This describes what MeshTender collects, why, how long it keeps it, and what you can do about it. It covers this MeshTender instance{{if .Operator}}, run by {{.Operator}}{{end}} — not your repeaters themselves, and not the wider MeshCore network, which nobody operates centrally.
In force since {{.Effective}}.
A username, and whatever else you choose to add: display name, bio, location, callsign, contact links, time zone, and an optional email address. Plus the means to sign you in — a password (stored only as a bcrypt hash, never the password itself) and/or the public half of each passkey you register. We record when the account was created and when it last signed in.
Repeaters you register (name, public key, radio settings, and — if MeshTender reads them from the device — coordinates), any documentation and maintenance notes you write, organizations you create or join, and who you've shared a repeater with. Commands you send to a repeater are recorded in that repeater's log with the command, the time, the reply, and a snapshot of your username as it was at that moment.
When you change your username we record the old and new names, the time, and the IP address and browser user agent of the request. That's the one place we retain an IP, and it exists so a handle can be traced back after a rename and so a freed name can't be grabbed straight away. Deleting your account erases the IP address and user agent; the old handle and date remain, unlinked from any account, because the name reservation depends on them.
For each page request we store the date and time, which surface and host it hit, the path, the HTTP method, the response status, and a visitor hash. The hash is a salted SHA-256 of the day plus your IP address and user agent — it rotates every day, so the same visitor counts once per day and cannot be followed from one day to the next. Your IP address is never written down, only mixed into that day's hash. Crawlers and vulnerability scanners are recorded the same way but counted separately, so they don't inflate the visitor figures. This runs entirely on our own server; no analytics provider is involved.
Error and audit logs record the HTTP method, path, and a request ID — no IP addresses. If your browser blocks something under our content security policy, it reports the rule and the blocked URL; those reports carry no information about you, and page addresses are stripped of query strings and tokens before they're stored.
Your profile page shows your username and any profile fields and links you filled in. Blank fields simply don't appear — leaving them empty is how you keep them private.
An organization's member list is visible only to its members. Its public page shows how many members it has, but not who they are — with one exception: an organization's admins are named publicly and linked to their profiles, since someone deciding whether to join deserves to know who would be running it. So joining an organization is not public; being promoted to admin of one is.
A repeater is visible to people you share it with and to organizations you belong to; it appears on public pages only if you turn that on for that repeater.
Profile pages and individual repeater pages ask search engines not to index them. That's a request, not a guarantee — anything on a public page should be treated as public.
Two, both strictly necessary and neither used for tracking: a session cookie that keeps you signed in, and a short-lived one that protects the sign-in handoff between our hosts. There are no advertising, analytics, or third-party cookies, which is why there's no cookie banner.
That's the complete list, and it's short for a structural reason: the site and its database run on hardware we own and administer ourselves, not on rented servers. There is no hosting company in the middle with access to what's stored.
Everything else — fonts, styles, scripts, icons — is served from this site, so loading a page tells nobody else that you did.
Every profile field is optional and editable from your account page, and you can remove your email address at any time. Your account page is also where you see everything the account holds.
Deleting your account removes the account, your profile, your sign-in methods, the repeaters you own along with their documentation and history, your organization memberships, and your access to anything shared with you. Organizations where you're the only member go too. It happens immediately and cannot be undone.
Two things deliberately survive, with no link back to you: commands you ran on other people's repeaters stay in those repeaters' logs, and maintenance notes you wrote stay in their history — both recorded against the name you had at the time. Removing them would tear holes in records that other people rely on to look after shared infrastructure.
Traffic is encrypted in transit. Passwords are stored as bcrypt hashes; passkeys leave their private half on your device, where we never see it. Cookies are HTTP-only and same-site. The server's own mesh identity is stored encrypted. Pages run under a strict content security policy with no third-party scripts. None of this makes a breach impossible, and we won't pretend otherwise.
Questions about your data, or want help getting it out before you delete an account? Write to {{.Contact}}.
{{end}}See also: Terms of use.