Your data should stay legible to you.

Account data. When you create a Mesh.me account we collect what is needed to operate it — your email address, username, display name, and a hashed (never plaintext) password. We may use email or phone-number verification to help prevent abuse and secure your account.

Profile and content. Optional profile details you provide (bio, location, website, avatar, banner image, accent color, interest tags) and the content you create — posts, comments, messages in MeChat, community activity, and your Meshi customization.

Connected accounts. When you connect a third-party platform (Instagram, TikTok, YouTube, X/Twitter, Threads, Facebook, Snapchat, Discord, Twitch, Reddit, LinkedIn, or Pinterest), we store the platform name, your platform username/ID, and encrypted OAuth tokens for the scopes you explicitly authorize, plus the specific content those scopes let you view or manage inside Mesh.me.

Payment data. MeshPro payments are processed by Stripe. We receive limited billing metadata (such as subscription status and the last four digits/card brand) but we do not receive or store your full card number.

Age-verification status. If you opt into age-restricted content, identity/age verification is performed by a third-party verifier. We receive only a pass/fail verification status — we do not receive or store your ID document.

Service, personalization and security records. We process account sessions, authentication and security events, and rate-limit records, which can include IP addresses, to operate and protect the Service. Flow uses seen, watch, completion and like records to rank content. Presence uses permission-filtered room, content and Meshi-position information to show activity.

Reports you submit. Bug reports can include your description, optional email, sanitized page origin and path, device, browser, screen, version and user-agent details. Support tickets can separately contain your account identity, message, screenshots and diagnostics.

Location features. If you use Meshimap location sharing, precise coordinates are received to calculate a coarser stored location. Your separate location and visibility controls govern that feature.

We use your information to operate and personalize Mesh.me; power the Mesh, Feed, MeChat, Communities, Analytics, and Meshi experiences; support connected-platform features you enable; process MeshPro subscriptions through Stripe; communicate with you about your account and security; and resolve issues in the Service.

We also use data to detect and prevent abuse and fraud, maintain security, enforce our Terms and age-verification requirements, and comply with legal obligations.

Mesh.me does not use your data to sell advertising, build third-party advertising profiles, or engage in data-broker monetization, and we will never sell your personal data. This is a permanent, foundational commitment.

If you are in the European Economic Area or the United Kingdom, we process your personal data on these legal bases: performance of a contract (to provide the Service you request); legitimate interests (to operate, secure, and protect the Service, balanced against your rights); consent (for optional features such as connecting a third-party account or opting into age-restricted content, which you may withdraw at any time); and legal obligation (to comply with applicable law).

We use strictly necessary cookies to keep you signed in and to secure authentication and OAuth flows (for example, session and CSRF/OAuth-state cookies). Service and security records are described above. Optional product-improvement analytics requires a separate explicit choice; accepting the Terms or continuing to use Mesh.me does not opt you in.

We do not use third-party advertising cookies or cross-site ad trackers. You can control cookies through your browser settings, though disabling strictly necessary cookies will break sign-in and security features.

We do not sell personal information. Public content you intentionally publish may be visible to other users and discoverable by search engines. When you trigger cross-platform actions through Mesh.me, those actions are carried out through your authorized connection, and the destination platform's own privacy rules also apply.

We share data only with service providers (subprocessors) that help us operate the Service under confidentiality and data-processing terms: Vercel (application hosting), Turso (database hosting), Stripe (payment processing), and Resend (transactional email). We may also disclose information to comply with valid legal process, enforce our Terms, or protect the rights, safety, and security of our users, the public, or Mesh.me. If Mesh.me is involved in a merger, acquisition, or asset sale, we will continue to protect your information and notify you of any change in control.

Meshi uses Mesh.me's own rule-based helpers and permission-filtered database queries. Prompts and the necessary Mesh context are processed on our application infrastructure. No external language-model provider receives Meshi prompts or Mesh context. This processing is not performed entirely on your device.

You control the context. The Meshi memory rule in your privacy controls governs what Meshi may read to answer you. Switch it off and Mesh.me skips Mesh grounding queries and journal recall for your account. Product help and calculations can still answer the question you submit.

Other people's data. Your choice does not speak for anyone else. Before including another person's name, handle, or post text in an answer, Mesh.me checks current visibility, blocks, and that person's Meshi memory rule.

Meshi's journal. You can separately authorize a small durable journal containing only words you explicitly dictate (“remember that…”). An eligible account may also save a bounded, verbatim excerpt of your own latest question to resume a conversation. Every entry is listed in your privacy controls and individually deletable. Turning the journal off deletes every entry immediately and permanently.

Meshi does not read private conversations in the background. Passwords, payment details, connected-platform credentials, and recovery secrets are not Meshi context. Actions such as sending a message require your explicit command and current permission checks; publishing a proposed post requires your separate confirmation.

When you connect a third-party account, Mesh.me uses that platform's official API only for the scopes you authorize, and only to power the features you use inside Mesh.me. We do not use connected-platform data for advertising, and we do not transfer or sell it.

Google API Services Limited Use. Mesh.me's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained from Google (including YouTube) is used solely to provide and improve the user-facing features you request, is not transferred to third parties except as necessary to provide those features or as required by law, is not used for advertising, and is not read by humans except with your consent, for security purposes, or to comply with applicable law.

Meta platforms. For Facebook, Instagram, and Threads, removing Mesh.me from your platform account triggers automatic deletion of the associated connected-account data through our data deletion and deauthorize callbacks. You can also request deletion at any time from the Data Deletion page.

We retain information while your account is active and as needed to provide the Service. If you delete your account, we delete or anonymize personal data within 30 days, except where longer retention is required by law. Connected-platform tokens are deleted immediately when you disconnect an account, and backup or cached copies are purged within 90 days.

For step-by-step instructions on deleting your account, removing a single connected platform, or how platform-initiated deletion works, see our Data Deletion page. You can also request a copy (export) of your data through product settings.

You can review and update your profile, visibility settings, connected accounts, message permissions, notifications, and data controls from product settings at any time.

Depending on where you live, you may have rights to access, correct, delete, restrict, or export your personal data, to object to certain processing, and to withdraw consent. EEA/UK residents have these rights under the GDPR and may lodge a complaint with their local supervisory authority. California residents have rights under the CCPA/CPRA to know, access, delete, and correct personal information and to opt out of "sale" or "sharing" — Mesh.me does not sell or share personal information as those terms are defined, and we do not discriminate against you for exercising your rights.

To exercise any right, use the controls in settings or contact security@meshs.me. We will verify your request and respond within the timeframe required by applicable law.

Mesh.me is not directed to children under 13, and you must be at least 13 to use the Service. We do not knowingly collect personal information from children under 13; if we learn we have, we will delete it. Age-restricted (NSFW) content is limited to verified users who are at least 18. If you believe a child under 13 has provided us information, contact security@meshs.me.

Mesh.me is operated from the United States, and our subprocessors may process data in the United States and other countries. If you access the Service from outside the United States, you understand your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your country. Where required, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses) for international transfers.

We apply industry-standard safeguards including password hashing, encrypted OAuth-token storage, HTTPS transport security, secure HTTP headers, CSRF protection, rate limiting, and input validation across endpoints. MeChat conversations are restricted to their members, connected-platform tokens are encrypted at rest, and payment details are handled by Stripe rather than stored by Mesh.me. No internet service can guarantee absolute security.

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date below and, where appropriate, provide additional notice. If you have privacy questions or want to exercise your rights, contact security@meshs.me.