Privacy Policy — MeshTalk

MeshTalk is built to minimize data collection: chats are end-to-end encrypted, work over LAN with no internet at all, and the control service never sees message contents. This policy covers the one exception — the optional, off-by-default aggregate analytics (also called telemetry) in release builds — and nothing else, because there is nothing else to cover: we operate no accounts, no tracking, no advertising, and no other data collection.

1. Scope

This policy applies only to the analytics described here. It does not apply to:

→ your messages, files, friends, rooms, or identities, which never leave your devices except as end-to-end encrypted traffic to peers you chose;
→ the control/relay service and STUN, which necessarily observe network endpoints to connect peers;
→ third-party services you interact with directly (e.g. update checks via your platform's channels, Cloudflare edge logs).

2. What we collect — and only with your consent

Analytics is off until you explicitly opt in (first-launch dialog, Off preselected; no pre-ticked boxes). Two levels:

Basic

A Tier-0 version ping, at most once per app version: app version, operating system, CPU architecture.

Extended (Tier 1, optional)

The above plus aggregate counters for room/group lifecycle and transport paths, and sanitized stability counters (exception class names only, never messages or tracebacks). Sent at most hourly and on clean shutdown. Per-event counts saturate at 10,000 and clear after each attempt.

3. What we never collect

No persistent or installation IDs, peer IDs, public keys, room IDs or secrets, invites, message or file contents, filenames, paths, usernames, or message/file activity counters. There is deliberately no way to join analytics records back to a person or device on our side.

4. How we use it

Solely to understand release adoption and connection health across platforms so development effort goes where it matters. We do not use it for advertising, profiling, pricing, or any automated decision-making, and we do not sell or share aggregates with third parties.

5. Sharing and third parties

→ The analytics proxy runs on Cloudflare Workers and forwards to our ingest. Neither sells or shares this data.
→IP addresses are not stored — the server keeps only daily aggregate counters — but they are unavoidably visible in transit for delivery and per-IP rate-limiting.
→ Counts are approximate; the endpoint is open and unauthenticated by design, so counts are poisonable and must not be treated as exact.

6. Retention

90-day rolling daily aggregates, then deleted. No raw requests, payloads, or IPs are logged or retained by us.

7. Your choices and rights

→Change or withdraw consent anytime: Settings › Diagnostics, or MESHTALK_ANALYTICS=extended|basic|off.
→Verify yourself: with analytics off, tcpdump / proxy logs should show no egress to the analytics hosts outside update checks.
→ Because we hold no identifiers, we cannot look up, export, or delete "your" records specifically — there is nothing keyed to you.

8. Children

MeshTalk has no age-gated accounts and analytics contains no personal data, but analytics should not be enabled for children under 13 (or your local age of digital consent) — leave it off.

9. Changes to this policy

Material changes will be noted here with a new date and, where feasible, announced with the release. Continued opt-in after a change takes effect constitutes acceptance; you can always switch analytics off.

10. Contact

Questions or requests: open an issue at QinCai-rui/MeshTalk.