Legal

Privacy Policy

Effective date: 18 May 2026 · Last updated: 18 May 2026

Overview

MeshDash is an open-source (GPL-3.0) self-hosted Meshtastic dashboard. This privacy policy covers the meshdash.co.uk marketing website and documentation — not the MeshDash application itself, which runs entirely on your own hardware and sends no data to us by default.

When you run MeshDash on your own hardware, your data stays on your network. Remote access (C2) is opt-in and end-to-end authenticated.

Data We Collect on This Website

Server Logs

Our web server (behind Cloudflare) logs standard request data: IP address, requested URL, browser user-agent, and timestamp. These logs are retained for up to 30 days for security and stability monitoring, then deleted.

Analytics

We do not currently run any client-side analytics (no Google Analytics, no tracking pixels). This may change in the future with a privacy-respecting tool like Plausible or Umami, in which case this policy will be updated.

Cookies

This website loads fonts from Google Fonts and icons from cdnjs (Font Awesome). These CDNs may set their own cookies according to their policies. The MeshDash website itself does not set any cookies.

Third-Party Services

• Cloudflare — CDN and DDoS protection. Cloudflare processes your IP address and request headers to deliver pages and mitigate attacks. See Cloudflare's Privacy Policy.
• Google Fonts — Web fonts. Google may log your IP when fonts are requested. See Google's Privacy Policy.
• cdnjs — Font Awesome icons via CDN. cdnjs may log request data for operational purposes.

The MeshDash Application

MeshDash runs on your hardware. By default:

• No data is sent to meshdash.co.uk or any third party.
• All data is stored in local SQLite databases.
• Authentication uses JWT tokens stored in HttpOnly cookies — no external auth.
• Community API and C2 remote access are disabled by default and require explicit opt-in.

When C2 remote access is enabled, your node sends periodic heartbeats to meshdash.co.uk containing node status and (optionally) GPS position. This data is encrypted in transit and authenticated with your unique API key. C2 access levels are controlled entirely by you.

Your Rights (UK GDPR)

Under UK GDPR and the Data Protection Act 2018, you have the right to:

• Access any personal data we hold about you
• Request correction or deletion of your data
• Object to processing of your data
• Lodge a complaint with the ICO

We do not sell, share, or transfer personal data to third parties for marketing purposes.

Contact

For privacy enquiries, contact: see the About page for project contact details.

This policy may be updated. Changes will be posted on this page with a revised effective date.