Tip line messages and their photos: 12 months in EVH's database, then deleted. The Slack copy stays until we delete it.
• Community submissions: in the review queue until I decide, then 12 months. Published content stays while it is live, or until you ask me to remove it.
• Hyperoptic reports: kept indefinitely, like heating. They hold a building and nothing about you.
• Ask EVH questions and answers: 12 months.
• Business Portal accounts: while the account is active.
• Your account, saves, follows and preferences: while the account is active.
• Push subscriptions: while active; deleted on unsubscribe or once delivery starts failing.
• The audit log: 24 months.

Deleting your account scrubs your profile and deletes your saves, follows, preferences and push subscriptions in one step. Your reports are unlinked from you and stay in the public record anonymously.

You can ask for a copy of everything EVH holds about you, ask me to correct it, or ask me to delete your account and your reports. One email is enough and I do not ask why.

With a My E20 account you do not have to ask at all: Download export in your settings gives you everything EVH holds as a JSON file, and Delete account does the erasure described above.

Under UK GDPR you have the right to:

• Access: a copy of your data.
• Erasure: deletion of it.
• Rectification: correction of anything wrong.
• Restriction: limits on how it is used.
• Objection: to anything EVH does on the basis of legitimate interest.
• Portability: your data in a portable format, where that applies.

I aim to answer within seven days. The legal limit is one month. If I get it wrong you can complain to the Information Commissioner's Office.

EVH is run by residents, not by a landlord or the council. Neither Get Living, Triathlon Homes, EVML nor Newham Council has access to your account or your reports. East Village Hub is the data controller for everything on this page.

These are the companies that process data for EVH:

• Netlify: hosting, and the functions that run the site.
• Supabase: the database and file storage holding accounts, reports, comments, submissions and photos, in the United Kingdom.
• GitHub: holds the site's published content. An approved submission becomes part of it, without your email address.
• Resend: sends sign-in emails, digests, alerts and forwarded form submissions, and receives tips emailed to tips@eastvillagehub.co.uk.
• Meta (WhatsApp): carries tips sent to the tip line's WhatsApp number, under WhatsApp's own terms.
• Anthropic: Claude writes Ask EVH's answers and checks comments. Not used for training.
• Voyage AI: turns your question into a search. Not used for training.
• Arize: keeps a copy of Ask EVH questions and answers, and of comments Claude checks, so I can see whether the AI is working. In the United States.
• Slack: where tip line messages reach us.
• Stripe: takes one-off contributions and supporter memberships. EVH never sees your card.
• Patreon: monthly support, and sign-in with Patreon if you choose it, under Patreon's own terms.
• Google: sign-in with Google if you choose it, reCAPTCHA on offer claims, and Analytics with your consent.
• Microsoft: Clarity, with your consent.

Some pages also load things straight from other services, which then see your IP address the way any website does: the weather from Open-Meteo, the lettering on maps from Protomaps (on GitHub Pages), and YouTube's privacy-enhanced player where an article embeds a video.

EVH does not sell your data, use it for advertising, or share it beyond what is on this page. If this policy changes materially, it will say so here, in What changed at the top.