Security & data

Encrypted with AES-256-GCM: your council session, its access token, your saved password, and the codes behind your printed and visitor QR links.

Stored as plain text: your number plates, your schedule, your permit details, email addresses, and the activity and change logs. None of that is a login to your council account, but anyone with access to this server or its database could read it. It is kept readable because that is what running the service reliably needs.

It lasts while the account is in use and stops after 90 days with nobody signing in (anyone you share the account with counts). About a week before, p.stonn emails a one-click link to keep it going. This is deliberate: it should not hold access to the council account of someone who has moved away or stopped using it.

You can also end it yourself any time — disconnect in Settings (immediate), or change your council password, which ends the stored session (an access token already issued may keep working for up to about an hour).

Saved by default, encrypted, so p.stonn can sign back in on its own when the council ends a session — without it, a lapsed session stops your schedule until you reconnect by hand. Untick “Save my password” when you link, or turn it off later in Settings, and it is erased and never stored again.

Your p.stonn sign-in is separate: a one-time code to your verified email. You can only ever link the council account whose email matches it. (Self-hosters: the app trusts whatever verified email its sign-in layer supplies.)

About you: your email, your vehicles and their plates, your schedule, your permit details, a log of the changes it made, a log of who on the account changed what, your notification settings, and the encrypted council session (plus your password, unless you turned that off).

About other people, only where you have used those features: the email addresses of anyone you gave shared access to or sent a guest link to, any driver email you attached to a car, and the plates visitors typed at a printed QR code. An address that bounces or reports spam goes on a do-not-email list so p.stonn stops trying it.

Activity and change logs: 90 days. A visitor’s plate from a printed QR: 7 days from the scan. A revoked guest link stops naming its recipient after 30 days. Sent notifications keep no message content — it is stripped the moment they go out. The server’s own operational logs hold plates and permit IDs, plus a redacted form of email addresses (first letter and domain, not the whole address). They are size- and age-capped, so they hold about the last couple of weeks of activity rather than a permanent history. On the do-not-email list, a bounce or unsubscribe ages out after two years; a spam complaint is kept, so a request to stop never quietly expires.

Only to run this service for you. It is never sold and never used for advertising. There are no trackers or analytics — the app makes no requests to any third party from your browser. It is shared only where a feature needs it: with the email provider that delivers your notifications, the push server if you turn push on, and the council itself when it changes your permit.

The server administrator can technically see what is stored on the server — that is true of any self-hosted tool. p.stonn is small and personal, and your data is used only to run the service for you: never sold, never shared beyond what a feature needs, and never looked at for anything else.

“Delete all my data” in Settings clears everything from the live database straight away: your session, saved password, schedule, vehicles, guest passes, logs, and anything queued to be emailed to you. It also removes your traces from any account you were a member of, including guest passes you created there.

Backups are the exception: encrypted backups run daily and thin out over time (roughly the last week daily, the last month weekly, then monthly for about three months), so deleted data can linger in a backup for up to about three months before it is gone for good. Backups are not reachable through the app and are encrypted with a key held separately from the server.

If this server or its encryption key were ever exposed, someone could use your saved council session the way you can — to view what is held in your ePermits account and manage the permits in it. Changing your ePermits password shuts the session out immediately. Encryption makes that exposure unlikely, using a password that is unique to your council account keeps any fallout contained there, and — as with any online service — none of this is an absolute guarantee.