Every page, tracker and article is readable without an account. If you never sign in, the only thing we hold is an anonymous page count that cannot be traced back to you.

You can also file a report on any of the trackers without an account. Those are covered below, under What happens to a report.

We ask for the minimum that makes the product work:

• Your email address, to sign you in and to send only what you have asked for.
• Your building, so a heating report can be counted in the right place.
• A display name, which can be a first name and an initial.

What is actually stored

Accounts live in our own database (Supabase, hosted in the United Kingdom — AWS London, eu-west-2). Against your account we hold:

• A stable account id we generate. You sign in with Google, a one-time email link, or Patreon, and we record which of those you have linked.
• A one-way hash (SHA-256) of your email, used to join your account to reports and offer claims you filed anonymously before signing up, and to spot duplicate signups.
• An encrypted copy of your email (AES-256-GCM), decrypted only at the moment of sending you something. It is never stored in plain text.
• Your display name, building, flat number, postcode, interests, bio and avatar, where you chose to give them.
• A hash of your postcode for aggregate counts, alongside the postcode itself for E20 verification.
• Your opt-in choices for the neighbour directory, community posting and email digests.
• A one-time verification token (stored hashed) when you ask for a sign-in link. It expires after 24 hours and is cleared once used.
• Timestamps: when the account was created, verified, and last seen.

Lawful basis: contract, for the account itself; consent, for the directory opt-in and for digest emails.

Saves, follows and notifications

• Saves — the type, slug and title of each thing you save.
• Follows — the type and key of each tracker or topic you follow.
• Notification preferences — which channels you want (on-site inbox, email, and browser push if you turn it on), how often, and which topics.
• Your inbox — the notifications shown to you, and whether you have read them.

Only you ever see any of it. Lawful basis: contract. If you turn on browser push we also store the endpoint your browser gives us and the two encryption keys needed to reach it, plus your user-agent and when it was last used, so failing subscriptions can be retired. Push is off until you turn it on, and the subscription is deleted the moment you turn it off. Lawful basis: consent.

Patreon, if you link it

Linking Patreon gives us your Patreon user id, email, name and current tier. We use it to work out your access level and nothing else — no advertising, no profiling beyond EVH features. Lawful basis: contract, and legitimate interest in keeping tiers accurate.

Posting under your own name

A verified resident can tick "post this under my display name" when filing a report. If you do, your display name is published beside that report and the report is linked to your account so it appears in your dashboard. It is opt-in per submission, anonymous is the default, and deleting your account strips the name and the link while the report itself stays in the public record anonymously. Lawful basis: consent.

The neighbour directory

Opt in and other signed-in verified residents can see your display name, building, interests, a count of your submissions, and the month you joined. Never your email, postcode, flat number or exact signup time. Off by default, and reversible from your profile. Lawful basis: consent.

The audit log

Significant account actions — signup, verification, profile updates, exports, deletion requests — are logged privately with the action, the field names involved (never their values), and a hashed IP for deletion requests. It is kept for 24 months and included in your data export. Lawful basis: legitimate interest in account security.

A report is published as part of a count, a breakdown or a map area — never as a record with your name on it. Locations on a map are rounded to roughly 110 metres before anything is drawn.

I see the text of a report and the building, so I can check it. Your email address is not shown alongside it.

What a report carries depends on the tracker:

• Phone and bag snatch — the incident date and time of day, the rounded location, an optional street name, whether you told the police, and an optional device type.
• Parcel theft — the drop point, the courier, whether you reported it, when, and any detail you add.
• District heating — the building, and the outside temperature and wind speed at the time, fetched from a public weather API for the fixed E20 location. Nothing about you.
• Sippi parking — your landlord, the issue, and an optional description. For a permit issue: the outcome and whether a PCN was issued. For a bay blocked with no enforcement: the car park or street, whether you reported it and what Sippi did, and whether it has happened before — never the bay number, because an allocated bay identifies a household. If you give a name, email or postcode for the formal escalation, those are stored apart from the report, never published, and only used in correspondence with your MP or councillor.
• Foxtail sightings — the spot you describe, whether a dog was affected, and your photograph. The description becomes the public map label, so keep it about the place.

Every one of them also stores a one-way hash of your IP address, which exists only to stop the same device filing the same thing twice. The raw address is never stored. Lawful basis: legitimate interest in giving residents accurate community information — except Sippi, where you tick a consent box, and that is consent.

Offer claims

Claiming a resident offer code stores a one-way hash (SHA-256) of your email — never the address itself — so the same person cannot claim twice and you can retrieve your code on return, plus the date it was claimed and redeemed. Lawful basis: legitimate interest in preventing duplicate use.

Forms and submissions

The contact form collects your name, email and message, and is forwarded to the team by email; nothing is kept beyond that thread. Community submissions — events, recommendations, dog profiles, group listings — store your name and email with the draft in our CMS, visible only to administrators, so we can ask about it. Claiming a business listing collects your name, email and role, and creates a Business Portal account if approved. Lawful basis: legitimate interest, and contract for the portal account.

Rate limiting and bot protection

A one-way hash of your IP is held briefly to stop automated abuse: a minute for offer claims, 30 minutes for heating reports, 24 hours for snatch, Sippi and parcel reports. Raw addresses are never stored and the hashes expire on their own. The offer claim form also uses Google reCAPTCHA v3, which sends browser and usage signals to Google. Lawful basis: legitimate interest.

Ask EVH and search

Your question is sent to Voyage AI to find relevant pages and to Anthropic's Claude to write the answer from them, with no access to the open web. Neither uses it for training. If you allowed counting visits, the text of a search is also stored anonymously to improve suggestions, unattached to you or your session, and deleted after 90 days. Lawful basis: legitimate interest, and consent for the stored query text.

Analytics

Only with your consent, and separately for each: Google Analytics for counting visits, with IP anonymisation and no cross-site tracking; Microsoft Clarity for session replays and heatmaps, with typing masked, processed by Microsoft and possibly outside the UK. Both are off until you say yes, and turning either off deletes its cookies. Lawful basis: consent. See the cookies page for the exact list.

Nothing is kept because it might be useful one day.

• Snatch, Sippi and foxtail reports — 12 months, then deleted.
• Parcel theft reports — 24 months, then deleted.
• District heating reports — kept indefinitely. The timestamp, building and weather are an independent performance record of the network, and they contain nothing about you.
• Sippi contact details — 12 months, or sooner if you ask.
• Offer claim records — the length of the offer plus 30 days.
• IP rate-limit hashes — 60 seconds to 24 hours, depending on the feature.
• Contact form messages — the email thread only; no database record.
• Community submissions — while the content is live, or until you ask us to remove it.
• Business Portal accounts — while the account is active.
• Your account, saves, follows and preferences — while the account is active.
• Push subscriptions — while active; deleted on unsubscribe or once delivery starts failing.
• The audit log — 24 months.
• Search query text — 90 days.

Deleting your account scrubs your profile and deletes your saves, follows, preferences and push subscriptions in one step. Your reports are unlinked from you and stay in the public record anonymously.

You can ask for a copy of everything we hold, ask us to correct it, or ask us to delete your account and your reports. One email is enough and we do not ask why.

With a My E20 account you do not have to ask at all: Download export in your settings gives you everything we hold as a JSON file, and Delete account does the erasure described above.

Under UK GDPR you have the right to:

• Access — a copy of your data.
• Erasure — deletion of it.
• Rectification — correction of anything wrong.
• Restriction — limits on how we use it.
• Objection — to anything we do on the basis of legitimate interest.
• Portability — it in a portable format, where that applies.

We aim to answer within seven days. The legal limit is one month. If we get it wrong you can complain to the Information Commissioner's Office.

EVH is run by residents, not by a landlord or the council. Neither Get Living, Triathlon Homes, EVML nor Newham Council has access to your account or your reports. East Village Hub is the data controller for everything on this page.

These are the companies that process data on our behalf:

• Netlify — hosting, and the sign-in behind the Business Portal and admin tools.
• Supabase — the database holding accounts, reports and comments, in the United Kingdom.
• Sanity — the CMS holding community submissions and business listings.
• Resend — sends verification emails, digests and forwarded form submissions.
• Anthropic — Claude writes Ask EVH's answers and moderates comments. Not used for training.
• Voyage AI — turns your question into a search. Not used for training.
• Google — reCAPTCHA, Maps, and Analytics with your consent.
• Microsoft — Clarity, with your consent.

We do not sell your data, use it for advertising, or share it beyond what is on this page. If this policy changes materially we will say so here, in What changed at the top.