Projects / HoraLuz

Privacy policy

This Privacy Policy applies to HoraLuz, an Android app that shows hourly PVPC electricity prices for peninsular Spain, published on Google Play as app.horaluz.

HoraLuz is published by the individual developer identified on HoraLuz’s Google Play listing. For privacy questions, write to the developer contact email shown in the Developer contact section of HoraLuz’s Google Play listing.

The related Terms of Service cover the licence, the one-time HoraLuz Plus purchase, and the limits of what the prices and reminders may be relied on for. A plain-language description of the app is on its overview page.

Summary

  • HoraLuz does not require an account.
  • HoraLuz does not operate its own backend server. There is no developer-run service to which your data could be sent.
  • HoraLuz contains no ads, no advertising SDK, no analytics SDK, no crash-reporting SDK, and no remote configuration.
  • HoraLuz does not sell or share personal data.
  • HoraLuz does not read your location, your contacts, your files, or any other app’s data.
  • The only network request the app makes for its own purposes is a fetch of public hourly PVPC prices from Red Eléctrica de España’s open data API at apidatos.ree.es. That request carries a date range and a peninsula geography identifier. It does not carry your name, email, device identifiers, or anything you configured in the app.
  • The only other network traffic is Google Play Billing, when you view, buy, or restore HoraLuz Plus.
  • Cached prices, reminder times, and settings live in the app’s private storage on your device. Android backup and device-to-device transfer of that storage are turned off.

Permissions the app requests, and why

HoraLuz declares the permissions below. There is no location permission, no camera permission, no microphone permission, no contacts or calendar permission, no storage permission, and no foreground-service permission anywhere in the manifest.

Internet

HoraLuz declares INTERNET. It is used for exactly two things, both described under “Information sent off your device” below: fetching public PVPC prices from Red Eléctrica, and talking to Google Play Billing. No other network request exists in the app.

Notifications

HoraLuz declares POST_NOTIFICATIONS (required on Android 13 and later). Three kinds of notification can be posted, all of them features of HoraLuz Plus, and none of them run unless you are entitled and the relevant setting is on:

  • the permanent, silent heatmap in the notification shade (channel pvpc_heatmap)
  • a reminder that a cheap window is about to start (channel appliance_reminders)
  • an evening notice that tomorrow’s prices have been published (channel pvpc_day_ahead)

The system prompt for this permission may appear on first launch so those features can work later. Granting it does not, by itself, post anything. Free users who never subscribe will not see the heatmap, the reminders, or the day-ahead notice. You can revoke the permission in Android settings at any time; the rest of the app, including today’s chart, keeps working.

Boot completed

HoraLuz declares RECEIVE_BOOT_COMPLETED so that, after the phone restarts, it can put back any reminders you had scheduled and refresh the heatmap notification if Plus is active. The receiver does not send anything off the device.

Vibrate

HoraLuz declares VIBRATE so a reminder notification can vibrate when your phone’s notification settings allow it. It is not used for anything else.

Wake lock

HoraLuz declares WAKE_LOCK. WorkManager and AlarmManager use it for the short interval in which a scheduled job or reminder actually runs. There is no always-on wake lock and no foreground service.

Billing

The Google Play Billing library contributes com.android.vending.BILLING, which is what allows the app to offer, restore, and check the HoraLuz Plus purchase.

Information processed on your device

Cached hourly prices

When HoraLuz fetches a day’s PVPC prices, it writes them to a local Room database so the chart and the heatmap can be drawn without asking the network again. Each row is public electricity-market data:

  • the territory it belongs to (always the Spanish peninsula — see below)
  • the start instant of that hour, and the local date it belongs to
  • the price in euros per kilowatt-hour, as published
  • a source label (PVPC_OFFICIAL)
  • when the row was fetched

This is the same series Red Eléctrica publishes for everyone. It is not about you.

Energy profile

Onboarding writes a single local record whose only field is the territory. The territory is always the Spanish peninsula. HoraLuz does not ask you where you live, does not read location, and does not offer other territories, because Red Eléctrica does not publish hourly PVPC prices for the Balearic Islands, the Canary Islands, Ceuta, or Melilla. The record exists so the rest of the app has a territory to key the price cache on.

Reminders

If you schedule a reminder (a HoraLuz Plus feature), HoraLuz writes one row per reminder to the same local database: an identifier, the time it should fire, the cheap window it points at, and a status (SCHEDULED, SENT, SNOOZED, COMPLETED, CANCELLED, or EXPIRED). Reminders are appliance-agnostic: the app never stores what you meant to switch on, only when.

App settings

HoraLuz stores preferences locally using Jetpack DataStore, in its own private app storage:

  • whether onboarding has been completed
  • whether the permanent heatmap notification is enabled, and whether it should draw the compact ribbon or the expanded chart
  • whether the notification permission has already been asked for, so the prompt is not repeated
  • the last definitive answer Google Play gave about Plus (owned or not), so background work can tell an owner from a non-owner without holding a billing connection open
  • the local date of the last day-ahead announcement, so tomorrow’s prices are announced once

These settings contain display and behaviour choices only. They contain no name, no email, no payment details, and no price history beyond what is already in the local cache.

Purchase state

If you own HoraLuz Plus, the local “plus owned” flag described above is set so Plus features keep working between visits to Google Play. The flag contains no payment details. Plus is bought once and does not lapse; a cached true can only be taken back if Play later reports a refund or revocation. An inconclusive check (pending, or Play unreachable) does not overwrite a previous definitive answer.

Android backup and device transfer

HoraLuz sets android:allowBackup="false" and excludes the entire app storage from Android cloud backup and from device-to-device transfer. Cached prices, reminders, settings, and the local Plus-owned flag do not leave your phone through a Google account backup or a phone-to-phone copy.

Information sent off your device

Red Eléctrica’s public PVPC feed

HoraLuz fetches hourly PVPC prices from the public API at https://apidatos.ree.es/es/datos/mercados/precios-mercados-tiempo-real. The request is an HTTP GET. The query string contains:

  • a start and end datetime for the day being asked for
  • time_trunc=hour
  • geo_trunc=electric_system, geo_limit=peninsular, and geo_ids=8741 (Red Eléctrica’s identifier for the Spanish peninsula)

The app does not attach your settings, reminders, purchase state, advertising identifier, or any other account or device identifier to that request. HTTP logging in the client is set to off.

As with any request your phone makes, the receiving server may observe technical metadata such as your IP address, the time of the request, and a standard HTTP user-agent. That processing is governed by Red Eléctrica de España, not by HoraLuz. HoraLuz is not affiliated with Red Eléctrica de España.

Today’s prices are fetched when you open the app and when they are not already in the local cache. A daily WorkManager job, scheduled for shortly after 20:20 Europe/Madrid (Red Eléctrica typically publishes the day-ahead PVPC around 20:15 CET), fetches today and tomorrow so Plus users can be told tomorrow’s cheap window once it exists. That job requires a network connection and a battery that is not low; it does not run otherwise. A second job, every fifteen minutes, only repaints the heatmap from the local cache and makes no network request.

Google Play Billing

HoraLuz Plus is a single non-consumable in-app product, horaluz_plus_v1. It is bought once and owned for as long as Google Play reports the purchase. It is not a subscription: nothing renews, and no further payment is taken. The app reads the localised price from Play at run time and does not hard-code it. All of this is processed by Google Play. Google Play is the seller; the developer never sees or receives your payment card details, bank details, billing address, name, email address, or Google account.

Through the Google Play Billing library, HoraLuz may receive the limited purchase information it needs to grant and restore Plus:

  • the product identifier that was purchased
  • purchase state (purchased, pending, or absent)
  • the purchase token and acknowledgement status needed to complete or restore the purchase
  • the localised price of the product, so the paywall can display it

This information is used only to unlock, acknowledge, and restore Plus on your device, and — if Play later reports a refund or revocation — to lock it again. It is not sent to any developer-operated server, because there is none. Google’s processing of your payment, purchase, device, and account information is governed by Google’s own policies and terms.

Links you open

If you follow a link out of the app — for example to this privacy policy, the terms, or the Play Store — Android hands a standard intent to whichever app you choose, and that app’s own policy governs what happens next.

Information HoraLuz does not collect

HoraLuz does not operate user accounts and does not collect, store, or transmit any of the following to developer-operated services:

  • name, email address, or phone number
  • contacts, calendar, messages, photos, videos, or audio
  • your location, or any approximation of it
  • payment card or bank details
  • advertising identifiers, device fingerprints, or any identifier used for tracking
  • analytics events, usage statistics, performance traces, or crash reports
  • installed-app lists, files, or documents outside the app’s own storage
  • what appliance you meant a reminder for — the app does not ask

Data sharing

HoraLuz does not sell personal data and does not share personal data for advertising or analytics.

Information is processed by third parties only where a feature requires it:

  • Red Eléctrica de España’s public API, when the app fetches PVPC prices
  • Google Play and Google Play Billing, when you view, purchase, acknowledge, or restore HoraLuz Plus
  • the app you choose when you follow an external link

Data retention and deletion

There is no server-side copy of anything, so there is nothing for the developer to retain or delete. Data on your device stays there until you remove it.

You can remove local HoraLuz data by:

  • cancelling or completing reminders in the app
  • turning the heatmap notification off, which also cancels the posted notification
  • clearing HoraLuz storage in Android system settings
  • uninstalling HoraLuz, which deletes its private storage entirely

Purchase records are also held by Google Play and in your Google account purchase history. Those are controlled by Google, and you can manage purchases, refunds, and history through Google Play and your Google account settings.

HoraLuz does not offer account deletion because it does not create or manage accounts.

Your choices

  • You can use HoraLuz without an account and without ever purchasing Plus. Today’s chart and the cheapest window stay available.
  • You can decline or revoke the notification permission. Plus features that need it will explain what they cannot do; today’s chart is unaffected.
  • You can turn the permanent heatmap off from the home screen or from the notification’s “hide” action. Both write the same setting.
  • You can restore Plus on another device by signing in with the Google account that bought it and using “Restore purchase”. If Play reports that the purchase was refunded or revoked, Plus features stop; today’s chart does not.
  • You can clear all local data at any time from Android system settings.

Security

Local data is kept in the app’s private storage, protected by Android’s app sandbox, and excluded from cloud backup and device transfer. Google Play Billing uses Google’s own secure purchase flow. The price request is ordinary HTTPS to Red Eléctrica’s public API.

No method of storage or transmission is perfectly secure. HoraLuz reduces that risk structurally rather than by promise: it has no server, no account, no third-party SDK other than Google Play Billing, and almost nothing to transmit in the first place.

Children’s privacy

HoraLuz is a household utility for people on the Spanish PVPC tariff. It is not designed for or directed to children under 13, and it collects no personal data from anyone, including children.

International users

HoraLuz is only useful on the hourly PVPC tariff of the Spanish peninsula, and it is distributed for Spain. Because no personal data is collected, transmitted to, or processed by the developer, there is no international transfer of your data by HoraLuz, and no developer-held record about you to access, correct, port, or erase. Rights you hold under the GDPR, the UK GDPR, or comparable laws remain available to you; a request under them will be answered honestly, which in practice means confirming that no such data exists.

Data you send to Google by purchasing through Google Play, or that Red Eléctrica observes when the app fetches public prices, is handled by those organisations under their own policies. Rights against them are exercised with them.

Changes to this policy

This Privacy Policy may be updated if HoraLuz’s features or data practices change. The effective date at the top of this page will be updated when that happens, and material changes will also be noted in the app’s Google Play release notes. This page remains available at its published address.

Google Play Data safety summary

For transparency, these are the answers this app supports on the Play Console Data safety form. If the app’s behaviour ever changes, this policy and that form are updated together.

  • Does the app collect or share any of the required user data types? No.
  • Location. Not collected and not shared. The app does not declare a location permission and does not read where you are.
  • Personal info, financial info, health, messages, photos, audio, files, contacts, calendar. Not collected and not shared.
  • App activity, app info and performance, device or other identifiers. Not collected and not shared. There is no analytics or crash-reporting SDK in the app.
  • Purchase history. Handled by Google Play as the seller; not collected by the app for its own purposes.
  • Is all user data encrypted in transit? Not applicable — the app transmits no user data. The price request to Red Eléctrica and the Play Billing traffic use HTTPS.
  • Can users request that data be deleted? Not applicable to server data, as none exists. On-device data is deleted by clearing app storage or by uninstalling.