Privacy Policy
Last updated: October 28, 2026
Introduction
MeshVote is operated by Magnalia, Inc., 6211 S Highland Dr #6011, Holladay, UT 84121 ("Magnalia", "we", "us", or "our"). This Privacy Policy explains how we collect, use, store, and protect your information when you use the MeshVote mobile application (iOS, Android, macOS) and the MeshVote web dashboard.
By using MeshVote, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the application.
Information We Collect
Account Information
When you create an account, we collect:
- Email address — provided during sign-up or via your Google or Apple account
- Display name — chosen by you during registration
- Authentication provider — whether you signed in with email/password, Google, or Apple
- Profile avatar — an optional image you upload
Device Information
- Ed25519 public keys — a unique cryptographic key is generated on each device you use. The public key is linked to your account to verify vote authenticity. Your private key never leaves your device.
Location Data
With your permission, we collect your approximate location (reduced to ~100 meter precision) to associate your account with a geographic area. Location is requested with medium accuracy and is optional — the app functions without it. You can revoke location permission at any time in your device settings.
Analytics and Crash Reports
- Firebase Analytics — on iOS and Android we collect anonymous usage events such as group creation, poll creation, vote casting, and sign-in events. On the MeshVote website, Google Analytics and Google Ads measurement run as described in Cookies and Web Technologies. Analytics are disabled on macOS.
- Firebase Crashlytics (iOS and Android only) — crash reports are collected to help us identify and fix bugs. These include device type, OS version, and stack traces.
Local Data (On-Device)
MeshVote stores data locally on your device in an SQLite database, including your identity keys, groups you have joined, polls, votes, and chat messages. This local copy lives on your device and is shared peer-to-peer via Bluetooth. For groups created with Network Sync enabled (the default), the same data is also synced through encrypted cloud storage as a parallel transport — see the Network Sync section below.
Bluetooth Low Energy (BLE) Data
MeshVote uses Bluetooth Low Energy mesh networking for peer-to-peer communication. Votes and poll data are exchanged directly between nearby devices via BLE. BLE-layer traffic is not routed through our servers — it travels only between phones in physical Bluetooth range. BLE communication includes cryptographically signed events that propagate through the mesh network.
Network Sync (Cloud Sync)
For groups created with Network Sync enabled (the default), MeshVote runs encrypted cloud sync alongside the Bluetooth mesh as a parallel transport. This allows late-joining members to catch up instantly and keeps votes in sync across devices that cannot reach each other over Bluetooth. Data synced through Network Sync includes polls, votes, and chat messages for that group, stored in Google Firestore.
The contents of Network Sync data are encrypted with the group's invite key before upload — poll questions and options, the choice recorded in each vote, final tallies, group settings, and chat messages. The invite key is held only by group members and admins, and we never store it, so we cannot read any of that content.
Some information is stored unencrypted so the service can function: the group name, member display names, each device's public key, poll and group identifiers, and timestamps. Every vote record carries the voter's device public key in the clear, because our servers use it to verify the vote's cryptographic signature. This means our servers can see that a particular member voted in a particular poll — and can associate that with their display name — but not what they chose.
Vote records are stored under an identifier derived from the poll and the voter's device public key, so anyone who knows a member's public key can tell which record is theirs. Our vote-processing logs do not record a voter's identity: they record the poll and the outcome of the check, not the record's identifier or the voter's key. Other operational logs, such as when a member leaves a group, do record device public keys. Nothing hides how a member voted from the rest of the group: every member holds the group key, so a member or administrator can determine how another member voted. Treat a MeshVote poll as a recorded show of hands — private from people outside the group and from us — rather than a secret ballot.
Network Sync is set per-group at the time of group creation and is immutable once chosen. Administrators who prefer fully offline operation can create groups with Network Sync off; in that case, no group data is synced to our cloud — the group runs purely over Bluetooth.
How We Use Your Information
- To provide and operate the MeshVote service
- To authenticate your identity and secure your account
- To verify the authenticity of votes using cryptographic signatures
- To improve app performance and fix bugs (via analytics and crash reports)
- To associate groups with geographic locations (with your permission)
Data Storage and Security
Account data (email, display name, avatar, device keys) is stored in Google Firebase (Firestore) infrastructure. All data is encrypted in transit via TLS. Firestore security rules restrict access so that users can only read and modify their own profile data.
Every vote and poll event is cryptographically signed with Ed25519, providing tamper-evident verification of data integrity across the mesh network.
Data Sharing
We do not sell your personal data to third parties. We share data only with the following service providers, which process data on our behalf:
- Google Firebase — authentication, cloud database (Firestore), analytics, crash reporting, and remote configuration
- Google Cloud Platform — server infrastructure for Cloud Functions
- Stripe — payments for plans bought on meshvote.com
- Apple and Google — payments for plans bought in the App Store or Google Play
- Google Analytics, Google Ads, reCAPTCHA and YouTube — on the website, as described in Cookies and Web Technologies
- Google Chat — our servers post operational alerts to a private Google Chat space that only Magnalia staff can read: a sign-up or account deletion (with the person's name and email address), a new group (with its creator's name), and purchases, renewals and payment problems (with a masked email address)
These providers are bound by their own privacy policies and data processing agreements.
Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you
- Correction — request that we correct inaccurate data
- Deletion — request that we delete your account and associated data (see Account Deletion)
- Portability — request your data in a portable format
- Analytics — the apps do not have a setting to turn off analytics yet. On the website, see Cookies and Web Technologies.
To exercise any of these rights, please contact us via our Support page.
Data Retention
We retain your account data for as long as your account is active. When you delete your account, your Firestore profile (display name, email, avatar, device keys) and Firebase Authentication account are permanently deleted.
Votes that have already been cast and propagated through the BLE mesh network cannot be recalled from other devices, as they are cryptographically signed and distributed across the peer-to-peer network. For groups using Network Sync, votes are also stored in encrypted cloud storage under the group document. This data belongs to the group, not to your account: deleting the group removes its cloud-stored polls, votes, and chat, but deleting your account does not. Each stored vote carries your device's public key, as described under Network Sync. Local data stored on your device (SQLite database) is removed when you uninstall the app.
Account Deletion
You can delete your account at any time from within the app (Profile screen) or by visiting our Account Deletion page. When your account is deleted, our Cloud Function automatically removes your Firebase Authentication account and your user profile, and cancels a subscription bought on this website. Your member record in each group and your votes stay with the group until it is deleted.
Children's Privacy
MeshVote is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete it promptly.
Cookies and Web Technologies
The MeshVote website (meshvote.com) uses:
- Sign-in storage. Firebase Authentication keeps you signed in with your browser's storage. The site needs it to work.
- Sign-in protection. The sign-in page and the admin console use Google reCAPTCHA, through Firebase App Check, to block automated abuse. It sends your IP address and browser details to Google.
- Google Analytics and Google Ads measurement. These tools count page views and visits and record how visitors use the site, such as taps on app store links, video plays and purchases. Google Ads uses some of these events to measure our ads. They set the cookies
_ga,_ga_<ID>and_gcl_au, and they send your IP address and browser details to Google. - YouTube. The home-page video loads from YouTube only when you play it.
If you visit from the European Economic Area, the United Kingdom or Switzerland, the Google Analytics and Google Ads cookies stay off until you accept them in the cookie banner. To change your choice, use Cookie settings at the bottom of this page. Elsewhere, you can block these cookies in your browser settings or with Google's opt-out add-on.
Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of MeshVote after changes constitutes acceptance of the revised policy.
Contact Us
If you have questions about this Privacy Policy or your data, please visit our Support page.