Privacy Policy

Last updated 2 October 2026

What Mesh collects, why, who can see it, and how to get it back or delete it.

Who we are

Mesh is operated by TODO: your legal entity or full name (ABN TODO: your ABN or ACN), trading as Mesh, located in TODO: your state or territory, Australia.

For anything in this policy, contact TODO: privacy@yourdomain.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where the EU or UK GDPR applies to you, we also honour the rights it gives you.

What we collect

We do not collect your contacts, your device's location, your device identifiers, or your browsing activity on other sites. A place you type on a post is only the words you chose to share; Mesh never reads where your device is. We do not buy personal information from data brokers.

Account details: Your email address, or your phone number if you sign in by SMS. If you use Google or Apple sign-in, we receive the email address and name they release to us, and nothing else.
Profile: Your handle, display name, and anything you choose to add: bio, pronouns, town, birth year, profile picture, relationship link.
Birth year: Collected to apply legal age protections. See 'Age' below.
Content: Posts (Stills, Strands and Flicks), photos, videos, captions, image descriptions, a place name if you add one to a post, polls, GIFs you choose, comments, reposts, messages, photos and voice messages you send in them, circle membership, gathering RSVPs, news stories you write with their sources, correction suggestions you send, and likes, replies and echoes on stories.
Interests: The interests you pick (for example Music or Gardening), the topics you tag on your posts, and the interests a circle's admins give it. Health, religion, politics, sexuality and other sensitive categories are deliberately not on the list.
Calls: When you make a voice or video call: who called whom, when, and how long it lasted, kept as a line in that conversation. The call's audio and video are never recorded or stored.
Interaction signals: Which accounts you follow, and which posts you like, comment on, repost, save, send, watch, skip, hide, report or vote on. These are used to order your feed and suggest accounts.
Technical: Your last-active timestamp, so people you message can see whether you are online.
Notifications: When someone likes, comments on, reposts or mentions your post, likes or echoes your story, follows you, asks to follow you, invites you to a gathering or lets you into a circle, a note of it (their handle and photo, which post or story, and the first 140 characters of a comment, echo or mention) is stored in your notifications. The person who acted writes it, and our servers only accept it if the action really happened.
Brick mode: If you use it: your scheduled times, daily limits and any instant brick, a change waiting its 24 hours, your time zone, and the minutes you spend in Feed, Flicks and News each day while a daily limit is on. Minutes are counted in 30-second steps and only for sections with a limit.
Parental controls: If a parent links to an under-18 account: who the parent is, whether the teen agreed, the parent's limits and any request the teen sends them.
Bricked time: If you use brick mode: how long you've been bricked in total, this week and in your longest single stretch, and your streak of bricked days. Our servers check each claim against your brick mode settings before accepting it.
Mesh News writers: If you write for Mesh News: that an admin made you a writer, your drafts, each version saved when you send a story for review or ask for one, which part of a story you're editing while you're editing it, and live blog updates you post.
Gathering replies: A copy of each gathering you reply to (its title, place, start time and your reply), kept with your account so Mesh can show what's coming up without searching every gathering.
Circle activity: Your last post time in each circle (for slow mode), how far you've got through a circle's guides, and, if a circle admin removes one of your posts, a record of that (a 'strike') with its date.

What we do not do

We do not sell your personal information. We do not share it with advertisers. We do not run advertising or third-party tracking on Mesh, and there are no analytics or advertising cookies on this site.

We do not use your private messages to train machine learning models.

Why we collect it

To run your account: Authentication, keeping you signed in, and letting people find you by handle.
To show you content: Ordering your feed, suggesting accounts and suggesting circles, using the interaction signals and the interests you picked.
To keep Mesh safe: Filtering hate speech and spam, limiting the reach of posts that may mock a group, rate-limiting posting, handling reports, suspending accounts that break the Community Guidelines, and enforcing circle rules. The filter runs on the text itself; it doesn't profile you.
Checking images: Photos and videos you choose are checked for nudity and sexual content by a model that runs on your own device, before anything uploads. The check doesn't send the image or its result to us or anyone else; only an image that passes is uploaded. Our moderators may run the same check on public posts.
To meet legal obligations: Responding to lawful requests and to the eSafety Commissioner where required.

Who can see what

Browsing without an account: Anyone can read public posts, profiles, circles, gatherings and news without an account. Liking, commenting, following, posting and messaging need one.
Your profile: Your handle, display name, photo, bio, pronouns, town, relationship link and follower counts are public. Your birth year is never shown: it's stored where only your account can read it.
Public posts: Visible to anyone, including people without a Mesh account.
Private accounts: If you make your account private, new followers need your approval, and your posts and stories are visible only to the followers you've approved.
Reposts: Public. When you repost something, your followers see it with your name on it, and it appears on your profile's Reposts tab.
Followers-only posts: Visible to you and the people who follow you. Enforced on our servers, not only in the app.
Circle posts: In a public circle, visible to anyone, including people without an account. In a private or hidden circle, visible only to its members. Posts waiting for a circle admin's approval are visible only to you and that circle's admins and moderators.
Gatherings: A public gathering's page (title, time, place, description, the host's handle and how many are going) is visible to anyone, including people without a Mesh account, so hosts can invite anyone. Who replied is only visible to people signed in. Private gatherings are visible only to the host, the people they invite, and members of the circle they belong to. If the host hides the guest list, only the host sees who replied.
Stories: Visible for 24 hours to the people who can see your posts. Only you see who viewed and who liked your story, and when you view someone else's story, they can see that you did. Replies to a story are private messages to you, like any other message. Echoes (public replies on a story) are visible to everyone who can see the story; you can delete any echo on yours, and they're deleted with the story.
Your notifications: Visible only to you. The person who caused one can take it back (for example by unliking).
Brick mode: Your limits and minutes are visible only to you, and to a parent you've agreed to link to. That parent sees your limits and today's minutes per section, never your messages, posts you haven't shared with them, or who you talk to.
Bricked time: Private unless you choose to share it. If you switch on 'Show on my profile and the leaderboard', anyone can see your bricked totals and streak on your profile and on the leaderboard. Switching it off hides them again.
Journalist profiles: If you write News, your outlet (or that you're independent), logo, region and any political affiliation you choose to declare are public, on your profile and with every story you write. Declaring an affiliation is up to you, and you can change or remove it at any time.
Badges: Badges Mesh gives an account, like Beta tester, are public on its profile and posts.
News drafts: A draft is visible only to its journalists until they publish it. Earlier versions are visible to the journalists and admins, and are deleted with the story. Published stories show every journalist's byline.
Correction requests: A request to correct a story is visible to that story's journalists and to Mesh admins, along with your handle.
Circle guides and strikes: A circle's admins and moderators can see how far members have got through its guides, and whether a member's post was removed in the last 28 days.
Messages: Visible only to the people in that conversation. We can technically access message records to respond to a lawful request or a safety report; we do not read them otherwise.
Your saved posts, hidden posts, and interaction signals: Visible only to you.
Your interests: Visible only to you. They're stored where no one else's account can read them. A post's topics and a circle's interests are public, like the post or circle itself.
Poll votes: Anonymous. Everyone sees the totals; only you can see which option you chose. In a group chat poll, members of that chat can see who voted for what.
Likes and comments: People who can see a post can see who liked it and what was said in its comments.
Voice messages and photos in messages: Like other messages, visible only to the people in that conversation. Unsending one deletes the recording or photo.
Reports: If you report something, moderators see what you reported, why, and anything you add. The person reported isn't told who reported them. Reporting a message shares that one message's text with moderators, not the rest of the conversation.
Your hidden words: Visible only to you.
Suspensions: If your account is suspended, the end date is stored on your profile so our servers can enforce it. The reason is visible only to you and moderators.
Who you've blocked: Visible only to you. The person isn't told. Blocking stops them following you, messaging you, adding you to groups and commenting on your posts.

Who we share it with

Mesh runs on Google Firebase (Authentication, Cloud Firestore, Cloud Storage). Google processes this data on our behalf as our service provider.

Your Firestore data, including photos and voice messages, is stored in Google's australia-southeast1 region (Sydney). When video uploads are switched on, video files are kept in Cloud Storage, which may be in the United States; that would be a transfer overseas, and Australian Privacy Principle 8 applies to it.

GIFs come from GIPHY, a US company. When you open the GIF picker, your search words and your IP address go to GIPHY to fetch results. When anyone views a GIF on Mesh, their browser loads it from GIPHY's servers, so GIPHY sees their IP address. We never send GIPHY your name, handle, email or any account detail. Accounts under 16 only see G-rated GIFs. GIPHY's own privacy policy covers what it does with this.

Voice and video calls connect your device directly to the other person's using WebRTC, and the audio and video are encrypted in transit. To find a route between you, your device contacts Google's public STUN servers, which see your IP address, and the other person's device learns your IP address during the call. The setup data is deleted from our database when the call ends. If a relay (TURN) server is configured for networks that block direct connections, the encrypted call passes through it without being decrypted.

Links people share can lead to other websites. Mesh shows you where a link goes and asks before opening it; once you leave, that site's own policies apply, not ours.

If you sign in with Google or Apple, that provider knows you signed in to Mesh.

Every visit to Mesh runs Google reCAPTCHA Enterprise in the background, through Firebase App Check. It checks that requests come from a real browser on this site and not from a script, and you never see a puzzle. To do that it sends Google information about your browser and device, and Google may set its own cookies. Google says it uses this data to run and improve reCAPTCHA and for general security, not for personalised advertising. If you use phone sign-in, reCAPTCHA also runs when you request an SMS code.

We otherwise disclose personal information only where we are legally required to, or where it is necessary to prevent a serious threat to someone's life, health or safety.

Age

Mesh is not intended for children under 13, and we do not knowingly create accounts for them.

Australia restricts accounts on age-restricted social media platforms for people under 16. We collect birth year and apply restrictions to accounts under 16. Your birth year is visible only to you. If you believe an account belongs to someone under the minimum age, report it and we will act.

We are actively reviewing our obligations under the Online Safety Amendment (Social Media Minimum Age) Act 2024 and will update this policy as our approach is finalised.

How long we keep it

We keep your account data for as long as your account exists. Deleting your account removes your profile, posts, handle, notifications, brick mode limits and minutes, bricked time, gathering replies list and parental-control links. Notifications you caused in other people's inboxes stay until they delete them, like a sent message.

Messages you have sent may remain visible to the people you sent them to, in the same way a sent text message does. Use unsend to remove an individual message for everyone.

Brick mode keeps your daily minutes for 7 days; older days are deleted when you next open Mesh. Notifications are kept until you delete them, and ones older than 90 days are removed when you open the notifications page. Parental controls end on 1 January of the year the teen turns 18, or earlier if the parent removes them.

Backups and server logs may persist for a short period after deletion before being overwritten.

Your rights

You can access everything we hold about you: Account → Your data → Download gives you a JSON export immediately, with no request needed.

You can correct your profile at any time from Profile → Edit profile.

You can delete your account permanently from Settings → Account → Delete account.

If you want something we have not built a button for, or you want to complain about how we have handled your information, email TODO: privacy@yourdomain. We aim to respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. If the GDPR applies to you, you may complain to your local supervisory authority.

Security, and its limits

Access to your data is enforced by server-side security rules, not only by the app. Passwords are handled by Firebase Authentication and are never visible to us.

No online service is perfectly secure, and we do not claim Mesh is. If a data breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.