PRIVACY STATEMENT -- meshbay.org
Last updated: 11 September 2026

1. CONTROLLER

   The data controller is the person responsible for meshbay.org (see
   the Legal Notice). Contact: meshbay.project@gmail.com

   This statement covers the meshbay.org server only. A group's data
   is kept on the machine of the participant hosting it (their
   "node"), who alone is responsible for it.


2. WHAT THE SERVER KEEPS

   Your account:
   - your username;
   - your email address, encrypted. It is used only to write to you
     (verification, account recovery);
   - your password, only as an irreversible hash: it cannot be read
     back.

   What running the service requires:
   - the groups you are a member of;
   - your registered devices and nodes, and your nodes' IP address,
     which the members of your groups need in order to connect to them;
   - your notifications (for example: a message was posted in a group,
     without its content) and your preferences.

   A connection log: IP address, date and type of action (sign-in,
   account creation, joining a group…). It is kept for one year for
   legal reasons.

   The server keeps none of your groups' content, files or messages,
   and no private key.


3. WHY

   - Managing your account and running the service: performance of
     the contract (Terms of Use).
   - Connection log: legal obligation to retain identification data
     (French LCEN, decree no. 2021-1362).
   - Protecting the service against abuse: legitimate interest.


4. HOW LONG

   - Account and related data: until the account is deleted. A
     registration that is never confirmed is erased after 7 days.
   - Connection log: one year, for legal reasons, then erased
     automatically.


5. NO ADVERTISING, NO TRACKING

   No data is sold, rented or transferred. No advertising, no audience
   measurement. meshbay.org sets no cookies: your browser only keeps,
   on your device, your session and your preferences.

   Your data is disclosed only to:
   - the judicial authorities, on a lawful request;
   - Google, the only third party your IP address is sent to: at
     registration and when requesting a password reset, an anti-robot
     check (reCAPTCHA) sends it your IP address and information about
     your browser. This data may be processed outside the European
     Union, and Google may set a cookie.


6. YOUR RIGHTS

   The "Profile" section shows your account information and lets you
   change it.

   It also lets you delete your account. All the data described in
   section 2 is then erased, the sole exception being the connection
   log, which keeps your username until the end of its one-year legal
   retention period. Groups you own must first be handed over or
   deleted.

   You have the rights of access, rectification, erasure, restriction,
   objection and portability. For a complete copy of your data or any
   other request: meshbay.project@gmail.com. Answer within one month.

   You may lodge a complaint with the CNIL (www.cnil.fr) or your
   national supervisory authority.


7. CHANGES

   Any substantial change is signalled in the application.