What we collect, why, and how long we keep it
Account information
When you sign up: your email address, a bcrypt-hashed password
(we never store the plaintext), an optional display name, and the
organization name you typed on the signup form. If you use
"Continue with Google", we receive your Google account ID, email,
and display name from Google's OpenID Connect — nothing else.
Retention: for the life of your account, plus 30
days after deletion so accidental deletes are recoverable.
Mesh metadata (not traffic)
For each machine you add to your mesh, we store: the name you gave
it, its public WireGuard key, its assigned overlay IP, and
aggregate handshake counters (last seen time, bytes transferred —
for the dashboard's status indicators). We never store the
private keys of your devices; those are shown to you once
at device creation and then forgotten by us.
We also generate and store a per-tenant hub private key
(encrypted at rest with AES-256-GCM) that your peers use to
establish tunnels to the controller. The encryption key for this
field is held in the controller's environment and is never logged.
Retention: while the machine is in your mesh; deleted within minutes when you remove it.
What we never see
Your mesh traffic is WireGuard, encrypted peer-to-peer. The
controller acts as a hub for tunnel establishment, but
the data inside the tunnels is end-to-end encrypted with keys we
do not hold. We technically forward packets between your peers'
namespace and can therefore see packet sizes and IP-header
metadata in the kernel; the payload content is encrypted and
unreadable to us.
Billing
If you upgrade to a paid plan, we store your billing email, the
plan, the machine count we're invoicing for, and invoice history.
Card details are handled by Stripe — they never reach our servers.
Retention: 7 years after the last invoice, to meet tax obligations.
Technical logs
The controller writes operational logs: HTTP request method/path/status, source IP,
timestamp, and error messages. These rotate every 7 days.
Application errors that include user-identifying context (email addresses, etc.)
are scrubbed before they're written.
Retention: 7 days for HTTP logs; 30 days for error logs.
Web analytics
We use self-hosted Plausible Analytics on
meshwg.com. Plausible doesn't use cookies, doesn't fingerprint browsers, and
doesn't collect personal data. The only thing recorded for a visit is the page
path, anonymized referrer, anonymized country (from IP — IP itself discarded),
browser family, and operating system. Aggregate, never individual.