Privacy Policy
Last updated: 26 October 2026
Four products, two very different answers. The Bridge and phone apps run on your hardware; the services they contact depend on your configuration. The Hub is a service we operate, so this policy is mostly about the Hub.
Who is responsible
The controller for personal data held in MeshSat Hub and on meshsat.net is Elli.Z.G., a sole proprietorship registered in Leiden, the Netherlands, Chamber of Commerce number 99812584, trading as MeshSat. Contact: hello@meshsat.net.
meshsat.net
We use Umami for analytics. It is self-hosted on our own infrastructure, sets no cookies, and does not build a profile of you. The homepage also requests public repository statistics from GitHub, which receives the network information needed to answer that request. Videos load from YouTube only after you select a play button; YouTube then receives the request and applies its own privacy policy.
Our YouTube channel
We publish MeshSat’s own videos to our YouTube channel (youtube.com/@MeshSat) with a small internal tool that uses the YouTube API Services. Only our team uses it, and only on our own channel. It reads and changes our channel’s videos, captions and playlists. It does not read or collect anything about viewers or other YouTube users, and it sets no cookies. The access it holds for our channel is stored on our own server and is never shared. We can withdraw it at any time on the Google account’s permissions page, which also removes it on Google’s side; we then delete our stored copy.
YouTube’s Terms of Service apply to anything you watch there, and Google handles YouTube data under the Google Privacy Policy.
MeshSat Bridge, MeshSat Android and MeshSat iOS
They run on your own hardware. There is no account, no analytics, no advertising and no crash reporting to us: data reaches MeshSat services when you connect the Bridge or an app to our Hub. Maps, orbit data and configured carriers make the other network requests described below.
The Android app comes in two editions. The full app, from GitHub (and from F-Droid once it lists it), can send and receive SMS through your SIM. The Google Play edition has no SMS access at all. Apart from that, the two handle your data identically. On iPhone, the app hands a text to Apple’s Messages app for you to send, and never reads your texts.
What the apps use on the phone, and why. Bluetooth, to talk to your MeshSat node or Meshtastic radio. Location, because Android needs it to scan for Bluetooth devices, the map shows where you are, and, if you choose, your position goes out over the mesh, by satellite or to a Hub. SMS, on the full Android edition only, to send and receive through your SIM. Notifications, to show that the gateway is running and what has arrived. The Android app keeps a small log of crashes and health readings on the phone for your own troubleshooting; it never leaves the phone and can be switched off in Settings.
What leaves the phone, and to whom.
- Map tiles come from OpenStreetMap’s tile servers when the map shows an area not stored on the phone. That server sees your network address and which tiles you asked for, under the OpenStreetMap privacy policy. Tiles you have seen are kept for offline use, and a map pack you import needs no connection at all.
- Orbit data for the satellite pass predictor comes from CelesTrak and, as a fallback, the public TLE API at tle.ivanstanojevic.me. Those requests carry the app’s name and your network address, never your position.
- Your messages and positions go to the carriers you configure: the Iridium network through your own RockBLOCK modem and Rock7 or Ground Control account, your mobile operator for SMS, APRS-IS if you connect to it. These are your accounts and their terms apply.
- A Hub, if you connect one. Positions, telemetry and messages then go to that Hub. If it is ours, the rest of this policy applies. If you self-host, everything below describes data that stays on your own infrastructure, and we are not involved in it at all.
Installing from Google Play or the App Store tells Google or Apple that you did, under their own policies; we see only the totals. Downloading from GitHub sends a request to GitHub, including the network information needed to deliver the file.
MeshSat Hub: what we hold
Your account. Email address, name, and what you told us when you asked for access: organisation, country, hardware, what you want to use it for, an optional callsign and Matrix ID. We also record the network address you signed up from and the moment you agreed to the terms. The address is kept as a record of where a request came from, which is how we tell fifty requests from one host apart from fifty people.
Your fleet. The devices and bridges you register, their identifiers, configuration and status.
Your traffic. Positions, telemetry, message content and message metadata, for as long as your retention setting keeps it. Message content is content: if you send coordinates, a name or a casualty report through the Hub, we hold it. Where you have configured end-to-end encryption, we hold ciphertext we cannot read.
Evidence. A tamper-evident audit log of security-relevant actions, kept for 90 days by default.
Credentials you give us. Provider API keys for your own Iridium, Twilio, Rock7 or Globalstar accounts, encrypted at rest, used only to send and receive on your behalf. They are deliberately excluded from your data export so they cannot leak through it.
We do not hold your payment card. Stripe does.
Why we hold it
To run the service you asked us to run: relaying your messages, showing your fleet, enforcing your plan, and keeping the account secure. Legally, that is performance of our contract with you, and our legitimate interest in keeping the service secure and abuse free. Where you have given consent, for example to the terms at signup, we record that you gave it and when.
Who else sees it
Only where the work requires it:
- Stripe, for subscription payments. They process the card and tell us that a payment happened, which account it was for, the billing country on the card, and when a subscription renews, fails or ends.
- Satellite and messaging carriers, for traffic you route through them: Ground Control and Cloudloop for Iridium, Rock7 and RockBLOCK, Globalstar, Twilio for SMS. These are your accounts. What passes through them is subject to their terms as well as ours.
- Nobody else. We do not sell your data, we do not share it for advertising, and there is no third-party analytics or tracking in the Hub.
If we are legally compelled to hand something over, we will tell you unless we are prohibited from doing so.
Where it lives
The Hub runs on our own hardware in Norway. Database backups are stored in the Netherlands. Traffic reaches the service through edge servers in Norway, Switzerland and the United States, so depending on where you connect from, your connection may transit the US even though your data is not stored there.
We do not use hyperscale cloud providers for the Hub.
How long we keep it
| What | How long |
|---|---|
| Messages, positions, telemetry | your configured retention period |
| Audit log | 90 days by default |
| Account and fleet records | until you close the account |
| Closed accounts | 30 days, then destroyed |
Closing your account marks it for deletion and starts a 30-day window. That window exists so an accidental deletion is recoverable. After it, the data is purged and we cannot restore it.
Your rights
Under the GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, and take it elsewhere.
Two of those you can exercise yourself, immediately, without asking us:
- A copy of everything, from Settings, as a single archive with one file per record type.
- Deletion, by closing the account.
For anything else, write to hello@meshsat.net. If you think we have handled your data badly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Security
Access is authenticated and role-based, and every tenant’s data is separated at the query layer. Traffic is encrypted in transit. Provider credentials are encrypted at rest. The audit log is hash-chained so tampering is detectable. Backups are taken daily.
We will tell you without undue delay if a breach affects your data.
Changes
If we change this policy in a way that matters, we will email the address on your account before it takes effect.