Legal
Privacy Policy
Your mesh traffic is end-to-end encrypted between your devices on every connection path: direct, through a standalone relay, and when the rendezvous server forwards it. Servers that carry it do not hold the keys to read it. Section 3 explains how each path handles your content. Connection metadata, push notifications, AI-provider requests and update downloads have separate data flows, described below.
1. About this policy
This policy applies to the Meshieve apps for iPhone and Mac, the meshieve CLI and helpers, this website, and the hosted services we operate. “Meshieve”, “we”, “us” and “our” refer to the developer and operator providing those products and services under the Meshieve name. Privacy questions and requests can be sent to nivek.est@gmail.com.
You do not need to create a Meshieve account. Each device has its own mesh identity. On first use, the iPhone app also creates an anonymous account key, with no name, email or password, which our hosted rendezvous uses to recognize account entitlements and service limits. Your connected devices, self-hosted infrastructure and selected third-party services may also process information under their operators' policies.
As of the last-updated date, the app versions described here do not include advertising or third-party app analytics. This describes current practices, not a commitment that future versions will remain advertising-free or use the same business model. Section 10 explains possible future advertising and analytics. We currently process operational information to connect devices, deliver notifications and updates, diagnose failures, enforce service limits and prevent abuse. Those operational records should not be confused with information that stays only on your devices.
Unless stated otherwise, feature, storage and processing descriptions in this policy refer to the versions and services currently described. We may change features, providers and data practices in future releases, with updated disclosures and the notices, choices and permissions required by applicable law and platform rules.
2. Information stored on your devices
- Configuration and identity: mesh settings and credentials, device keys, peer names and identifiers, permissions, sharing choices, app preferences and connection or traffic summaries.
- Agent activity: recent sessions, message drafts, attachments, review and schedule records, notification receipts, token/cost summaries and launch settings. Environment variables you enter may contain API keys or other secrets; hiding a value in the interface does not encrypt it.
- Files and media: downloaded or selected files, transfer and preview caches, and photos or camera images you choose to attach, upload or share. Media can retain embedded metadata, such as timestamps or location, depending on its format and the transfer.
- Browser data: cookies, login sessions, caches and website storage for forwarded services and links opened in the in-app browser. Sites you open may contact their own servers and third parties under their own policies.
- Local diagnostics: app and operating-system logs and, on Mac, daemon logs. These can contain device names, addresses, file paths, connection events and error details. They are not automatically uploaded as a general crash or analytics report by the apps.
On iPhone, app data is held in its local container and preferences; mesh configuration is kept in app preferences, which are included in device backups; device identities and signed membership state are also stored locally. Free-session quota and session-access records are held in Keychain so they can survive reinstalling the app. The anonymous account key and its certificate are also held in Keychain and can survive uninstalling; when iCloud Keychain is on, the account key syncs to your other Apple devices. On Mac, configuration and identity/state are stored under ~/.meshieve, settings in Application Support, preferences and update caches in your user Library, and daemon logs in ~/Library/Logs/Meshieve. Mesh credentials are also cached in the Mac login Keychain; the daemon configuration contains the credentials it needs with restricted file permissions.
3. Content exchanged with your peers
Terminal input and output, files, source code, agent messages and results, forwarded web traffic, screen frames, system audio and remote-control input travel between the devices you connect. Meshieve encrypts this traffic end to end between your devices on every connection path. Devices authenticate each other with their device keys and mesh membership, then derive per-connection keys that never leave them. When a direct connection is unavailable, a standalone relay or the rendezvous server forwards the traffic, but either one handles only ciphertext it has no keys to read or alter undetected. A server that forwards traffic can still observe its timing and volume, such as how many streams are opened and how many bytes each carries. A Mac or CLI host can be set to direct-only connections, which keeps its session traffic off relays; messages that set up connections still pass through the rendezvous.
Content can be readable on the sending and receiving devices, retained in local caches, stored in peer files or agent transcripts, or sent onward by the software you run. Encryption between peers does not hide information from an authorized receiving peer, an AI provider or a website you choose to use. We do not receive the contents of your terminal, files, screen or agent transcripts. Push labels and information you send us voluntarily are exceptions described below.
A Mac, Linux or WSL host can serve a shell running as your user, a folder you choose (read-only unless you allow writes; it can also be mounted over NFS) and forwarded local ports to permitted peers. The iPhone can also serve a folder and the photo-library selection available to the app when you enable sharing. Optional file writes let permitted peers create, change and delete shared files. Shared photos can include their location data. Images that agent messages or Markdown files reference by web address are fetched directly by your phone from the image's host, which receives your network address. Disable sharing to stop new access; doing so cannot erase copies a peer has already received.
4. Rendezvous and relay metadata
Rendezvous services introduce devices and coordinate connectivity. They receive network addresses, peer identifiers and public keys, device and mesh names, a public mesh identifier, device type, advertised capabilities, service access levels, and online or connection status. They also receive signed membership records, including device roles and membership changes such as additions, removals and admin grants. Our hosted rendezvous also receives a device summary, held in memory while the device is connected: app version and build, operating system and version, device model and architecture, CPU count, language, time zone and uptime. Rendezvous and relay services can also handle connection times, transferred-byte totals (including between each pair of devices that communicated), latency and loss measurements, performance and failure information, enrollment or approval events, and records needed to enforce capacity and security policies. Our hosted services log connection events with peer identifiers and source IP addresses. A device's registration is kept for 30 days after it was last seen.
When you use services we operate, we process that metadata for connectivity, service operation, troubleshooting and abuse prevention. When you configure your own or another operator's rendezvous and relays, that operator controls their records. Self-hosting those services does not change the separate push, Apple, AI-provider or update-download flows described here.
5. Agent notifications and Apple push delivery
The iPhone app uses push.meshieve.com to deliver agent notifications through Apple Push Notification service (APNs). Registration sends the device's APNs token and a peer identifier to obtain a scoped push credential. Your peer receives that credential so it can notify your phone. The credential stored on your peer includes your phone's APNs device token, so any process that can read it can send notifications to your phone until the credential expires, currently after 14 days by default.
A notification request can include the device token, peer and mesh identifiers, session and event identifiers, peer name, session title, agent type, event type and tool name. Badge synchronization sends hashed session references. The service reads those fields, constructs the notification and sends its payload to Apple. The notification Apple receives shows the event, agent and peer name as its title and the session title as its body, and also carries routing data, including your peer, mesh and session identifiers and, for approval requests, the tool name. Apple may hold a notification it cannot deliver immediately for up to an hour. This notification path uses encrypted HTTPS connections but is not end-to-end encrypted between your peer and phone.
The app and helper do not send complete transcripts or tool arguments through this notification path. A session title or peer name can still reveal information about your work and may appear on your lock screen. The service's operational database stores pseudonymous device references, peer IDs and names, hashed session/event references, delivery results, timestamps, badge state and related service records. It does not store full device tokens, raw mesh/session IDs, session titles or transcript text in that database; this does not mean those fields are hidden from the service while delivering a push. The service's application logs record request outcomes with peer and session identifiers and a short device-token prefix, but not session titles, peer names, tool names or full device tokens. Your IP address is not written to the database or application logs; it is held in memory for rate limiting for up to an hour.
Agent notifications are enabled by default in the app. Turn them off in Meshieve settings to stop app registration and remove peer push credentials when those peers are reachable. A credential held by a peer that could not be reached remains valid until it expires. Apple's alert permission and lock-screen preview settings separately control presentation; turning off banners in iOS alone is not the same as turning off Meshieve's notification feature. Disabling notifications does not immediately erase existing service audit records.
6. Coding agents and AI providers
Claude Code, Codex and Pi run on a connected Host using the accounts and providers configured there. Depending on that configuration and the tools used, prompts, attachments, source code, files, command output and other session context may be sent to Anthropic, OpenAI or another selected provider. Pi's provider is configurable; these services are not all operated by Meshieve.
The provider's applicable terms and privacy policy determine its retention, security and any use of content to improve models. Meshieve does not make a blanket promise that every provider keeps content local or excludes it from training. Review the provider and the scope of files and tools before sharing sensitive information. Command approval and permission to share personal information with an AI provider are separate decisions; this policy does not replace feature-specific permission where required.
Agent Mesh Access is off by default. Enabling it can let an agent use approved mesh tools to reach other connected machines and their permitted files or commands, extending the information available to that agent. Disable it in Meshieve settings and review active sessions if you no longer want that access.
7. Dictation, photos and Mac permissions
- Dictation: Meshieve uses microphone audio for Apple Speech Recognition. It prefers on-device recognition where available but can fall back to Apple's servers, including when on-device recognition fails. Recognized text goes into the active composer and can be sent to the agent when you submit it. Dictation cleanup, which is on by default and can be turned off, uses Apple's on-device model when available; it does not use a separate cloud cleanup provider.
- Camera and Photos: the camera scans invite QR codes and captures images you choose to use. Photo access supports selection, saving and optional sharing with your peers. The shared library is limited by the access you grant through iOS.
- Face ID and local network: App Lock uses Face ID or your device passcode, checked by iOS; Meshieve does not receive biometric data. Local network access lets the app connect directly to peers on the same network.
- Mac screen and system audio: enabling Remote Desktop lets permitted peers receive your screen and requested system audio. Screen Recording controls capture, and Accessibility controls remote keyboard and pointer input. Screen contents and system audio can include information about other people or applications. Remote Desktop, shell access and file sharing are off by default in Mac settings, but the first-device setup screen proposes turning on Remote Desktop, shell access and sharing of your home folder; switch off any you do not want before finishing.
- Mac files and background operation: Full Disk Access can allow the daemon and agents launched through it to reach protected files, subject to the Host's sharing and shell permissions. The optional privileged helper sets up an overlay network interface and routes. Launch at login and the menu-bar app support continued connectivity; closing the window does not necessarily stop the app.
Change feature permissions in Meshieve and revoke system permissions in iOS or macOS settings. Disabling access stops the relevant future activity but does not erase data already transmitted or jobs already running on another device.
8. Account and purchase records
Apple processes App Store purchases, payment details, trial eligibility and refunds. Meshieve uses StoreKit product, transaction and entitlement information to verify account entitlements. We do not receive payment-card details. On our hosted rendezvous, the app presents its anonymous account identifier and your signed App Store transaction so purchase entitlements can be recognized for your devices; the purchase is linked to that account through an App Store account token. Our hosted rendezvous stores that account identifier with the subscription's original transaction ID, expiry date and trial status. Your chosen agent or AI provider bills its own services separately. Apple's processing is covered by its Privacy Policy. Manage any existing Apple subscription in your Apple Account settings; uninstalling the app does not cancel it.
The app also checks policy.meshieve.com for signed access-policy and announcement updates. Requests contain a fresh random nonce and supported verification-key identifiers, without device, account or mesh identifiers. The service receives the network connection used for the request.
9. Website, updates, feedback and recipients
The Mac app uses Sparkle to request update information and downloads from meshieve.com. These requests expose the connection's network address and HTTP information, including the app and Sparkle version in the user agent, to the delivery infrastructure. The files are delivered through Cloudflare. Sparkle system profiling is disabled in our Mac app configuration. Update checks and automatic installation are controlled through Sparkle's choices.
This website stores your theme and language choices locally in your browser. Its fonts load from Google Fonts and Fontshare, so those providers receive the network requests needed to deliver fonts. Website and download hosting can process addresses, request times, requested resources and HTTP headers for delivery and security. As of the last-updated date, we do not use this website to track your activity across other sites for advertising; future changes are addressed in Section 10.
If you send feedback by email or GitHub, we receive the content you submit and associated contact information to respond and improve Meshieve. Public GitHub issues can be visible to others; do not include secrets or confidential logs. Using an external email or GitHub provider is also subject to its own policy.
Recipients depend on the features you use: your authorized peers; operators of configured infrastructure; our hosting and delivery providers; Apple for push, speech and purchases; your selected AI providers; and the providers you choose for websites or feedback. Providers working on our behalf must handle information for the relevant service and with appropriate protection. We may disclose records when required by law or necessary to address security incidents, fraud or abuse. Possible future advertising and analytics recipients are addressed in Section 10.
10. Advertising, analytics and future changes
We may introduce advertising, sponsored placements, affiliate referrals, analytics or attribution services in future versions of the Software, Services or website. Advertising may be contextual or, where permitted and with any required permission, personalized. The present absence of advertising is not a promise of permanently advertising-free use.
If introduced, advertising or analytics providers may process information such as device or advertising identifiers, network addresses, approximate location derived from an address, app and operating-system versions, language, feature interactions, ad views and clicks, campaign or referral information, and diagnostic or performance measurements. Which information is processed depends on the actual integration. These are possible future categories, not a statement that those advertising or analytics integrations currently exist.
Before introducing material new processing, we will update this policy and any applicable feature notice to identify the actual purposes, data categories, recipients, retention and available choices. Where required, we will obtain permission before processing begins, including Apple's App Tracking Transparency permission for covered tracking and any applicable cookie or advertising consent. Accepting these Terms or this policy does not substitute for that permission. Adding advertising does not itself give an advertiser access to your Mesh or credentials.
At the last-updated date, the versions and services described here do not sell personal information or share it for cross-context advertising. Some future advertising arrangements may be classified as a sale or sharing under particular privacy laws. If applicable, we will disclose the actual practice and provide required opt-out mechanisms and respect legally required preference signals. Declining personalized advertising or tracking does not necessarily remove contextual advertising.
A free or paid plan is not guaranteed to remain advertising-free unless the applicable purchase offer expressly includes that benefit. Any changes affecting an existing paid offer remain subject to its applicable terms, consumer rights and platform rules. A future change to this policy does not, by itself, authorize materially incompatible new uses of information previously collected; the required notice, lawful basis and any consent must be addressed first.
11. Retention and deletion
- Local app data: use the relevant app controls to remove drafts, files, sessions and configurations. iPhone uninstall removes its app container but can leave quota and session-access records in Keychain. Deleting the Mac app bundle does not remove its configuration, state, logs, settings or Keychain items. Leave each mesh, remove the optional helper and turn off launch at login in Mac settings before uninstalling if you want to stop that access. Leaving a mesh removes that mesh's credentials, identity and state; logs and preferences remain until you delete them.
- Browser data: the general browser's data-clearing option clears that browser's persistent store. Forwarded services use separate stores; deleting a service mapping currently leaves its store on disk. Do not assume one browser clear or mapping deletion clears every stored login.
- Peer data and work: transcripts, files, attachments and schedule history may remain on the Host or in the agent's own storage. Closing or disconnecting the phone does not reliably stop peer processes or erase those records. Stop active work, cancel schedules and remove stored data on the relevant Host or with its operator.
- Hosted operational data: retention depends on the record's purpose and configured lifecycle. Our hosted rendezvous and relays keep connection audit records for 14 days, subject to a cap on the total number of records. Our push service retains verified audit events for 90 days, unverified events for up to 14 days, inactive device/peer inventory for 180 days, and dead-token records for 90 days. Badge state is removed when the app syncs an empty set or Apple reports the device token invalid; a 30-day idle sweep applies only when the service tracks a very large number of devices. Daily per-device/per-peer summaries and some administrative records have no automatic time-based expiry. Deleted records can persist in database free space until overwritten, and in operator backups until those backups are deleted. Pseudonymous references can remain linkable and are not necessarily anonymous.
- Feedback: contact us to request deletion of information we hold. A public issue, email provider, recipient's copy or legally required record may have a separate retention process.
Website and downloads: this website and the Mac app's update and download files are served through Cloudflare, which processes and retains request logs and statistics under its own policies. The periods above are the settings our hosted services currently run with; if they change, we will update this section.
You can request deletion of hosted records at nivek.est@gmail.com. We may ask for information needed to identify the relevant records and verify your authority; do not email private keys or credentials. We will explain any records we must retain and any applicable backup lifecycle. Disabling a feature, cancelling a subscription or uninstalling an app does not itself submit this request or erase Apple or third-party-provider records.
12. Your privacy choices and rights
You can disable notifications, dictation, sharing and Agent Mesh Access; revoke camera, photo, microphone, speech, Face ID, local network, Screen Recording, Accessibility and Full Disk Access permissions; stop using a configured provider; leave meshes; and contact us about information we hold. Some features require the data needed to perform their function, but you can use other features without granting unrelated permissions.
Under the Personal Information Protection Law of the People’s Republic of China (PIPL) and other applicable laws, you may have rights to know about and decide on the processing of your personal information; to access, copy, correct, supplement or delete it; to have it transferred to another handler where the conditions set by the regulator are met; to restrict or refuse processing, or object to it; to withdraw consent; to ask us to explain these rules; and to complain to the competent authority. Send requests to nivek.est@gmail.com. We will reply within 30 days after verifying a request, unless the law provides otherwise, subject to the verification needed to protect other users.
Under the PIPL, we process personal information where it is necessary to conclude or perform the agreement you request (for example, connecting your devices, delivering notifications and recognizing subscriptions), where necessary to fulfil legal duties or obligations, or with your consent, including separate consent where the law requires it. Where a law such as the GDPR applies, processing necessary to provide requested services can rely on performance of a contract; service security and troubleshooting can rely on legitimate interests where permitted; optional processing may rely on consent; and required records may rely on a legal obligation. The relevant basis must match the actual activity, and withdrawal of consent does not undo earlier lawful processing.
Information can be processed where your peers, our infrastructure, Apple and your chosen providers operate, which may be outside your country. Our hosted rendezvous, relay and push services run on servers located in the United States, and this website and its download files are served through Cloudflare’s global network. If you use our hosted services from mainland China or another country, the personal information described in Sections 4, 5 and 8 is transferred to and processed in the United States by us, as the overseas recipient, for the purposes in this policy; you can contact us and exercise your rights at nivek.est@gmail.com. Using our hosted services is optional: you can run your own rendezvous and relay instead, although the push service and Apple’s services remain separate. Where applicable law requires a transfer safeguard, we will put it in place and provide information about it on request.
13. Minors
Meshieve is intended for adults and is not directed at children. If you are under 18, use Meshieve only with the consent of your parent or guardian. We do not knowingly collect personal information of children under 14 through our hosted services; if a parent or guardian believes we have, contact us and we will delete it.
14. Changes, language and contact
We may revise this policy as our products, providers and business model change, including the introduction of advertising, analytics or paid features. We will publish the revised policy and its last-updated date here and give the additional notice and choices required by applicable law and platform rules. This policy's amendment provision is not blanket consent to future tracking or new data uses. This policy is published in English and Chinese; if the two versions conflict, the Chinese version prevails. It forms part of the agreement described in the Terms of Use, including its governing-law section. Questions and privacy requests: nivek.est@gmail.com.