Security & data

p.stonn encrypts these with AES-256-GCM: your council session, its access token, your saved password, and the codes behind your printed and visitor QR links.

p.stonn stores these as plain text: your number plates, your schedule, your permit details, email addresses, and the activity and change logs. None of that is a login to your council account, but anyone with access to this server or its database could read it.

The connection lasts while the account is in use and stops after 90 days with nobody signing in (anyone you share the account with counts). About a week before, p.stonn emails a one-click link to keep it going. This is deliberate: p.stonn should not hold access to the council account of someone who has moved away or stopped using it.

You can also end the connection yourself any time. Disconnecting in Settings ends it immediately. Changing your council password ends the stored session (an access token already issued may keep working for up to about an hour).

p.stonn saves your password by default, encrypted, so it can sign back in on its own when the council ends a session. Without it, a lapsed session stops your schedule until you reconnect by hand. Untick “Save my password” when you link, or turn it off later in Settings, and p.stonn erases it and never stores it again.

Your p.stonn sign-in is separate: p.stonn sends a one-time code to your verified email. You can only ever link the council account whose email matches it.

About you: your email, your regos and their labels, your schedule, your permit details, a log of the changes p.stonn has made, a log of who on the account changed what, your notification settings, and the encrypted council session (plus your password, unless you turned that off).

About other people, only where you have used those features: the email addresses of anyone you gave shared access to or sent a guest pass to, any email you attached to a rego, and the number plates visitors typed at a printed QR. If an address bounces or its owner reports our email as spam, p.stonn adds it to a do-not-email list and stops trying it.

p.stonn keeps activity and change logs for 90 days, and a visitor’s number plate from a printed QR for 7 days after the scan. A revoked guest pass stops naming its recipient after 30 days. p.stonn deletes the content of each notification as soon as it has gone out. The server’s own operational logs hold number plates and permit IDs, plus a redacted form of email addresses (the first letter and the domain). Those logs are limited in size and age, so they cover about the last couple of weeks. On the do-not-email list, p.stonn removes a bounce or an unsubscribe after two years, but keeps a spam complaint so that a request to stop never quietly lapses.

p.stonn uses your data only to run the service for you. We never sell it or use it for advertising. The app has no trackers or analytics, and your browser makes no requests to any third party. p.stonn shares data only where a feature needs it: with the email provider that delivers your notifications, with the push service if you turn push notifications on, and with the council when p.stonn changes your permit.

The server administrator can technically see what is stored on the server, as with any self-hosted tool. p.stonn is small and personal, and we use your data only to run the service for you. We never sell it, never share it beyond what a feature needs, and never look at it for anything else.

“Delete all my data” in Settings clears everything from the live database straight away: your session, saved password, schedule, regos, guest passes, logs, and anything queued to be emailed to you. It also removes your traces from any account you were a member of, including guest passes you created there.

Backups are the exception. p.stonn takes an encrypted backup daily and thins them out over time (roughly the last week daily, the last month weekly, then monthly for about three months), so deleted data can linger in a backup for up to about three months before it is gone for good. Backups are not reachable through the app. We hold the key that encrypts them separately from the server.

If this server or its encryption key were ever exposed, someone could use your saved council session the way you can, to view what is held in your ePermits account and manage the permits in it. Changing your ePermits password shuts the session out immediately. Encryption makes that exposure unlikely. Using a password that is unique to your council account keeps any fallout contained there. As with any online service, none of this is an absolute guarantee.