Privacy policy

Last updated: 20 July 2026

Who we are

Cheap Hours (cheaphours.uk) is built and run by Grizzlyware Ltd. We're the data controller for anything described on this page. If you want to ask us something about privacy, email contact@grizzlyware.com. Our registered address and company details are on the Grizzlyware company details page.

This policy covers Cheap Hours specifically. Grizzlyware's company-wide privacy policy, cookie policy and terms and conditions sit alongside it at grizzlyware.com/legal. Where this page is more specific about Cheap Hours, this page applies.

Cheap Hours is an independent tool. We aren't affiliated with, endorsed by or connected to Octopus Energy.

What stays in your browser

Everything you set up in Cheap Hours is stored using your browser's local storage on your own device. It doesn't travel to us, we can't read it, and nobody else can either. There are three things saved:

• cheap-hours — your region letter, the appliances you've added (name, cycle length, how their delay timer works, any finish-by time), and your preferences such as the earliest hour you're happy to set a timer and your light or dark theme choice.
• cheap-hours-consent — your cookie choices: whether you said yes to analytics, whether you said yes to advertising, and when you decided.
• cheap-hours-install-dismissed — the date you dismissed the "add to home screen" prompt, so we don't nag you again for a couple of months.

Clearing your browser's site data for cheaphours.uk deletes all three, and you're back to a blank slate. We don't set any cookies of our own — the only cookies that can appear are Google's, and only if you allow them.

Your postcode, exactly

Agile prices differ by region, so we need to know which of the fourteen Great Britain regions you're in. You can pick it from a list and skip this entirely. If you'd rather type a postcode, here is precisely what happens to it:

1. Your browser strips it back to the outward code — the first half, like SW1A or M1 — before it sends anything. The rest is dropped there and then, on your device.
2. Only that outward code is sent to our server, which tidies and trims it again as a belt-and-braces check.
3. We ask Octopus Energy's public grid supply point API which region that outward code belongs to. Only the outward code is sent — Octopus never sees your full postcode either.
4. We remember that answer for up to 30 days: a small shared lookup table of "outward code → region letter". It isn't linked to you, your device or anything else, and it's the same answer for everyone in that outward code.
5. The region letter comes back to your browser and is saved there. That's the end of it.

So: your full postcode never reaches us at all. It isn't written to a database, isn't attached to a profile, isn't shared with an advertiser, and can't turn up in our logs, because it was never sent. To be completely straight with you — like any website, our host (Cloudflare) keeps short-lived technical logs of requests to keep the site running and secure, and the web address of a lookup request contains the outward code. Those logs are diagnostic, aren't used to build any profile of you, and age out on their own. An outward code still points at a chunk of a town, so if even that bothers you, pick your region from the list instead.

One honest caveat about timing. Trimming in the browser started on 20 July 2026. Before that, the full postcode was sent to our server and trimmed there, which means it appeared in the web address of the request and could have reached those short-lived host logs. We can't retroactively unsee that, and we'd rather say so than imply this was always the case. If you had a Cheap Hours tab open from before that date, it keeps behaving the old way until you reload it.

Price data

When we fetch prices we ask for them by region letter only — "what does region C cost today" — and we cache that per-region price data on our server so we're not hammering the Octopus API. It's public pricing information. There's nothing about you in it.

Sharing a setup

When you share your appliances with someone, the whole setup is packed into the link itself, after the #. Browsers never send that part of a web address to a server, so your setup goes from your device to theirs and never touches us. Nothing is stored, and there's nothing to expire.

The QR code is drawn in your browser. If you scan someone else's, the camera runs entirely on your device and the video is only ever looked at by your own browser — no images or frames are uploaded anywhere. Your browser will ask your permission before the camera turns on.

Analytics and advertising

Cheap Hours is free, and Google ads help keep it that way. Google Analytics tells us which bits people actually use. Neither can use cookies until you decide, and rejecting is remembered exactly like accepting — we won't ask again on every visit to wear you down.

Before you choose, or if you say no

The page tells Google's Consent Mode that ad storage, ad user data, ad personalisation and analytics storage are all denied before any Google code runs, and they stay denied unless you accept. In practice that means:

• Google Analytics runs in its cookieless mode: it cannot read or write any cookies or store anything on your device. What reaches Google is an anonymous, cookie-free ping — which page was viewed and what kind of thing happened (say, "an appliance was added" or "a setup was shared"), with no identifier that could recognise you or connect two of your visits together. We see those only as aggregate counts, which is what tells us whether a feature is worth keeping.
• The Google AdSense tag is present in the page from the start — Google requires that for site review — but Consent Mode tells it not to read or write advertising cookies and not to personalise anything.
• Because both tags load, Google's servers do see the technical basics that come with any web request, such as your IP address and browser type.

If you say yes

• Analytics — Google Analytics may use cookies, so it can also measure things like whether people come back. We use it to decide what to improve.
• Advertising — Google AdSense may use cookies and similar technologies to show and measure ads, including personalised ones. Google acts as an independent controller for that; their own privacy policy and how Google uses data from sites that use its services explain what they do with it.

The two are separate switches. Saying yes to one is not saying yes to the other, and neither one is required to use Cheap Hours.

Changing your mind

Scroll to the bottom of the app and tap Cookie settings. You'll get the same choices back, set to whatever you picked last time, and you can turn either one off. Withdrawing consent stops any further use straight away and is exactly as easy as giving it.

Turning analytics off also deletes Google Analytics' cookies from your browser there and then. Advertising cookies live on Google's own domains where we can't reach them — clearing your browser's site data removes those. And turning something off doesn't reach back and delete data Google already holds — for that, Google's account controls are the place to go.

Other things the page loads

Not much. The typefaces are served from cheaphours.uk itself rather than a font service, so loading the page doesn't quietly introduce you to a third party. The "Buy us a coffee" link only goes anywhere if you click it, at which point you're on Buy Me a Coffee's site under their privacy policy.

Who else is involved

• Cloudflare — hosts the site and the small region lookup cache.
• Google — Analytics and AdSense, whose tags load on every visit but stay cookieless and consent-gated as described above.
• Octopus Energy — their public API answers "which region is this outward code in" and "what do prices look like in region C". No account or API key is involved.

Why we're allowed to do this

Under UK GDPR we need a lawful basis for handling personal data. Ours are simple: consent for the cookies and identifiers behind analytics and advertising, which is why neither can store anything on your device until you choose; and legitimate interests for the ordinary business of serving the site securely, looking up a region when you ask us to, and counting usage anonymously. Storing your appliances on your own device isn't us handling your data at all — it never leaves your browser.

Your rights

UK GDPR gives you the right to ask for a copy of your personal data, to have it corrected or erased, to restrict or object to how it's used, to receive it in a portable form, and to withdraw consent at any time.

In practice, most of these you can exercise yourself in seconds, because we don't hold an account for you and we have no way of identifying you. Your appliances and region are yours to edit or delete in the app or by clearing your site data; your cookie choices are yours to change under Cookie settings. If you think we're holding something about you and want to ask, email contact@grizzlyware.com and we'll do what we can — though we may genuinely not be able to connect a request to any data, precisely because we don't collect enough to try.

If you're unhappy with how we've handled something, you can complain to the Information Commissioner's Office at ico.org.uk. We'd rather you told us first so we can put it right.

Children

Cheap Hours is a household energy tool meant for the bill payer. It isn't aimed at children and we don't knowingly collect anything about them.

Changes to this policy

If what we do changes, we'll update this page and change the date at the top. If a change affects what you've consented to, we'll ask you again rather than assume.

Getting in touch

Email contact@grizzlyware.com and a human will read it.