Skip to content

Privacy Notice

Last Updated: October 30, 2026

MeshMapper ("we", "us", or "our") operates the MeshMapper platform at meshmapper.net and its associated regional subdomains. This Privacy Notice explains how we collect, use, and protect your information when you use our services.

Information We Collect

Account Information

When you sign in or link your account via Discord OAuth, what we receive depends on where you authenticate:

  • My MeshMapper portal: with your permission, we receive your Discord user ID, username, avatar, and the email address associated with your Discord account. Your Discord avatar reference is stored with your account, but it is only shown on your public leaderboard profile if you turn that option on.
  • Region administration and the main site: we receive only your Discord user ID and username.

We use your Discord user ID to send you automated notifications, such as direct messages about your regions or pending repeaters.

If you create a My MeshMapper portal account, we store your chosen username, your display name, your email address (used for account verification and password resets), a hash of your password, and when the account was created and last signed in. Your email address is never displayed publicly and is not used for marketing.

If you contact us through the region onboarding form or the contact form on the website, we receive the email address and message you provide.

Location and Coverage Data

When you participate in wardriving sessions, the following data is collected:

  • GPS coordinates (latitude and longitude) of your device during active sessions
  • Signal metrics such as RSSI, SNR, and hop counts
  • Session metadata including timestamps, region, and session identifiers
  • Node identifiers for mesh network repeaters and devices encountered, including your device name
  • Device identity, including your device's public key — a persistent, unique identifier for your mesh node
  • Device and radio details, such as your radio model, app version, radio frequency, transmit power, external-antenna setting, GPS accuracy, altitude, and noise-floor readings

This data is essential to the core function of MeshMapper: building community-driven RF coverage maps.

MeshMapper also records publicly broadcast mesh adverts (node name, public key, and time last heard) received by observers, including from people who do not use MeshMapper.

Note that by default the wardriving app does not broadcast your GPS coordinates over the mesh radio channel — pings carry a short anonymous token on the air, and your coordinates are transmitted only to our servers over the internet. An opt-in setting ("Broadcast My Coordinates") is available for users who want their position visible on the air.

Technical Data

We may collect standard technical information such as:

  • IP addresses and browser user-agents, used for rate limiting and abuse prevention. Full IP addresses are recorded in server access logs kept for about 30 days. For signed-in app sessions, we also store the IP address and user-agent last used with each app login token until that token expires (at most one year).
  • To block unauthorized scraping on meshmapper.net and the packet analyzer (analyzer.meshmapper.net), we keep the IP address, user-agent, country and requested paths of clients flagged as automated traffic, for up to 180 days after the address was last seen. For addresses flagged in the last 7 days, banned in the last 30 days or linked to an attempt to get around the block, we also keep their other requests for 14 days, and the evidence for that attempt for up to 180 days. For two days we also keep only the address and time of every request we let through, so shared addresses are not banned by mistake. Reports that include these IP addresses are posted to Discord for the MeshMapper team and stay there. The same records, retention and reports apply on both sites. Anyone can use the MeshMapper Discord bot's !amibanned command on any IP address: the bot answers in the channel whether it is flagged on each site, or banned until when and for what short reason. MeshMapper staff can see more detail in private.
  • Privacy-first, cookieless website statistics run on our own servers. Your country is looked up from your IP address using a local database, and the IP address is not stored for statistics.
  • If you ask the MeshMapper Discord bot a question, your Discord username, the channel, your question and the bot's answer are logged (the most recent 1,000 interactions).
  • If you submit feedback or a bug report from the app, it includes your device's public key, app version and platform, and any debug logs you choose to attach (which include your phone's OS version and model).

How We Use Your Information

We use the information we collect to:

  • Provide the service: Display RF coverage maps, leaderboards, and network analytics
  • Manage sessions: Track active wardriving sessions and associate data with contributors
  • Improve the platform: Analyze aggregate usage patterns to improve map accuracy and features
  • Prevent abuse: Rate limiting, session validation, and security monitoring

Data Sharing and Visibility

  • Coverage data is public. GPS-tagged signal data submitted through wardriving is displayed on publicly accessible maps. This is the core purpose of MeshMapper.
  • Leaderboard data is public. Usernames and contribution statistics appear on regional and global leaderboards (if "anonymous" mode is not enabled on the wardriving app).
  • We do not sell your personal data to third parties.
  • We do not share your data with advertisers.
  • We may share data with regional administrators who manage their respective MeshMapper regions.
  • Optional third-party forwarding. The wardriving app includes an optional feature, off by default, that forwards your ping data to a custom endpoint that you configure. If you enable it, data is sent to the third-party destination you specify, and that destination's handling of your data is your responsibility.

Data Storage and Security

  • The wardriving app uses your location in the background during an active wardriving session, and Bluetooth, Wi-Fi or USB to reach your radio.

  • All data is stored in databases on our servers.

  • Sessions are managed server-side using PHP sessions and API key authentication.
  • Data sent from the wardriving app to our servers is transmitted over secure (HTTPS/TLS) connections, and our MQTT data ingestion also runs over TLS.
  • Wardriving-channel messages carried over the mesh use the MeshCore channel's standard AES encryption and are decrypted on our ingestion server. This relies on the shared public channel key, and some mesh traffic (such as repeater advertisements and status pings) is transmitted unencrypted as part of the mesh protocol — the mesh channel should not be treated as a private or confidential transport.
  • We take reasonable measures to protect your data, but no method of electronic transmission or storage is 100% secure.

Third-Party Services

MeshMapper integrates with the following third-party services:

  • Discord for OAuth authentication (Discord Privacy Policy)
  • MapLibre GL as the map rendering engine (MapLibre)
  • OpenFreeMap for standard, bright, and dark base map tiles (OpenFreeMap)
  • OpenTopoMap for topography tiles (OpenTopoMap)
  • Esri for satellite imagery — Source: Esri, i-cubed, USDA, USGS, AEX, GeoEye, Getmapping, Aerogrid, IGN, IGP, UPR-GP, and the GIS User Community (Esri Privacy Policy)
  • Google Maps for the Google Satellite and Google Hybrid base layers (Google Privacy Policy)
  • AWS Open Data Terrain Tiles for 3D terrain elevation data
  • Nominatim for geocoding / location search (Nominatim Usage Policy)
  • OpenStreetMap for map data (OpenStreetMap Privacy Policy)
  • MeshMapper MQTT broker — observer data is ingested through MeshMapper's own MQTT broker over TLS. We also collect observer data published to the public LetsMesh.net broker, which is not MeshMapper infrastructure and is run under its operator's own terms (LetsMesh)
  • Discord CDN for loading public leaderboard avatars
  • Email delivery — account, invite and notification emails are sent through an email relay service
  • GitHub for handling in-app bug reports, which may include information you choose to submit in a report (GitHub Privacy Statement)
  • OpenTopoData for elevation lookups (OpenTopoData)
  • Content delivery networks — our web interface loads fonts, scripts, and an anti-abuse CAPTCHA widget from third-party CDNs (including Google Fonts, unpkg, jsDelivr, Cloudflare cdnjs, and cap.js). These providers may receive your IP address and browser user-agent when their assets are loaded.

Data Retention

  • Coverage and session data is retained indefinitely to maintain historical map accuracy. Regions may remove pings whose repeaters have moved or disappeared.
  • Repeaters not heard for 30 days are marked inactive. Records of other mesh devices heard on the air are removed after about 30 days, and some repeater metadata expires after 90–180 days.
  • You can view your sessions and delete some or all of your contributed pings (and the leaderboard credit from them) through the My MeshMapper portal after verifying ownership of your device.
  • Deleted data may remain in routine database backups until those backups are overwritten.
  • To delete your account or remaining session records, contact us at admin@meshmapper.net.

Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate or incomplete data
  • Delete your personal data (subject to legitimate retention needs)
  • Object to or restrict certain processing of your data

To exercise any of these rights, please contact us at admin@meshmapper.net.

Children's Privacy

MeshMapper is not directed at children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us at admin@meshmapper.net so we can remove it.

Changes to This Notice

We may update this Privacy Notice from time to time. Changes will be reflected by updating the "Last Updated" date at the top of this page.

Contact

If you have questions about this Privacy Notice, please reach out via the MeshMapper Discord community or contact us at admin@meshmapper.net.