Privacy
What MeshWars stores about you, why, how long it's kept, who can see it, and what you can remove yourself. Identity can be public. Location can be public. The link between them cannot.
The short version
“Identity can be public. Location can be public. The link between them cannot.” Anyone can look at the map and see which squares each team holds. Seeing which real account is behind a specific position requires being signed in. And the operating rule behind everything below is simple: the less MeshWars stores, the better.
What we store, and why
This is everything MeshWars keeps about a player, in plain terms, and how it's stored.
Sign-in identity
When you sign in with Google, GitHub or Discord, MeshWars stores the provider's name, the account id that provider gave us, your email address, and whether that provider says the email is verified. All of it is stored as given — none of it is hashed or encrypted.
Contact email
A contact email you set yourself is stored raw. It's for reaching you — you can never sign in with it.
Password
If you set a password, only a scrypt hash of it, with a salt, is stored. The password itself is never kept.
Two-factor authentication
The secret behind your two-factor codes is stored encrypted, with the encryption key held outside the database. Your recovery codes are stored as SHA-256 hashes only, and are deleted the moment you turn two-factor off.
API keys
Both a player key and an integration key are stored as a hash. The raw key is shown to you once, when it's issued, and is never stored anywhere after that — lose it and it has to be reissued, not recovered.
Display name
Your display name is whatever you chose. It's stored raw, and there is no requirement that it be your real name.
Sessions
Signing in creates a session. MeshWars stores a hash of your session cookie — never the cookie itself — a coarse device label like “Chrome on Windows,” and when the session started and last renewed. It does not store your IP address: that column has been dropped from the database entirely, and the same change rewrote every stored raw browser identifier down to that same coarse device label.
Radio and node identifiers
Your radio's node ID or public key is stored as-is. This isn't really a MeshWars secret — your radio already broadcasts that identifier in the clear, over the air, to anyone listening on the mesh.
Positions
Each ping updates your last known position; it overwrites the previous one rather than piling up a history. Pings and repeater credit are stored at roughly 300-metre grid-cell resolution, not exact coordinates, and are deleted 48 hours after they're recorded. An earlier table that held finer-grained position tied to radio identity was found in an audit and dropped outright — it no longer exists in any form.
Your device's location on the map
The map has a "My location" option, and a follow mode that keeps the map centred as you move. Both are off until you switch them on, and switching them on asks your browser for permission. This is not the same thing as the radio positions above, and it is worth being exact about the difference: your device's location is used entirely inside your own browser, to draw the marker and to work out which grid square you are standing in. It is never sent to meshwars.com, never written to the database, never logged, and never kept — when you switch the option off or close the page, it is gone. Nothing about where you are personally reaches the server or any other player.
Site traffic
This one applies to every visitor to meshwars.com, not just players. The site counts page views so the operator can see how many people are looking at it. What it stores is a salted, one-way hash of your address and browser together — never the address itself, never the browser string itself, and there's no way to turn the hash back into either. That hash is kept for 90 days and used only to produce aggregate counts: page views, how many distinct visitors showed up, and how many of those were new. Automated traffic (search crawlers, uptime monitors, and the like) is recognised and counted separately, never mixed into the visitor numbers above.
Kept forever, on purpose
Some records are never deleted. This is deliberate, not an oversight: capture history (who took which square, and when), check-in awards, team changes, the account event log and the admin action log are all kept indefinitely, because they're what makes the scoreboard's history and an audit trail possible at all.
How long everything else is kept
Outside of what's kept forever above, everything else runs on a timer enforced in code:
| Position pings and repeater credit | 48 hours |
|---|---|
| Ingest stat counters | 30 days |
| Message buffer | 48 hours |
| Duplicate-detection ledger | 72 hours |
| Unresolved check-in sender log | 60 days |
| Site traffic hashes | 90 days |
| Sign-in tickets and two-factor challenges | consumed, or expired and swept |
| Dead session rows (signed out, revoked or expired) | swept about an hour later |
That last row is recent: dead session rows are now swept within about an hour of going dead. A session you're still actively using is never touched by this.
What you can do yourself
From your account, you can sign out one device or every device, rotate your API key, set or remove a password, unlink a sign-in provider, and turn two-factor off.
You can also delete your account outright. “Delete my account” destroys, in one irreversible step, everything that identifies you: every sign-in method, your password, your two-factor secret and recovery codes, every active session, and your API key. Any radios you'd registered are unbound. It has to be confirmed by typing your own display name (and a two-factor code too, if you have one enabled), so it can't happen by accident or from a browser that isn't really yours.
What it does not erase is the game record. The framing is deliberately “delete the person, keep the team” — the squares your team already holds because of you, and your capture history, month awards and check-in awards, all stay on the board exactly as they are. Only your player's own display name changes, to a placeholder nobody can trace back to you; who used to hold that name is not recoverable afterward.
Who can see the link between identity and location
The map is public — anyone can see which squares each team holds. Seeing which account sits behind a specific position is different: that requires signing in. A route that once exposed this link without signing in has since been closed.
The integration API
The one deliberate exception is /api/v1, the integration API used by bots and dashboards built on MeshWars, which returns more than an anonymous visitor sees. In the operator's own words: its key is issued personally by the operator, so it's accountable rather than anonymous, and revocable per key.
What leaves the system
MeshWars talks to a small number of outside services, each in a narrow way:
- Mesh data sources (MeshView, FreqMapper, MeshCore map endpoints) — MeshWars only reads from these. It's a consumer of mesh coverage data that's already public; no player data goes out to them.
- Sign-in providers (Google, GitHub, Discord) — they receive only what a sign-in requires, and return your subject id, email and verified flag. Nothing else comes back, and nothing else is kept.
- Email — sent through an SMTP server the operator configures. A sign-in email contains only the sign-in link.
There is no third-party analytics or telemetry of any kind in the backend. Page-view counting (see “Site traffic” above) is done entirely in-house on this server — nothing about your visit is sent to an outside service to make it work.
Last reviewed 2026-09-07.