Skip to content
moonstreamtech

Privacy Policy

How MeshChat handles your information — and why most of it never leaves your phone.

Last updated: 4 October 2026

MeshChat is a one-to-one messaging app for Android and the web, published by Moonstream Tech. It has no servers: devices running MeshChat find each other and carry each other's messages, and every message is end-to-end encrypted so that only its recipient can read it. This page explains, plainly, what information exists, where it goes and who can see it. For the studio-wide policy, see the Moonstream Tech Privacy Policy.

In short: Moonstream Tech does not run a server for MeshChat and receives none of your messages, contacts or profile. There is no sign-up with a phone number or e-mail, no ads, no analytics and no purchases. Messages and photos are deleted automatically 30 days after they are sent.

How MeshChat works

When you create an account, your phone generates a pair of cryptographic keys. Your account ID is derived from your public key. Other MeshChat devices that are online at the same time connect to each other directly (WebRTC). A message you send is encrypted on your phone for its recipient, then passed from device to device until it reaches them. If the recipient is offline, devices that are online keep the encrypted message for up to 30 days and hand it over when the recipient comes back. They cannot read it.

Information kept on your device

Stored in the app's own storage on your phone (or browser) and not sent to Moonstream Tech:

  • Your private keys (your account).
  • Your messages and photos, conversations, drafts, reactions, read status and blocked list.
  • Public profiles of other users you have seen, and profile photos.
  • Encrypted messages you carry for other users (you cannot read them).
  • Your settings (theme, notifications, privacy options, network settings).

Your public profile

So that people can find you and send you messages, MeshChat shares a signed profile with other MeshChat devices: your username, your 4-digit tag (as in name#1234), your public keys and account ID, and — only if you add them — an "about" text and a profile photo. Anyone using MeshChat can see this profile. Do not put information in it that you do not want to be public.

Messages and photos

Messages, photos, replies, reactions, edits, deletions and read receipts are end-to-end encrypted (ECDH P-256 key agreement and AES-256-GCM) on your device. Only you and the recipient can decrypt them; the devices that carry them, and Moonstream Tech, cannot. Photos are resized and re-encoded on your phone before sending, which also removes hidden metadata such as location.

Devices that carry a message can see its envelope: the sender's and recipient's account IDs, the time and the size. The "typing…" indicator is encrypted too and is never stored.

Online status

If Online status is on (Settings → Gizlilik), your device sends a small signed "I'm online" note to the network about once a minute, so others can see that you are online or when you were last seen. Turn it off to stop sending it; devices directly connected to yours can still tell that you are connected.

Connection data and third parties

To connect devices, MeshChat uses standard internet services run by third parties. They never receive messages or profiles, but they do see your IP address:

  • Public WebTorrent trackers (tracker.webtorrent.dev, tracker.openwebtorrent.com) help devices find each other. They receive your IP address, a random session ID that changes every time the app starts, and technical connection offers (which contain network addresses).
  • STUN servers operated by Google (stun.l.google.com) tell your device its public address. They see your IP address.
  • Other MeshChat devices you connect to see your IP address, as with any direct connection.
  • If you add your own TURN or signaling server in Settings → Ağ, that server is yours to choose and runs under its operator's terms.

Because devices connect across the world, your public profile and encrypted messages may pass through devices in other countries.

What Moonstream Tech receives

Nothing, unless you contact us. We do not operate a MeshChat server, and we do not collect analytics, crash reports, advertising IDs, contacts or location. We do not sell or share personal data.

If you report a user or a message, the app prepares an e-mail to us in your e-mail app with the reason, the reported user's name and account ID, your own name and account ID, the app version and — if you report a message — that message's text. You see it and decide whether to send it. We use reports only to handle abuse and, where required, to work with the authorities, and delete them when they are no longer needed. The same applies to any other e-mail you send us.

Key file and backups

The key file you save when you create your account contains your keys, encrypted with your recovery code (and optional password); the chat backup is encrypted with a key only your account can derive. You choose where to save these files (for example your cloud drive). We never receive them and cannot open them.

Permissions

  • INTERNET — to connect to other devices, trackers and STUN servers.

MeshChat does not request access to your contacts, camera, microphone, location or files. Photos are picked one at a time with the system picker; key files and backups are saved through the system share or download screen.

Retention and deletion

  • Messages and photos are deleted automatically 30 days after they are sent, on the sender's and the recipient's devices.
  • Encrypted copies carried for offline users are kept for at most 30 days and deleted as soon as the recipient confirms delivery.
  • An account whose devices have not been online for 90 days is treated as deleted by all MeshChat devices; a device that has not been opened for 90 days deletes the account stored on it.
  • When you log out, your data is kept on the device in an encrypted vault that only your key file and code can open, or deleted if you choose so. Vaults not opened for 90 days are deleted.
  • Delete account (Settings → Kimlik ve güvenlik → Hesabı sil) sends a deletion record signed with your key: your profile disappears from search, your name#tag is freed, nobody can message you, copies carried for you are dropped, and all data on your device is erased. Messages already on other people's devices stay there until they expire (30 days) or they delete them. See Delete your account.

Security

Keys never leave your device except inside your encrypted key file. Each chat has a safety code you can compare with the other person to make sure nobody is in the middle. No system is perfectly secure; keep your key file and recovery code safe and separate.

Children

MeshChat is intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal information from children. See our Child Safety Standards.

Your rights

Because your data is on your own device, you can see, change, export (chat backup) and delete it in the app at any time. Depending on where you live (for example under the GDPR or Turkey's KVKK) you have rights to access, rectify, erase and object; since Moonstream Tech holds no MeshChat data about you, such requests are fulfilled in the app, and we will answer any question at moonstreamtech@gmail.com.

Changes to this policy

We may update this policy when MeshChat changes. The "Last updated" date will change accordingly, and the Data safety section on Google Play will be kept in sync.

Contact

Moonstream Tech — moonstreamtech@gmail.com

Türkçe: Gizlilik Politikası özeti (KVKK aydınlatma)

Veri sorumlusu: Moonstream Tech (moonstreamtech@gmail.com). Son güncelleme: 4 Ekim 2026.

  • Sunucumuz yok. MeshChat için bir sunucu işletmiyoruz; mesajlarını, kişilerini ya da profilini almıyoruz. Reklam, analiz ve satın alma yoktur; telefon numarası veya e-posta istenmez.
  • Cihazında saklananlar: gizli anahtarların, mesajların ve fotoğrafların, sohbet ayarların, gördüğün kullanıcıların herkese açık profilleri ve başkaları için taşıdığın şifreli (okuyamadığın) mesajlar.
  • Herkese açık profil: kullanıcı adın, 4 haneli etiketin, açık anahtarların ve — eklersen — "hakkında" metnin ve profil fotoğrafın diğer MeshChat kullanıcılarıyla paylaşılır.
  • Mesajlar uçtan uca şifrelidir (ECDH P-256 + AES-256-GCM). Sadece sen ve alıcı açabilir. Mesajı taşıyan cihazlar yalnızca gönderen ve alıcı kimliklerini, zamanı ve boyutu görebilir.
  • Bağlantı verisi: cihazların birbirini bulması için kullanılan halka açık tracker'lar ve Google STUN sunucuları ile bağlandığın diğer cihazlar IP adresini görür; mesaj içeriğini görmez.
  • Saklama: mesajlar ve fotoğraflar gönderildikten 30 gün sonra otomatik silinir; 90 gün hiçbir cihazından girilmeyen hesap silinmiş sayılır.
  • Şikayet ve e-postalar: şikayet ettiğinde senin e-posta uygulamanla bize gönderilen bilgileri yalnızca kötüye kullanımı incelemek ve gerekirse yetkili makamlarla iş birliği için kullanır, işimiz bitince sileriz.
  • Hakların: KVKK md. 11 kapsamındaki haklarını kullanabilirsin. Verilerin kendi cihazında olduğundan görüntüleme, düzeltme, dışa aktarma ve silme işlemlerini uygulama içinden yapabilirsin; sorularını moonstreamtech@gmail.com adresine iletebilirsin.
  • Yurt dışı aktarım: cihazlar dünya genelinde birbirine bağlandığından herkese açık profilin ve şifreli mesajların başka ülkelerdeki cihazlardan geçebilir.