The short version: MESH cannot read your messages — they are encrypted on your device before they leave it. We don't know your name, email, or phone number. The only things our relay server stores are your Stellar address, your NaCl public key, and your chosen username — all of which are public by design.
MESH Protocol is an independent project developed by Mohamed Abdellah. The relay server and website are hosted at meshprotocol.ru.
Contact: contact@meshprotocol.ru · support@meshprotocol.ru
| Data Type | Collected? | Where? |
|---|---|---|
| Your name | ✗ Never | — |
| Email address | ✗ Never | — |
| Phone number | ✗ Never | — |
| IP address | ✗ Not stored | Briefly visible in server logs (not retained) |
| Message content | ✗ Never readable | Encrypted blobs only — stored on IPFS, not our server |
| Stellar public address | ✓ Yes | Relay server — public by nature of blockchain |
| NaCl public key | ✓ Yes | Relay server — needed for encryption, public by design |
| Username (@handle) | ✓ Yes | Relay server — chosen by you, publicly searchable |
| Message pointers (memoKey) | ✓ Temporarily | Relay server — deleted after delivery confirmed |
Your messages are encrypted on your device using NaCl box encryption (Curve25519 + XSalsa20 + Poly1305) before they leave your phone. The encrypted blob is uploaded to IPFS via Pinata. A pointer to that blob travels via the Stellar blockchain.
Our relay server only ever sees an encrypted pointer — never the message content. We have no technical ability to read your messages. This is not a policy — it is a cryptographic guarantee.
The MESH app stores the following locally on your device using Expo SecureStore (hardware-backed encrypted storage on supported devices):
None of this is transmitted to us. It lives only on your device. If you uninstall the app or use "Clear All Data", it is permanently deleted. Make sure you have your recovery phrase before doing so.
MESH uses the following third-party services:
The MESH website (meshprotocol.ru) does not use advertising cookies, tracking pixels, or analytics scripts. The only browser storage used is localStorage to remember your chosen accent color preference.
The MESH mobile app does not use any analytics SDK, crash reporting service, or advertising framework.
You have the right to:
Because we don't know who you are, you'll need to identify yourself by your Stellar public address when making a request.
MESH is not intended for users under 13 years of age. We do not knowingly collect data from children. Because we collect no personal information at all, we have no way to verify age — parental guidance is advised.
We may update this policy as MESH evolves. The "Last updated" date will always be current. Continued use of MESH after changes means you accept the updated policy.
Privacy questions or deletion requests: contact@meshprotocol.ru