Privacy policy

Last updated: 2026-10-18. Version française.

This page covers the meshloom.app website, its flasher and the optional Meshloom Community network. The Meshloom application runs on your own machine: what it sends out is described in its security documentation. The sharing service meshl.ink has its own privacy policy.

Data controller

Azur Mesh, a non-profit association registration: Registration in progress, seat: 11 Rue Torrin et Grassi, 06510 Gattières, France.

For any question about your data: privacy@meshloom.app.

The website

The site is static: no account, no cookie, no advertising tracker and no third-party analytics. Like any web service it is served by Cloudflare, which sees your IP address and request headers to deliver the page, protect it from abuse and produce its own statistics and logs. The Worker that serves the site keeps Cloudflare's invocation logs (requested page address, response code) for the period Cloudflare sets.

The flasher

• USB or Bluetooth flashing: everything happens in your browser (Web Serial). The official MeshCore firmware is downloaded from GitHub through our server, which only relays the file.
• Release list: our server queries the GitHub API and caches the answer for a few minutes. No personal data is sent to GitHub for this.
• Wi‑Fi update without credentials: only the board and the TCP port are sent to the build server. The resulting firmware holds no credentials; it is deleted from our server after your download, or after 10 minutes.
• Wi‑Fi install with credentials: your Wi‑Fi name and password are sent over an encrypted connection (HTTPS) to our build server, through Cloudflare, which relays the traffic and can technically see it. They are used only to build this firmware: they are kept in temporary memory (not in a database, not on disk), hidden from the build log, and erased when the build ends. The firmware contains them, so anyone who gets the file can read them; it is deleted from our server after your download, or after 10 minutes.
• Anti-abuse: the build is protected by Cloudflare Turnstile, which analyses your browser to tell humans from bots.

Meshloom Community (optional)

Off by default, Community receives nothing until you join in Settings → Meshloom Community, with one exception: the optional Suggest codes button sends your radio's position, rounded to about 1 km, to Community once per click, even while Community is off. Like any request, it shows in Community's access logs with your IP address. Community records no code and binds nothing from it. Once Community is on, your server sends:

• the raw radio packets your radio hears, with signal strength, the radio's name and its public key (private and direct messages stay encrypted; the text of your conversations never goes through this path);
• your radio's position, if it has one, with your IATA code: rounded to about 1 km unless the radio's adverts already broadcast it exactly. It is shown on Community's public map;
• a status message every five minutes: name, public key, model, firmware version and radio settings, Meshloom version;
• directory requests and look-ups of hashtag channel names (public names only; keys are never shared).

Your radio's private key is never sent. Community's servers (mqtt.meshloom.app, api.meshloom.app) keep the IP address of requests in their access logs. When you leave Community, the position is deleted and the status cleared; packets already published stay in the statistics under the radio's name. To have everything deleted, write to privacy@meshloom.app.

Legal basis: your consent, given by joining Community and withdrawable at any time by leaving it.

Processors

• Cloudflare, Inc.: site hosting, network and protection (Workers, Turnstile), United States, standard contractual clauses and data processing agreement.
• Resend: sends and receives e-mail for @meshloom.app addresses. Mail you write to our contact addresses (contact@, privacy@, abuse@, ban@) is received by Resend, which tells the Community API through a webhook (email.received); the API stores only metadata (sender, recipients, subject, date, attachment names and sizes), never the body. The body is read from Resend when we open the message.
• GitHub, Inc.: source of releases and firmware files; it receives our server's requests, not your data.

Retention

The site keeps no visitor database. E-mails you write to us are kept by Resend for 30 days, and the Community API deletes their metadata after 30 days. Once we have read a message, any copy or reply kept in our own mailbox is kept only as long as needed to handle your request. See above for the flasher (10 minutes) and Community (until you leave) periods.

Your rights

You can ask for access, rectification, erasure, restriction or portability of your data, and object to its processing (GDPR, articles 15 to 21), by writing to privacy@meshloom.app. We answer within one month. You may also complain to the CNIL (cnil.fr).