Legal
Privacy Policy
Last updated: 17 October 2026 · Effective: 1 January 2025
1. Overview
NodeMesh ("we", "us", "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains what data we collect, how we use it, and the rights you have over it. It applies to all users of the NodeMesh platform at nodemesh.app.
We process personal data in accordance with the General Data Protection Regulation (GDPR), the UK GDPR, and other applicable data protection laws.
2. Data Controller
The data controller for the NodeMesh platform is NodeMesh. For privacy-related enquiries: contact@nodemesh.app.
3. Data We Collect
The table below describes the categories of personal data we collect, the source, the legal basis, and how long we keep it.
| Category | Data | Basis | Retention |
|---|---|---|---|
| Account | Email address & username. Passwords are stored only as a salted hash. | Contract | Until account deletion + 30 days |
| Session | Encrypted session cookie, IP address at login | Contract | Session duration (max 30 days) |
| NodeCoin (NMC) | NMC balance and transaction ledger (admin grants, usage charges). No card, bank, or other payment details are collected — there is no payment processor. | Contract | Until account deletion + 30 days |
| Node & Instance | Node name, instance names, game configs | Contract | Until deletion + 30 days |
| Performance | CPU/RAM and player-count metrics, uptime stats | Legitimate interest | Per-minute samples 48 hours; hourly averages 90 days |
| Network performance | Latency, jitter, throughput, connection counts and packet-loss figures between your host, our traffic proxy and players, plus a country code (country only) derived from host and player IP addresses. No IP address is stored. | Legitimate interest | Per-minute rows 25 hours; hourly aggregates 30 days |
| Support | Emails, crash reports | Legitimate interest | 2 years |
| Analytics | Page views, feature usage (anonymised, self-hosted) | Legitimate interest | 12 months |
4. Agent and Node Data
The NodeMesh agent installed on your hardware transmits the following data to our servers:
- Heartbeat telemetry: CPU utilisation, RAM utilisation, agent version
- Instance stdout/stderr logs (streamed to the web console, not permanently stored)
- Agent status events (online, offline, error)
The agent does not access any files outside the NodeMesh data directory (/opt/nodemesh/ on Linux). It does not collect system-wide process lists, personal files, network traffic of other applications, or environment variables outside its own process.
Traffic proxy and network measurements. If you turn on the Traffic Proxy for a server, players connect to a NodeMesh proxy node and the proxy relays their connection to your host. To do this the proxy processes the IP addresses of connecting players, and of your host, transiently in memory; they are not written to our database or logs. From those connections we measure network performance (latency and jitter on the path between your host and the proxy, throughput, connection counts and UDP packet loss) and keep these metrics for 30 days: per-minute rows for 25 hours and hourly aggregates for 30 days. We also derive a country-level location (country only) from the host's and the players' IP addresses, using a locally stored geolocation database, so we can see where our users are and place proxy nodes sensibly; only the country code and per-country counts are stored, never the IP address. The legal basis is our legitimate interest in operating, securing and improving the Service. Owners of a server see only that server's own latency and traffic figures; player countries are visible to NodeMesh staff only.
Dedicated host address. The traffic-proxy paragraph above describes host IP addresses as transient. The one exception is a host you mark as a dedicated server: if you confirm its public IPv4 address (accept the address we saw it connect from, or type it), we store that address, how you obtained it (observed or typed), and when a connection test last succeeded, so that players can join directly and so that we can check that the game port answers. Until you confirm an address we keep nothing: the address we see an agent connect from is held only in memory, to suggest it to you. When the address is stored, we connect to it, and only to the ports we allocated for your servers, from our own servers, to run the game protocol’s status query. We never scan other ports or addresses. The address is shown only to you; it appears on a public server page only if you turn on “Show this address on the public server page” for that server. You can remove the address at any time from the host page, which deletes it together with its test result. The legal basis is performance of the service you requested (direct join) and our legitimate interest in checking that it works.
5. How We Use Your Data
- Provide, maintain, and improve the Service
- Authenticate you via email and password
- Track your NodeCoin (NMC) balance and usage
- Send service notifications (outages, low NMC balance, security alerts) via email
- Detect and prevent abuse or security incidents
- Produce aggregated, anonymised usage analytics to guide product development
We do not sell your personal data. We do not use your data for advertising profiling.
6. Data Sharing
We share personal data only with the following sub-processors, strictly as necessary to deliver the Service:
- Cloud infrastructure provider — server infrastructure (EU data centres)
We may disclose data to law enforcement when legally required to do so.
7. Data Retention
We retain personal data only for as long as necessary for the purposes described above. When you delete your account, personal data is erased within 30 days, except where a longer retention period is required by law.
8. Security
We protect your data using industry-standard measures: TLS 1.3 in transit, AES-256 encryption at rest for sensitive fields, bcrypt for session secrets, and strict access controls. Agent–server communication uses mutual TLS over gRPC.
Despite these measures, no system is completely secure. Please report security vulnerabilities to contact@nodemesh.app.
9. Cookies
We use a single first-party session cookie (nodemesh_session) to maintain your login state. This cookie is HttpOnly, Secure, and SameSite=Lax. We do not use third-party tracking cookies or advertising cookies.
10. Your Rights
Under GDPR you have the right to: access, rectify, erase, restrict or object to processing, and data portability. To exercise these rights, email contact@nodemesh.app. We respond within 30 days. You may also lodge a complaint with your national data protection authority.
11. International Transfers
Your data is stored in EU data centres. Any transfers outside the EEA are covered by Standard Contractual Clauses (SCCs) approved by the European Commission.
12. Children
NodeMesh is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us personal data, contact contact@nodemesh.app and we will delete it.
13. Changes to this Policy
We may update this Privacy Policy. When we do, we'll revise the "Last updated" date and, for material changes, notify you via email or in-app notification. Continued use of the Service after changes take effect constitutes acceptance.
14. Contact
Privacy questions: contact@nodemesh.app
Security reports: contact@nodemesh.app
General: contact@nodemesh.app