Privacy

The short version

“Identity can be public. Location can be public. The link between them cannot.” Anyone can look at the map and see which squares each team holds. Seeing which real account is behind a specific position requires being signed in. And the operating rule behind everything below is simple: the less MeshWars stores, the better.

What we store, and why

This is everything MeshWars keeps about a player, in plain terms, and how it's stored.

Sign-in identity

When you sign in with Google, GitHub or Discord, MeshWars stores the provider's name, the account id that provider gave us, your email address, and whether that provider says the email is verified. All of it is stored as given — none of it is hashed or encrypted.

Contact email

A contact email you set yourself is stored raw. It's for reaching you — you can never sign in with it.

Password

If you set a password, only a scrypt hash of it, with a salt, is stored. The password itself is never kept.

Two-factor authentication

The secret behind your two-factor codes is stored encrypted, with the encryption key held outside the database. Your recovery codes are stored as SHA-256 hashes only, and are deleted the moment you turn two-factor off.

API keys

Both a player key and an integration key are stored as a hash. The raw key is shown to you once, when it's issued, and is never stored anywhere after that — lose it and it has to be reissued, not recovered.

Display name

Your display name is whatever you chose. It's stored raw, and there is no requirement that it be your real name.

Sessions

Signing in creates a session. MeshWars stores a hash of your session cookie — never the cookie itself — a coarse device label like “Chrome on Windows,” and when the session started and last renewed. It does not store your IP address: that column has been dropped from the database entirely, and the same change rewrote every stored raw browser identifier down to that same coarse device label.

Radio and node identifiers

Your radio's node ID or public key is stored as-is. This isn't really a MeshWars secret — your radio already broadcasts that identifier in the clear, over the air, to anyone listening on the mesh.

Positions

Each ping updates your last known position; it overwrites the previous one rather than piling up a history. Pings and repeater credit are stored at roughly 300-metre grid-cell resolution, not exact coordinates, and are deleted 48 hours after they're recorded. An earlier table that held finer-grained position tied to radio identity was found in an audit and dropped outright — it no longer exists in any form.

Kept forever, on purpose

Some records are never deleted. This is deliberate, not an oversight: capture history (who took which square, and when), check-in awards, team changes, the account event log and the admin action log are all kept indefinitely, because they're what makes the scoreboard's history and an audit trail possible at all.

How long everything else is kept

Outside of what's kept forever above, everything else runs on a timer enforced in code:

That last row is recent: dead session rows are now swept within about an hour of going dead. A session you're still actively using is never touched by this.

What you can do yourself

From your account, you can sign out one device or every device, rotate your API key, set or remove a password, unlink a sign-in provider, and turn two-factor off.

You can also delete your account outright. “Delete my account” destroys, in one irreversible step, everything that identifies you: every sign-in method, your password, your two-factor secret and recovery codes, every active session, and your API key. Any radios you'd registered are unbound. It has to be confirmed by typing your own display name (and a two-factor code too, if you have one enabled), so it can't happen by accident or from a browser that isn't really yours.

What it does not erase is the game record. The framing is deliberately “delete the person, keep the team” — the squares your team already holds because of you, and your capture history, month awards and check-in awards, all stay on the board exactly as they are. Only your player's own display name changes, to a placeholder nobody can trace back to you; who used to hold that name is not recoverable afterward.

Who can see the link between identity and location

The map is public — anyone can see which squares each team holds. Seeing which account sits behind a specific position is different: that requires signing in. A route that once exposed this link without signing in has since been closed.

The integration API

The one deliberate exception is /api/v1, the integration API used by bots and dashboards built on MeshWars, which returns more than an anonymous visitor sees. In the operator's own words: its key is issued personally by the operator, so it's accountable rather than anonymous, and revocable per key.

What leaves the system

MeshWars talks to a small number of outside services, each in a narrow way:

• Mesh data sources (MeshView, FreqMapper, MeshCore map endpoints) — MeshWars only reads from these. It's a consumer of mesh coverage data that's already public; no player data goes out to them.
• Sign-in providers (Google, GitHub, Discord) — they receive only what a sign-in requires, and return your subject id, email and verified flag. Nothing else comes back, and nothing else is kept.
• Email — sent through an SMTP server the operator configures. A sign-in email contains only the sign-in link.

There is no analytics or telemetry of any kind in the backend.

Cookies and local storage

Every cookie MeshWars sets is HttpOnly, SameSite=Lax and Secure by default. Your session cookie lasts 30 days and slides forward each time you use it. A few short-lived cookies exist for the moments in between: mid-sign-in state, a pending account link, and an in-progress two-factor challenge.

The only thing MeshWars keeps in your browser's local storage is whether you've dismissed a notice, tagged to that notice's version. There is no identity of any kind in it.