ukmesh/docs/privacy.md

Privacy & data retention

Applies to ukmesh.com / app.ukmesh.com (MeshCore Analytics). UK GDPR + DPA 2018. Contact: ukmesh@proton.me

1. Error diagnostics telemetry

What is stored (per event): kind (error/warning/unhandledrejection/crash), truncated message (≤500 chars) and stack (≤4000 chars), page pathname only (no query string), userAgent, HMAC-hashed source IP. No raw IPs, no account IDs, no cookies, no localStorage in the telemetry path.

Lawful basis — legitimate interest (Art 6(1)(f)). Three-part test:

• Purpose test: operating a reliable public service requires knowing when client-side failures occur; this telemetry has already root-caused real production crashes (deck.gl/maplibre, worker-file MIME regressions).
• Necessity test: error capture cannot be tied to a logged-in account (the site has no general auth), so pseudonymous event capture is the minimum effective means; fields are bounded and truncated.
• Balancing test: data is pseudonymous (hashed IP, no identifiers), kept 30 days, rate-limited (10/min/IP) and sampled (20/hr/source), self-hosted (no third-party processor → no DPA required), no profiling. Individual impact is minimal; service reliability benefit is direct.

Retention: 30 days, enforced by the operational retention loop (DATA_LIFECYCLE_RETENTION_ENABLED=true + DATA_LIFECYCLE_RETENTION_TARGETS). Erasure: individuals cannot be mapped to rows; the retention job IS the erasure mechanism (documented as such).

2. Mesh packet database

The service stores radio traffic observed on the MeshCore network.

Data	Retained	Rationale
packets — message content + raw bytes + metadata	at most 30 days (Timescale chunk policy + bounded exact-row boundary cleanup)	network diagnostics; content is not kept long-term
packet_decryptions — full decrypted messages	30 days (operational retention loop)	diagnostics only
packet_paths — path metadata (node IDs, timing, signal, hashes)	indefinite, content-stripped	raw pathing analytics is the product
multibyte_path_facts, multihop_paths_weekly, path_*_priors — derived path stats	indefinite	derived, pseudonymous
packet_daily_stats / packet_hourly_stats	indefinite	anonymous aggregates

Lawful basis — legitimate interest (Art 6(1)(f)).

• Purpose test: operating and improving the network (pathing, coverage, diagnostics) requires the packet data; the owner portal requires status data.
• Necessity test: content is deleted after 30 days; long-term retention is limited to path metadata with no message content and no coordinates, which is the minimum needed for pathing analytics.
• Balancing test: pseudonymous node identifiers only (linkable to an individual solely when a node owner registers in the portal); no content in long-lived tables; no individual profiling; disclosed in the privacy notice.

Design rules (binding):

• Path/long-lived tables NEVER gain payload, raw_hex, or coordinate columns. Content-bearing tables always have a retention policy.
• Retained path visibility is derived from the current private-node prefix tables. Stored packet_paths flags are a trigger-maintained cache and are never the authority for a public or derived read.
• Decryption outputs land only in short-retention tables (30 days).
• New derived tables get a lifecycle policy at creation.
• Erasure (Art 17): owner-portal-linked nodes are mappable — node-scoped deletion procedure in the ops playbook (rows by src/rx node id across packets, packet_paths, decryptions, path facts).

3. Cookies

LocalStorage-only choices (cookie consent, theme). No third-party cookies. PECR does not apply to the mesh radio data (not a public electronic communications network).