Privacy Policy

Status: 15 November 2026

This privacy policy informs you how Corvin Hartmann (“we”, “us”) processes personal data when you PowerMonitor (“Services”) - in particular the web app at powermonitor.net.

Questions or concerns? Read this statement. If you do not agree with our practices, please do not use the Services. Contact: corvin_hartmann@gmx.de. Further provider information can be found in Imprint.

Quick overview

  • What data? Depending on how you use the site, we process optional account details, content you save (such as favourites and analyses), technical access data and aggregate page view counts.
  • Special categories? We do not process any special categories of personal data within the meaning of Art. 9 GDPR.
  • Third-party data about you? We do not obtain any third-party profiles about you; public energy data (e.g. ENTSO-E, MaStR) is not personal user data.
  • Without account: You can largely use the map, statistics and analytics without registering; then we do not store any of your account data.
  • Locally in the browser: Settings such as the map section or clipboard for Analytics imports can be in your browser (localStorage/sessionStorage) — not on our servers.

1. Responsible person

Responsible within the meaning of the GDPR:
Corvin Hartmann
Hirschgraben 24
52062 Aachen
Email: corvin_hartmann@gmx.de

2. What data do we collect?

2.1 Data you provide to us (optional, with account)

If you create or use an account (email/password or Google login via Firebase Authentication), we process in particular:

  • Email address and, if applicable, display name of the account
  • Content you have saved in Firebase Firestore, e.g. E.g. favorites, dashboard layout, saved analytics evaluations and personal clipboard under /copypaste
  • Technical identifier of the account (Firebase User ID)

2.2 Data collected automatically

When accessing the services, technical data may be generated, e.g. B. IP address, date and time of access, browser type, operating system, referrer URL and requested pages. This data is primarily needed to provide the services, detect errors and ensure security (hosting, Firebase, API calls).

2.3 How we count page requests

For ordinary GET requests to known pages, Firebase Hosting counts responses with status 200 or 304. In Cloud Monitoring we see separate totals for the selected period by site section and, when available, by country using the Firebase Hosting country code. Another total counts requests with both URL parameters utm_source=google and utm_medium=cpc.

Cloud Monitoring retains these counts for six weeks. Google temporarily processes the original requests to produce the counts. We exclude the associated new Hosting request logs from persistent storage and export in our project. This internal analysis stores no individual URLs, query parameters, IP addresses, cities, or user, click or campaign identifiers.

For successful page requests we count browser families and operating system families separately, using the user agent already sent with the request. For known pages we also count successful responses, redirects and errors. Each counter stores only a total for a fixed category. We do not store the full user agent or individual page paths in these counters, or link the totals to countries, accounts or visitor profiles.

Our legitimate interest under Article 6(1)(f) GDPR is to understand demand for our services and the reach of paid referrals. Aggregate counts meet this need without recognising individual visitors. You may object on grounds relating to your particular situation by writing to corvin_hartmann@gmx.de.

If you consent in the analytics settings, your browser also sends the page path to our service when you visit a statistics subpage. We use it to count weekly views of that page. You can withdraw consent at any time in the analytics settings for future visits.

2.4 Usage analysis with Firebase Analytics

Before you choose and if you decline, your browser sends Google Analytics a basic page-view signal to help us estimate reach. The signal also includes the broad public section of the site. No Analytics cookies are read or set for these signals. Google receives connection data such as your IP address, standard browser information and your consent status. PowerMonitor sends no identifier of its own for a user or browser, campaign parameters or detailed events in these signals. They cannot reliably count individual visitors.

With your consent, PowerMonitor uses Analytics cookies and also measures interactions, approximate engagement time and campaign parameters. Advertising cookies, sharing user data for Google advertising and ad personalization remain disabled. You can withdraw consent at any time in Privacy settings for future measurement. The blocking option in section 2.6, Global Privacy Control (GPC) or Do Not Track (DNT) also prevents the Analytics tag from loading and stops further basic signals.

2.5 Local storage in the browser

Without sending it to us, the following can be saved in the browser: map section, clipboard for import into Analytics, cache entries for faster display. You can delete this data in the browser settings.

2.6 PowerMonitor’s session count

If you consent to usage analytics, your browser notifies PowerMonitor when you open a page or move to another page path. The request body always contains only “consent=granted”. The request sends no cookies, page paths, referrer URLs or account IDs. The server uses only the network prefix of the IP address (IPv4 /24, IPv6 /48) and the browser and operating system families from the user agent. A secret key that changes daily turns these into a pseudonymous day identifier. The counter does not store full IP addresses or user agents.

A new session starts after 30 minutes without further navigation or at the start of a new UTC day. For each day identifier we store its expiry, the time of the latest signal and whether there was a follow-up. We regularly remove expired records. From the introduction of this measurement, we count navigation signals, sessions included in this measurement and sessions with a follow-up each day. We sum the time from the first to the last observed signal. Only sessions with at least two signals contribute to the average. Time spent on the final page and the duration of a visit with one signal remain unknown. This uses no extra browser requests and keeps no page history. Shared networks and similar devices can merge visits, while changing networks can split them. We rely on your consent for this measurement (Article 6(1)(a) GDPR). You can withdraw consent at any time in Privacy settings for future measurements. This setting is stored locally.

2.7 Umami

We run Umami ourselves on Google Cloud in Belgium. Whatever you choose for detailed analytics, we estimate how many visitors use our site each UTC calendar month. Umami combines the site, IP address and browser user agent with a salt that changes monthly to generate a pseudonymous identifier. Changing network or device can count one person twice. People sharing a connection and the same user agent can count as one. Visits are estimated in hourly windows. A temporary token in the tab’s memory can link navigation across the hour. Umami sets no cookies and saves no identifier in browser storage.

For each view we record the time and broad site section. Umami derives browser, operating system and device families from the user agent. We estimate the country of the internet connection on our server from the IP address using DB-IP Country Lite (CC BY 4.0). We do not send the IP address to DB-IP. This measurement excludes city, region, query parameters, referrers, account IDs, screen size and language. When a page is viewed, we associate the last known country with the monthly visitor identifier. Individual event and session records are deleted after 35 to 36 days. Backups may retain them for up to seven more days. Only monthly totals are kept in Cloud Monitoring for 24 months. We rely on our legitimate interest in estimating monthly reach (Article 6(1)(f) GDPR). You can stop collection using the opt-out in section 2.6 or GPC/DNT.

3. Purposes and legal bases

  • Provision of PowerMonitor (map, statistics, analytics): Art. 6 Para. 1 lit. b GDPR (contract/pre-contractual measures) or lit. f GDPR (legitimate interest in a functional information offering)
  • Optional account functions (favorites, saving): Art. 6 Para. 1 lit. b GDPR
  • Security, error analysis and the server-side request counts in section 2.3 are based on Article 6(1)(f) GDPR.
  • For basic signals, we rely on our legitimate interest in estimating the reach of our service through aggregate statistics (Article 6(1)(f) GDPR). Detailed analytics, PowerMonitor session counting and browser-reported views of statistics pages rely on your consent (Article 6(1)(a) GDPR).

4. Transfer and order processing

We use services from the Google Firebase / Google Cloud platform for operation and account functions (including hosting, authentication, firestore, storage and Google Analytics for Firebase as described in section 2.4). Google can also process data in third countries (e.g. USA); The data protection mechanisms provided by the provider apply (e.g. standard contractual clauses). Further information: Firebase Privacy.

It will not be passed on to third parties for advertising purposes. In the event of company transfers (e.g. merger), data can be transferred within the scope of the legal requirements.

5. Storage period

We store account and user content until you delete it or have your account removed. Technical protocols and anonymous counters are only retained for as long as is necessary for the respective purpose or as long as there are legal retention requirements.

The storage period of analytics data depends on the settings of the associated Firebase-/Google-Analytics-Property. We save your consent decision locally in your browser so that we can take it into account on subsequent visits.

6. Security

We take appropriate technical and organizational measures. However, complete security of data transmissions over the Internet cannot be guaranteed.

7. Children

The Services are not directed to persons under 18 years of age. We do not knowingly collect data from minors.

8. Your rights

Depending on the applicable law, you have in particular the right to information, correction, deletion, restriction of processing, data portability and objection to processing on the basis of legitimate interests. You can submit a complaint to a supervisory authority (e.g. North Rhine-Westphalia State Commissioner for Data Protection). Please send inquiries to corvin_hartmann@gmx.de.

9. Changes

We may adapt this privacy policy if the services or the legal situation change. The current version is available on this page.