Privacy Policy

MeshTalk for Android · Last updated 2026-07-07

Short version: MeshTalk has no servers, no accounts, and everything it stores lives only on your device. The only place your messages travel is directly, over Bluetooth, to other nearby phones running MeshTalk. The app uses Firebase (operated by Google) for anonymised crash reporting, usage analytics, and performance monitoring — you can disable all of this in Settings > "Usage & crash reporting" at any time.

What MeshTalk stores on your device

Your identity keypair — generated on first launch, stored in the app's private storage. Never leaves your device except as a public key, which other MeshTalk users see when you're nearby.
Your nickname — chosen during onboarding, shared with nearby peers so they know who's talking.
Contacts — the public keys and nicknames of other MeshTalk users your phone has seen nearby, plus when you last saw them.
Messages — public feed posts and direct messages you've sent or received, including any photos/files attached, stored locally in the app's database.

None of this is uploaded anywhere. There is no MeshTalk server. Uninstalling the app removes all of it.

What gets sent over Bluetooth, and to whom

MeshTalk talks directly to other phones running the app within Bluetooth range — no internet connection is used or required. Two kinds of messages exist:

Public messages are readable by anyone on the mesh, by design — that's the point of a public feed. They're cryptographically signed so recipients can verify who sent them, but not encrypted.
Direct messages are end-to-end encrypted (X25519 + AES-GCM) so only the intended recipient can read the content. Other phones may still relay the encrypted bytes to help the message reach its destination, but can't decrypt them.

Because this is a mesh network, your phone also relays other users' messages toward their destination — this is how range is extended beyond a single Bluetooth connection. Relaying only forwards already-encrypted or already-public bytes; your phone doesn't read the content of messages that aren't addressed to it.

Attachments

Photos and files you send are compressed/size-capped and transmitted the same way as text — public ones are visible to the mesh, DM ones are encrypted. You can turn off receiving attachments in Settings; when off, your device still relays other people's attachment data for the mesh, it just doesn't store or display it for you.

Permissions MeshTalk requests, and why

Bluetooth (scan/advertise/connect) — required to find and talk to nearby phones; this is the entire mechanism of the app.
Nearby devices / location (older Android versions) — Android requires this permission for Bluetooth LE scanning on some OS versions. MeshTalk does not use GPS or any other location source, and does not read or store your location.
Notifications — used to alert you to new direct messages and to show the ongoing "mesh is running" status notification required for background operation.
Battery optimization exemption (optional) — improves reliability of background message delivery; you can decline this and use the app normally.

Third-party services

MeshTalk uses Google Firebase to help the developer understand how the app is being used and to identify issues. Three Firebase services are integrated:

Firebase Analytics

Collects anonymised, aggregated data about how people use the app — for example, which screens are viewed, which features are most used, and the number of active users. No personally identifiable information (no names, no message content, no contact data, no Bluetooth identifiers) is collected. This data is processed by Google's servers and is subject to Google's Privacy Policy.

Firebase Crashlytics

Collects crash reports when the app encounters a fatal error. Each report includes the stack trace (which line of code failed), the device model, Android version, and app version. No message content, cryptographic keys, contacts, or any user-generated data is included. Crash reports are processed by Google and help the developer fix bugs.

Firebase Performance Monitoring

Collects anonymised performance data — app startup time, how long it takes to render screens, and similar technical metrics. This helps the developer keep the app fast. No user data or message content is collected.

Opting out of Firebase data collection

All three Firebase services can be turned off at any time from within the app: open Settings and toggle off "Usage & crash reporting". When disabled, no analytics events, crash reports, or performance metrics are sent to Google. This setting is immediate — no data is queued or sent after you turn it off. It is enabled by default so the developer can learn about issues early, but you have full control.

Other third parties

Aside from Firebase (as described above), MeshTalk does not integrate any advertising, analytics, or other third-party SDKs, and does not communicate with any server operated by the developer or anyone else.

Children's privacy

MeshTalk does not knowingly collect any information from anyone, of any age, since it doesn't collect information at all in the traditional sense — everything described above stays on-device or goes directly to other nearby users' devices.

Changes to this policy

If this policy changes, the updated version will be posted at this same address with a new "last updated" date.

Contact

Questions or concerns can be raised via GitHub Issues on the project repository.

← Back to MeshTalk