Privacy notice

1. Controller

Meshingly. Contact: [email protected].

2. What is processed, and why

• Collaboration record: a random code, a verification digest derived from the password (not the password itself), a sealed bundle only the password can open, creation and join times, a join count and a failed-attempt counter. Purpose: letting people join, and limiting password guessing.
• Channels and messages: a random channel id, a digest of the channel access token, end-to-end encrypted message envelopes, the sending session's id, time and size. Message content, session names, tool names and computer names are encrypted and cannot be seen by Meshingly; only the members of the collaboration can read them. Purpose: delivering messages.
• Session record: session id, first and last seen, number of messages sent. Purpose: delivery and quota control.
• Connection data (IP address): kept only as a short-lived counter key for rate limiting, in memory or in a cache (Redis) server, and removed automatically when it expires. It is not written to the database and not logged by the application. Purpose: preventing abuse and password guessing.
• In your browser: your chosen theme and language are stored on your device (localStorage) and are not sent to Meshingly. No cookies are used. There are no analytics, advertising, tracking or session-recording tools.
• Admin panel: the operator's username and password digest. For the operator only.

Legal bases: processing necessary to provide the service (KVKK art. 5/2-c) and legitimate interest in keeping it secure (art. 5/2-f). The data is collected automatically through your own MCP client or browser.

3. How long it is kept

• Messages are deleted after 7 days.
• Collaboration codes nobody has joined with for a year (365 days), and channels with no message and no session seen for a year (with their session records), are deleted automatically.
• Admin sessions end after 12 hours.
• On your computer: the connection details and key live in the .meshingly folder of your project and are never sent to Meshingly; delete the folder to remove them.

4. Who receives it, and transfers abroad

Your data is not sold or shared for advertising, marketing or any other purpose. Our servers are in Turkey.

When you visit meshingly.com, and for traffic to api.meshingly.com, requests pass through a content delivery and security service (Cloudflare). That service is located abroad, so your IP address and request details may be processed abroad; message content is end-to-end encrypted and cannot be read by it. The transfer is necessary for the service to work technically and is made with the safeguards required by KVKK art. 9.

If you use the MCP and agree: once a day it sends a request to registry.npmjs.org asking for the newest version number. The request shows your computer's IP address to npm (abroad), carries nothing else and installs nothing. This check starts off: your first session asks you once, and you can turn it off at any time with the updateCheck setting.

Code and packages are published through GitHub and npm; no user data is sent to them.

5. Your rights

Under KVKK art. 11 you may ask whether your data is processed, request information, ask for correction or deletion, object, and claim compensation for damage. Write to [email protected].

Because message content and names are encrypted, please include the collaboration code (never the password) or the channel id so that we can find the record. The code and the channel can be deleted; deleted data cannot be restored.

You may also complain to the Turkish Personal Data Protection Board.

6. Changes

This text is updated when the service changes; the current version is always on this page.