Privacy policy

What we collect, why, and — mostly — what we do not do with it. We do not advertise, we do not track you from one site to the next, and nobody receives your contact details unless you tick a box asking us to send them.

Who we are

Home Energy Planner is operated by Rabbits Foot Limited, a company registered in England and Wales (company number TODO), whose registered office is at TODO. Rabbits Foot Limited is the data controller for everything described on this page.

We are an independent site. We are not a government body and have no connection to any of the schemes we describe.

For anything on this page, including any of the rights below, email richard@rabbitsfoot.co.uk.

Reading this site collects nothing

There are no analytics, no advertising tags and no tracking cookies anywhere on this site. That is why you have not been asked to accept any: there is nothing to accept. You can read every page here, including this one, without us learning anything about you beyond the server logs described further down.

One cookie exists. It is called hep_token, it holds the key that connects your browser to your own assessment, and it is set only once you start one. It is marked httpOnly, which means no script in the page — ours or anybody else’s — can read it. It is strictly necessary for the service to work and is used for nothing else.

What we collect when you use the tool

Your assessment answers. Your postcode, and then whatever you choose to tell us about the property: its type, roughly how big it is, how it is heated, what insulation and glazing it already has, what you use or spend on energy, and what you are hoping to achieve. Almost all of it is optional, and none of it asks who you are.

We ask for a full postcode because which schemes apply depends on where a home is. What is stored against your assessment is the outward code — the first half, the part that covers thousands of homes — not the full postcode.

Your answers are also kept in your own browser, so closing the tab does not lose your progress. That copy sits on your device rather than on our servers, and clearing your browsing data for this site removes it.

A quote request, if you make one. Your name, your email address, a phone number if you give one, the first part of your postcode, and which improvement you want quoting for. None of it goes anywhere until you tick the consent box, and we record the exact wording you agreed to, with a version and a timestamp, so it stays clear what you said yes to rather than resting on our word for it.

Ordinary technical records. Our host and our own API keep server logs, which include your IP address, so that we can keep the site up and stop one machine submitting ten thousand assessments. When you click a commercial link, your IP address reaches our API and the click is recorded against a hash of it rather than the address itself — enough to spot a robot, not enough to identify a person.

Errors, when something breaks. We use Sentry to record errors and a sample of performance traces, which is how a form that fails for one browser gets found at all. On the assessment and results pages we also load Sentry’s session replay, which can record a reconstruction of what happened in the page around an error — what was clicked and what the page did, so that a fault can be diagnosed by someone who cannot see your screen. It is not loaded on any other page.

Why we are allowed to hold it

To produce the answer you asked for. Our legitimate interest in providing the thing you came here to use. You can stop at any point and nothing further is stored.
To pass your details to an installer. Your consent, and only your consent. There is no other route from you to a company, and no code path from an unticked box to a provider.
To keep the site working and to stop abuse. Our legitimate interest in a service that is available and not being scraped or flooded.
To keep records the law requires us to keep. A legal obligation — principally the record of a consent, which exists to prove that we had one.

Who else sees it

One installer, if you ask for a quote. One company, for the one improvement you asked about, after you ticked the box. Not a panel of them, and not for anything else.

Suppliers who work on our behalf. Vercel hosts the site. Sentry receives the error reports described above. They act on our instructions and may not use what they process for their own purposes.

Nobody who pays for it. We do not sell personal information, we do not share it with data brokers or advertising networks, and we do not build a profile of you to rent out. If that ever changes it would be a different service, and this page would say so before it happened rather than after.

When you follow a commercial link you arrive at another company’s website, and from that point their privacy policy applies rather than ours. We send them a visitor; we do not send them your answers.

Where it is held

We keep personal information in the UK or the European Economic Area wherever we can — our error monitoring, for instance, uses Sentry’s EU region. Where a supplier processes data outside the UK, we rely on the UK’s adequacy regulations for that country or on the International Data Transfer Addendum, which obliges them to protect it to the same standard.

How long we keep it

Rather than a single figure that would be wrong for most of it, here is what actually decides:

The copy in your browser is yours. It stays until you clear your browsing data.
An assessment is kept while its results link still needs to work, and so that we can still show the workings behind a plan months later against the figures that produced it.
A quote request is kept while the enquiry is live, and the record of your consent for as long as we could be asked to prove we had it.
Server logs and click records are kept briefly, for security and for counting, and the click records identify a machine by a hash rather than an address.
Error reports expire on Sentry’s own retention schedule.

You do not have to wait for any of that. Ask us to delete it and we will.

The ranking is automatic. It decides nothing about you

Your plan is produced by software, not by a person reading your answers. It is worth being plain about what that does and does not mean: it works out what each improvement would do in a home like yours and puts them in an order. It does not decide whether you can have something, it produces no legal effect, and no company can pay to move a result up it.

How we rank recommendations explains the order and what controls it, and every plan carries the figures and sources it was built from.

Your rights

Under UK data protection law you can ask us to:

Tell you what we hold about you, and give you a copy.
Correct anything that is wrong.
Delete it.
Stop using it, or restrict what we do with it.
Hand it over in a portable form.
Stop relying on consent — you can withdraw it at any time, and withdrawing it does not make what we did beforehand unlawful.

Email richard@rabbitsfoot.co.uk. We will respond within one month, and it costs you nothing. If your assessment was anonymous we may need enough detail to find it — the results link is usually the quickest way.

If you think we have got this wrong, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you raised it with us first, but you are not obliged to.

Children

This service is for people making decisions about a home they own or live in, and it is not aimed at or designed for children. We do not knowingly collect information about anyone under 18.

Changes to this page

We update this page when what we do changes, and the date below moves only when the wording does. If a change materially affects what happens to information we already hold, we will say so here rather than relying on you to spot it.

Last updated: 5 September 2026