Privacy

• No advertising, no trackers, no analytics companies, and nothing sold or shared for marketing.
• Traffic statistics are counted without storing your IP address at all.
• An email address is optional, and only used to prove it's yours and to reset a password.
• You can delete your account yourself, and it really deletes.

Your account

A username, and whatever else you choose to add: display name, bio, location, callsign, contact links, time zone, and an optional email address. Plus the means to sign you in — a password (stored only as a bcrypt hash, never the password itself) and/or the public half of each passkey you register. We record when the account was created and when it last signed in.

What you create

Repeaters you register (name, public key, radio settings, and — if MeshTender reads them from the device — coordinates), any documentation and maintenance notes you write, organizations you create or join, and who you've shared a repeater with. Commands you send to a repeater are recorded in that repeater's log with the command, the time, the reply, and a snapshot of your username as it was at that moment.

Username changes

When you change your username we record the old and new names, the time, and the IP address and browser user agent of the request. That's the one place we retain an IP, and it exists so a handle can be traced back after a rename and so a freed name can't be grabbed straight away. Deleting your account erases the IP address and user agent; the old handle and date remain, unlinked from any account, because the name reservation depends on them.

Traffic statistics

For each page request we store the date and time, which surface and host it hit, the path, the HTTP method, the response status, and a visitor hash. The hash is a salted SHA-256 of the day plus your IP address and user agent — it rotates every day, so the same visitor counts once per day and cannot be followed from one day to the next. Your IP address is never written down, only mixed into that day's hash. Bot traffic is skipped. This runs entirely on our own server; no analytics provider is involved.

Diagnostics

Error and audit logs record the HTTP method, path, and a request ID — no IP addresses. If your browser blocks something under our content security policy, it reports the rule and the blocked URL; those reports carry no information about you, and page addresses are stripped of query strings and tokens before they're stored.

Your profile page shows your username and any profile fields and links you filled in. Blank fields simply don't appear — leaving them empty is how you keep them private.

Organizations show their member list to people who can see the organization. A repeater is visible to people you share it with and to organizations you belong to; it appears on public pages only if you turn that on for that repeater.

Profile pages and individual repeater pages ask search engines not to index them. That's a request, not a guarantee — anything on a public page should be treated as public.

Two, both strictly necessary and neither used for tracking: a session cookie that keeps you signed in, and a short-lived one that protects the sign-in handoff between our hosts. There are no advertising, analytics, or third-party cookies, which is why there's no cookie banner.

• Resend delivers our email. When you add an address or ask for a password reset, Resend handles that address and the message in order to send it. It's the only time your address leaves our server.
• CARTO serves the map tiles. When a page with a map loads, your browser fetches tiles from CARTO directly, so CARTO sees your IP address and which tiles you asked for. Pages without a map involve them not at all.
• Our hosting provider runs the servers the site and database sit on, and can technically access what's stored there.

That's the complete list. Everything else — fonts, styles, scripts, icons — is served from this site, so loading a page tells nobody else that you did.

• Your account and what you created — until you delete the account.
• Raw traffic events — 90 days, then deleted. Daily totals (counts only, with nothing about individuals) are kept.
• Password reset links — 45 minutes, and one use.
• Email confirmation links — 24 hours, and one use.
• Sign-in handoff codes — 60 seconds, and one use.
• Repeater share links — 7 days to accept; spent and lapsed links are cleared within 30 days.
• A released username — reserved 90 days before anyone else can take it.

Every profile field is optional and editable from your account page, and you can remove your email address at any time. Your account page is also where you see everything the account holds.

Deleting your account removes the account, your profile, your sign-in methods, the repeaters you own along with their documentation and history, your organization memberships, and your access to anything shared with you. Organizations where you're the only member go too. It happens immediately and cannot be undone.

Two things deliberately survive, with no link back to you: commands you ran on other people's repeaters stay in those repeaters' logs, and maintenance notes you wrote stay in their history — both recorded against the name you had at the time. Removing them would tear holes in records that other people rely on to look after shared infrastructure.

Traffic is encrypted in transit. Passwords are stored as bcrypt hashes; passkeys leave their private half on your device, where we never see it. Cookies are HTTP-only and same-site. The server's own mesh identity is stored encrypted. Pages run under a strict content security policy with no third-party scripts. None of this makes a breach impossible, and we won't pretend otherwise.

If this policy changes in a way that matters, the date at the top changes with it, and material changes will be announced on the site rather than slipped in quietly.