Privacy Policy

Effective date: 27 October 2026

MeshChat ("the app", "we") is a private, end-to-end encrypted messenger made by Omar M Abu Sharifa ("the developer"). This policy explains what data the app handles and where it goes. The short version: we run no servers that see your messages, we have no accounts, and we do not track you.

1. What we do not collect

• No account, name, phone number or email address is required or collected.
• No analytics, advertising, crash-reporting or other third-party SDKs are included in the app.
• The developer does not receive, store or have access to your messages, contacts, media, profile or location.
• This website uses no cookies, no analytics and no third-party scripts, fonts or embeds.

2. Data stored on your device

Your identity keys, contacts, messages, photos, voice messages and files are stored only on your device, in an encrypted database. The encryption key is protected by the iOS Keychain or the Android Keystore. Optional app lock can require biometrics or your device credentials. Android backups of app data are disabled. The developer cannot recover this data for you.

3. How messages travel

Messages are end-to-end encrypted between you and the recipient. They travel by one or more of the following paths, and contents are never readable by relays or intermediaries.

Bluetooth mesh

The app advertises and scans over Bluetooth Low Energy so nearby phones can find each other. Other MeshChat phones in range can forward encrypted packets for you. Anyone nearby with a Bluetooth radio can observe that Bluetooth traffic exists and may be able to see signal strength. Forwarding phones see only encrypted data and the routing information needed to pass it on.

Same Wi-Fi

When enabled, the app discovers and connects to contacts on the same local network. Your local IP address is visible to other devices on that Wi-Fi network that connect to you, and the network owner can see that devices are exchanging data. Connections are encrypted.

Internet link

The optional internet link connects you directly to your contacts using a peer-to-peer network (Hyperswarm). Because connections are direct, your IP address is visible to the contacts and group members you connect to, and to nodes of the distributed hash table (DHT) network that help peers find each other, along with a stable public key used for lookup. Message contents remain encrypted. You can set the internet link to off, Wi-Fi only, or Wi-Fi and cellular in Settings. When it is off, the app does not use the internet link.

4. Optional instant notifications (iPhone push relay)

iOS does not let a closed app listen for messages, so the iPhone app offers an optional push relay, run by the developer at push.omr.it.com. It is used only if you turn instant notifications on and your internet mode is not Off. Sending a push also needs the sender to be online.

The relay stores only: a random mailbox identifier, your Apple Push Notification service (APNs) device token, hashes of the per-contact send capabilities, and expiry and rate-limit counters. It does not store plaintext messages, names, your identity key or contact lists, and its logs carry no identifiers, tokens or IP addresses. It forwards a small, padded, encrypted payload to Apple's APNs; only your phone can decrypt it. The relay can see the payload size class, timing, and the IP address of the sender while a push request is in flight. Apple, as the operator of APNs, sees your device token, the timing and frequency of notifications, and a generic alert; it does not see names or message text.

Mailboxes expire after 30 days without renewal. Turning push off, setting Internet to Off, or using panic wipe deletes your mailbox at the relay. Android does not use this relay.

5. Operating system services

The app relies on services from Apple (iOS, APNs, TestFlight, App Store) and Google (Android, Play), which have their own privacy policies. If you install the app through a store or TestFlight, the store operator may collect information about your download and device under its own terms. The developer does not receive your personal data from them, only aggregate store statistics.

6. Permissions

• Bluetooth / Nearby devices: to find and talk to nearby phones.
• Local network (iOS): to connect to contacts on the same Wi-Fi.
• Camera: only to scan a contact's QR code. Microphone: only while recording a voice message.
• Notifications: to show message alerts.
• Biometrics: only to unlock the app if you enable app lock. Biometric data is handled by your operating system and never reaches the app or the developer.

The app does not collect location. Older Android versions require a location permission for Bluetooth scanning; the app does not use it to determine your location.

7. Information you share with others

Whatever you send to a contact or group, including profile name, photo and about text, can be saved, copied or shared by the recipients. Group members can see who else is in the group. We cannot delete content from other people's devices.

8. Children

MeshChat is not directed to children under 13 (or the minimum age of digital consent in your country). We do not knowingly collect data from children. Since we collect no personal data, there is nothing to delete on our side. Parents who believe a child is using the app can contact us.

9. Deleting your data

You are in control: use panic wipe in the app to erase keys, messages, app lock and settings, and to remove any push mailbox. Uninstalling the app also removes its data from your device. Because we hold no copy of your data, there is nothing on our servers to request. Contacts may still hold copies of what you sent them.

10. Security

We use well-reviewed standard cryptography and design to minimise exposed data, but no software is perfectly secure. Keep your device updated and use a device passcode.

11. Changes

We may update this policy as the app changes. The effective date above will change, and material changes will be noted on this page.

12. Contact

Questions or privacy requests: Telegram @omrrrs, or see omr.it.com.