Privacy Policy

MeshStar (“the app”) is an off-grid messenger for iPhone. It sends messages between phones over Bluetooth, over LoRa radios (MeshCore nodes) and, through a gateway box, over the Iridium satellite network. This policy explains what data the app handles, where it goes and who can see it. “We” and “us” mean the developer of MeshStar, the publisher shown on the App Store page. Contact: [email protected].

Summary

• No accounts, no registration, no phone number or e-mail required.
• No analytics, advertising, tracking or third-party SDKs.
• Direct messages and voice notes are end-to-end encrypted on your phone. Gateways, the satellite network and our relay carry only encrypted data.
• Your keys, contacts and message history stay on your device. You can erase everything at any time.

Data stored on your device

• Identity keys. On first launch the app generates cryptographic key pairs (X25519, Ed25519). They are kept in the iOS Keychain on this device and are never sent to us. Your public key and display name are shared only when you show your QR code or appear in the Bluetooth mesh (see below).
• Contacts you add by QR code, message history, voice notes and settings, stored in encrypted app storage (iOS Data Protection) and excluded from iCloud backups.
• Retention. You choose how long each chat is kept, from minutes to forever. Expired messages are deleted on the device.
• Emergency wipe. A triple tap on the MeshStar title, after one confirmation, erases keys, contacts, history and settings.

Data that leaves your device

Direct messages and voice notes (end-to-end encrypted)

Each message is encrypted for the recipient’s public key and signed with yours. Only the recipient can read it. Whatever carries it (another phone, a radio, a gateway box, the satellite network, our relay) sees only:

• the recipient’s address (a hash of their public key) and a packet hash, used to route and confirm delivery;
• the size and the time of transmission.

The sender’s identity is inside the encrypted part. Delivery receipts are signed by the recipient and contain no message content.

Bluetooth mesh with nearby phones

To find people nearby, the app broadcasts your display name and a public key over Bluetooth. Anyone with the app within Bluetooth range can see them. Public mesh messages are visible to everyone nearby; private messages are encrypted.

MeshCore LoRa radio (optional)

If you connect your own MeshCore node, the app talks to it over Bluetooth. End-to-end encrypted messages travel through the radio network as encrypted fragments. Text channels of the radio network (for example “Public”) are not end-to-end encrypted: they are encrypted with the channel key, and anyone who has that key (for Public, anyone) can read them. The app shows such channels separately from encrypted chats.

Gateway box and satellite (optional)

To use satellite messaging you configure a gateway box (an address and an access token). The box receives your encrypted packets and passes them to an Iridium satellite modem. The operator of the box (you, someone you trust, or us for a demo gateway) can see the routing data listed above, but not the content. Gateway boxes we operate keep an access log (token name, request type, time) for up to 30 days.

Satellite packets travel through the Iridium network, its service provider and our relay server, which forwards them between gateway modems. The relay keeps routing data (recipient hash, packet hash, size, time) only as long as needed to deliver and confirm a message, and operational logs for up to 30 days for troubleshooting. It never has access to message content.

Reporting a message

If you choose “Report” on a message, the app opens an e-mail draft addressed to us with the message identifier. Nothing is sent unless you send that e-mail yourself. We then receive your e-mail address and what you write, and use them only to handle the report.

Permissions

• Bluetooth — the mesh with nearby phones and connecting your MeshCore node.
• Microphone — only while you record a voice note.
• Camera — only to scan QR codes of contacts and radio channels.
• Photos — only when you pick an image to share in the Bluetooth mesh.
• Local network — to reach a gateway box you configure on your network.
• Notifications — local alerts about incoming messages, generated on the device.

The app does not request your location.

What we do not do

We do not sell, rent or share personal data. We do not build profiles. We cannot read your messages and cannot hand them over, because we do not have the keys.

Your choices

There is no account to delete: removing the app or using the emergency wipe erases all data the app holds. To ask about logs on a gateway box or relay we operate, write to [email protected].

Children

The app is not directed at children under 13.

Changes

We will post updates to this page and change the date above.

Contact

[email protected]