Privacy & legal

The short version: this is my hobby game, it collects the minimum it needs to work, it sells nothing, and you can ask for your data or its deletion at any time. The long version follows, because you are entitled to it.

Who runs this

I build and run MeshTorry myself, as a hobby, on my own hardware, from Slovenia. I am a private individual; there is no company behind it. For anything on this page (questions, corrections, requests about your data) use the contact form below, or write to privacy@cl0.eu. Either reaches the same person; that address is also my contact as the data controller in the sense of the GDPR.

Privacy notice

This notice covers the public site (every page of it), the game itself (the web app and the Android app) and the public coverage map. It is written to satisfy Articles 13 and 14 of the GDPR, in plain language.

If you only visit

No cookies, no analytics, no trackers. The only thing this site keeps in your browser is your light/dark choice, and only once you click the switch; it stays on your device and is never sent anywhere. There is no third-party script on it.
Server logs. Like any web server, the machines that serve the site keep ordinary technical logs: your IP address, the time, what was requested, and your browser's user-agent string. They exist to keep the service running and to debug it, and are not analysed for anything else. They are rotated by size and only the last few files are kept: in practice the game's access log covers the last few days, the server's general log the last few weeks.
Map tiles come from Esri. The base map on the coverage map is drawn from tiles your browser fetches directly from Esri's ArcGIS Online servers (server.arcgisonline.com; Esri, Inc., USA). Esri therefore sees your IP address and which tiles you requested, and as a US company may handle that request outside the EU, under Esri's own privacy policy. The app uses Esri by default too; a player can instead pick OpenStreetMap's tiles (their policy), or CARTO's with their own CARTO key (their policy), and then that provider sees the same. The hex and node data drawn on top of the tiles come from this game's server only.

If you apply and play

Applying creates an account. What is stored, and why:

Your callsign and password. The password is stored only as a salted hash; nobody, including me, can read it back. Needed to run your account (GDPR Art. 6(1)(b), performance of a contract).
Your application text: which network you use, and the optional region, setup and motivation fields. Read by one human to decide on admission, then kept as the account's decision trail. Same basis.
Email, only if you give it. Used solely to ask you something about your application, or to reach you about your account. No newsletters, no lists, never passed on.
Game data. Which nodes you registered (their mesh identifiers as your radio broadcasts them), which hexes your node was heard in and when, signal strengths, tier changes, points, faction membership, and a record of administrative actions on your account. This is the game; without it there is nothing to play.
Position. To decide whether you genuinely worked a hex, the app sends the server your position when it reports a detection, and the server keeps what the presence check needs (for each hex you are progressing, where that progress started and whether you moved). What is published is never finer than the hex, a cell roughly 350 m across, for you and for everyone else. (A setting to delay when your fresh gains appear is planned; it does not exist yet.)
On your device. The app keeps your login token, your preferences, an offline queue, and a cache of map tiles and public map data (so the map works without a connection) in the browser's on-device storage. That stays on your device; the offline queue is uploaded to the game when you are back in coverage, and nothing else is.

If your node is heard but you are not playing

Mesh radios broadcast their identifiers; that is how a mesh works. When a player's node hears yours, the game records the identifier and the name your node broadcasts, which network it is on, the signal strength, when it was first and last heard, and, if your node broadcasts its own position, that position as broadcast (it is published only at hex level, as described next). The public map shows your node in two ways, never finer than a hex (a cell roughly 350 m across): as a dot at the centre of the hex its own broadcast position falls in, if it broadcasts one; and by name, with the signal strength, in the list of nodes heard in each hex where a player's radio picked it up. The basis is my legitimate interest in showing real coverage (Art. 6(1)(f)), weighed against the fact that you already chose to transmit that identifier over open radio. If you would rather your node did not appear, send the identifier through the contact form (pick "take my node off the map") and it will be taken off.

Where it is processed, and who else is involved

The game runs on a server at my home in Slovenia. The public entry point, the address you connect to and where TLS terminates, is a rented virtual server in Germany (Netcup GmbH), which forwards traffic over an encrypted tunnel to that home server. I back the game database up daily to a second machine of my own, and from there to a rented storage box in Germany (Hetzner Online GmbH). Everything the game stores stays on those machines, inside the EU.

Four outside services are involved, and all four are named on this page: Netcup and Hetzner host and store the game's data; Esri's tile servers are contacted directly by your browser when a map loads (see above; OpenStreetMap or CARTO instead, only if a player picks them in the app); and Porkbun forwards the privacy@cl0.eu address to my own mailbox, so a message written to that address passes through them on the way. Nothing is sold, shared or used for advertising, and no other processor handles the game's data.

How long

Applications that are not approved within 5 days are deleted automatically, account and all.
Accounts exist until you ask for deletion, or until they are removed for breaking the rules below.
Messages sent through the contact form are kept until the request is handled, and after that as the record of what was done about it; a reply address, if you left one, is kept with them. Ask and they are deleted like anything else.
On request, the account and the personal data tied to it are deleted, by me, by hand, which is why the answer may take a few days rather than a click. Map history that other players' territory depends on may be kept without any link to you.
Server logs are rotated by size: a few days for the game's access log, a few weeks for the server's general log (see above).

Your rights

You can ask to see the data held about you, to have it corrected, deleted or restricted, to receive a copy of it, and to object to processing based on legitimate interest, through the contact form or by writing to privacy@cl0.eu. No fee, and no more proof of identity than is needed to be sure the data goes to the right person. If you think your data has been handled unlawfully, you can complain to the Slovenian supervisory authority, the Information Commissioner (Informacijski pooblaščenec), or to the authority in your own country.

Security

Everything travels over TLS, passwords are hashed, only I have administrative access, and the home server accepts no connections from the open internet except through the tunnel described above. It is a beta, and I run it carefully, but I am one person; if you find a security problem, please report it before you tell anyone else. The form has a "security report" option, or use privacy@cl0.eu if you would rather not type it into a website.

Rules of the beta

It is a beta. The game is provided as it is, without warranty. Mechanics will change, numbers will be retuned, and the board may be reset. Nothing here has monetary value.
One person, one account. Register nodes you actually operate. Do not spoof positions, signals or identifiers. The game is only interesting if the map is real.
You are the licensee of your radio. The game deliberately keeps transmissions tiny and capped, but the legal responsibility for what your transmitter does (duty cycle, power, region settings) is yours, under your local regulations.
Be decent on the mesh. Other people's networks carry this game as a courtesy. Do not use it to flood, jam or annoy a mesh you do not run.
Removal. Accounts that break these rules can be disabled or removed, and I can refuse admission without giving a reason. Decisions can be revisited: write and ask.
Changes. This page may change as the game does; the date at the bottom says when it last did.

Contact

Data requests, "take my node off the map", security reports, or anything else. This goes straight to me, into the game's own admin panel, not to a mailbox, and not to anyone else. A reply address is optional; without one you will still get the change you asked for, just no message saying so.

Attribution & third-party components

Map rendering by Leaflet (BSD-2-Clause); hex grid by H3 / h3-js (Apache-2.0).
Meshtastic and MeshCore are independent open-source projects; this game is not affiliated with or endorsed by either.

Last changed: 2026-09-21.