voidmeshPrivacy Policy

← Back to voidmesh

Privacy Policy

Last updated: July 7, 2026

Scope

This policy applies to the voidmesh applications for macOS, iOS, Android, Linux, and Windows, and to the discovery/signaling nodes operated at void.innernette.co.

What we do not collect

• No personal account. You do not provide a name, email address, or phone number. Your identity is a cryptographic key pair generated on your device from a username and password you choose — it never leaves your device.
• No message content. Messages, reactions, edits, and file transfers are end-to-end encrypted (X25519 key exchange, Ed25519 signatures, XChaCha20-Poly1305 authenticated encryption) and are readable only by you and the people you communicate with.
• No files. Files are transferred directly between devices and encrypted in transit. Our servers never receive or store them.
• No contacts, groups, or keys on our servers. These exist only in encrypted storage on your device.

What the nodes process (signaling metadata)

To help two devices find and connect to each other, voidmesh uses discovery/signaling nodes. While you are connected, a node processes — but does not write to disk — a limited set of metadata:

• Your public peer ID and the display name you choose.
• A coarse, approximate location derived from your IP address (city/region level, via an offline IP database) — used only to render the optional network map. We do not use device GPS or precise location.
• Which peers are attempting to connect to which, so a connection can be established.
• Your IP address, which is inherent to any internet connection and is used to enforce anti-abuse rate limits.

Nodes are designed to be zero-knowledge at rest: this metadata is held transiently in memory for the duration of your session and is not persisted to a database. Nodes may share the current roster of online peers (peer ID, display name, coarse location) with other federated nodes so that peers connected to different nodes can discover one another.

Data stored on your device

Everything that matters — your keys, messages, contacts, and settings — is stored locally on your device and encrypted at rest. You control it. Deleting the app, or resetting your identity in Settings, removes it. We have no copy to delete on your behalf, because we never had one.

Diagnostics and crash reports

If the app encounters an error, a crash report may be recorded locally on your device. These reports are never transmitted automatically — there is no background telemetry. You may choose to export one to send to us for support; when you do, identifying details such as IP addresses are redacted before you share it.

Third-party services

• NAT traversal (STUN/TURN). When a direct peer-to-peer connection cannot be established, encrypted traffic may be relayed through a TURN server we operate. The relay can see your IP address and that encrypted data is flowing, but never its contents.
• Optional link previews and media embeds. Off by default. If you enable "Load remote content," fetching a preview or embedding a video (for example from YouTube) will reveal your IP address to that third-party host, subject to their own privacy policies. This is entirely your choice and stays off unless you turn it on.
• App updates. The desktop apps check for updates through the connected node, which proxies the release files; the app does not contact GitHub or any third party directly for updates.

voidmesh does not use any advertising, analytics, attribution, or tracking SDKs.

No tracking, no ads, no selling

We do not track you across apps or websites, we do not serve advertising, and we do not sell, rent, or trade any information to anyone.

Children

voidmesh is intended for users aged 16 and older. It is not directed to children under 16, and we do not knowingly collect information from them.

Your choices and rights

Because your data lives on your device and not on our servers, you can review or delete it directly at any time: manage or delete messages and contacts in the app, reset your identity in Settings, or uninstall the app to remove everything locally. Where applicable law (such as the GDPR or CCPA/CPRA) grants you rights over the limited, transient metadata described above, you may contact us using the details below.

Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected here with a new "last updated" date.

Contact

Questions about privacy or this policy? Contact us at privacy@innernette.co.

---