1. Information We Collect

1.1 Account Information

When you create a Mesh account, we collect your name, username (handle), email address, and password (stored as a bcrypt hash — never in plain text). If you sign in via Sign in with Apple, we receive only the information Apple shares: your Apple ID, name (if you consent), and email address.

1.2 Profile & Content

Information you voluntarily add to your profile: bio, avatar, links, location, skills, and any posts, projects, images, videos, or files you upload to the platform.

1.3 Payment Information

Mesh does not store your payment card details. All payment processing is handled by Stripe. When you make or receive a payment, Stripe processes and stores your financial information under their own Privacy Policy. We receive from Stripe: transaction IDs, amounts, timestamps, and payment status — never raw card numbers or bank account details.

For sellers, Stripe Connect collects your identity documents (for KYC/AML compliance), tax ID, and bank account information as required by financial regulations.

1.4 Usage & Analytics

We collect information about how you interact with Mesh: pages visited, features used, posts liked or saved, searches performed, and time spent. This helps us improve the platform and personalize your experience.

1.5 Device & Technical Information

When you use Mesh, our servers automatically receive your IP address, browser type and version, device type, operating system, and referring URL. On the iOS app, we additionally collect device model and OS version for crash reporting and compatibility.

1.6 Communications

Messages you send to other users through Mesh's direct messaging system, and any support requests you send to us, are stored to enable the communication and for safety purposes.

1.7 AI Interactions

When you use Mesh AI (powered by Anthropic Claude and OpenAI), your prompts and the AI's responses are processed by those third-party AI providers. We store a record of AI conversations on Mesh's servers to enable conversation history and improve the AI experience. We do not use your content to train third-party AI models without your consent.

1.8 Push Notifications

On the iOS app, if you grant permission, we collect your device push token via Apple's Push Notification Service (APNs) to send you notifications about activity on your account. You can disable push notifications at any time in your device Settings.

2. How We Use Your Information

3. Third-Party Services We Use

All third-party providers listed above are required to process your data only as directed by Mesh and in accordance with applicable law. We encourage you to review their privacy policies for full details of their own data practices.

4. How We Share Your Information

We do not sell your personal information. We share it only in these circumstances:

• With other users: Your public profile, posts, and store listings are visible to all Mesh users and, depending on your privacy settings, to the public web.
• With service providers: As listed in Section 3 above, only to the extent needed to operate the Service.
• For legal compliance: We may disclose information when required by law, court order, or government authority, or to protect the rights, property, or safety of Mesh or its users.
• Business transfers: If Mesh is acquired, merged, or undergoes a restructuring, your information may be transferred as part of that transaction. We will notify you before your data is subject to a different privacy policy.
• With your consent: Any other sharing will only happen with your explicit consent.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: Retained until you delete your account, plus 30 days (for recovery purposes).
• Transaction records: Retained for 7 years for tax, legal, and fraud compliance purposes, even after account deletion.
• AI conversation history: Retained for up to 12 months, then automatically deleted.
• Usage logs: Retained for up to 90 days in raw form; aggregated analytics retained indefinitely.
• Push tokens: Deleted immediately when you revoke notification permission or delete your account.

6. Your Privacy Rights & Choices

6.1 Access & Portability

You can export your Mesh data (posts, messages, account info) at any time from your account settings under Settings → Account. Your export will be prepared within 30 days and delivered to your registered email.

6.2 Correction

You can update your name, email, username, and profile information directly in your account settings at any time. For other data corrections, contact jacksonsk2012@gmail.com.

6.3 Deletion — "Right to Be Forgotten"

You may request deletion of your account and personal data by visiting Settings → Danger Zone and selecting "Delete Account," or by emailing jacksonsk2012@gmail.com with the subject "Deletion Request." We will process your request within 30 days. Note that transaction records required by law will be retained per Section 5.

6.4 Opt-Out of Marketing Emails

Every marketing email from Mesh contains an unsubscribe link. You can also manage email preferences at Settings → Notifications. Transactional emails (password resets, purchase receipts, security alerts) cannot be disabled.

6.5 Push Notifications

You can disable push notifications at any time through your iPhone's Settings app under Notifications → Mesh, or within Mesh settings under Notifications.

6.6 GDPR & CCPA Rights

If you are located in the European Union, United Kingdom, or California, you have additional rights including: the right to object to processing, the right to restrict processing, and (for EU/UK users) the right to lodge a complaint with your local data protection authority. To exercise any of these rights, contact jacksonsk2012@gmail.com.

7. Security

We take security seriously. Mesh uses industry-standard measures to protect your data:

• All data in transit is encrypted using TLS 1.2+ (HTTPS)
• Passwords are hashed using bcrypt with a work factor of 12+
• Database access is restricted to authenticated services on private networks
• Session tokens are httpOnly cookies with strict SameSite settings
• Rate limiting and fraud detection protect against account takeovers
• Files are stored in Amazon S3 with restricted access policies

Despite these measures, no system is 100% secure. If you believe your account has been compromised, change your password immediately and contact jacksonsk2012@gmail.com.

8. Children's Privacy

Mesh is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we discover that we have collected personal information from a child under 13 without parental consent, we will delete it immediately. If you believe we have inadvertently collected such information, please contact jacksonsk2012@gmail.com.

Users between 13 and 17 may use Mesh with parental consent but may not access payment features. We encourage parents to monitor their children's online activity.

9. International Data Transfers

Mesh is operated from the United States. If you access Mesh from outside the US, your information will be transferred to and processed in the US, where data protection laws may differ from your country. For EU/UK users, we rely on Standard Contractual Clauses (SCCs) as the legal basis for transferring your data to the US.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email and an in-app notice at least 14 days before the changes take effect. The "Last Updated" date at the top of this page always reflects the most recent version. Your continued use of Mesh after the effective date constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related questions, data requests, or concerns, please contact our Privacy team:

Last updated: May 9, 2026 · Effective: May 9, 2026