Website privacy
This page is about this website. Each app has its own, longer, policy.
The short version. This site sets no cookies, runs no analytics, shows no ads, has no login, has no forms, and loads nothing from a third party. There is no tracking to opt out of because there is none to begin with. What is left is the unavoidable floor — your device has to tell a server where to send the page — and one light/dark setting saved in your own browser. Everything below is the detail behind those two sentences.
On this page
- Who is responsible
- What this page covers
- What we do not do
- What happens anyway
- The one thing kept in your browser
- If you email us
- Why we are allowed to
- How long anything is kept
- Where it physically goes
- Your rights
- How to exercise them
- How to complain
- If something goes wrong
- Children
- Changes to this page
1. Who is responsible
meshmesh Labs is the working name of an independent software studio operating from Jordan. It is not a registered company — it is one person building software under that name — and that matters here for exactly one reason: the controller of the small amount of personal data described on this page is therefore that individual rather than a corporate entity. The controller is the party that decides why and how your data is handled, and the party you can hold to this document.
We would rather say that plainly than let a plural pronoun imply a company that does not exist. If meshmesh Labs is registered later, the registered name and number replace this paragraph and the date at the foot of the page moves.
- Contact for privacy
- [email protected]
- General contact
- [email protected]
- Controller's name and postal address
- Given on request to the privacy address above, and given without argument — a request for the identity of the controller is itself one of the rights in section 10. It is not published here because, with no registered office, the address would be a private home.
- Data protection officer
- None appointed. Jordan's Personal Data Protection Law requires one where processing personal data is the main activity, or where sensitive data, financial data or the data of people without legal capacity is processed. None of that is true of this website. The privacy address above reaches the person who would be it.
2. What this page covers
It covers meshmeshlabs.com and www.meshmeshlabs.com — the pages you
are reading — and the three studio mailboxes.
It does not cover our apps. An app runs on your device, can ask for permissions a web page cannot, and may sync things a web page never sees, so it gets its own policy with its own specifics. It also does not cover sites we link to; once you follow a link outward you are covered by whoever runs that site.
3. What we do not do
- No cookies. None, of any kind — not "essential", not "functional", not "strictly necessary". This is why there is no cookie banner: there is nothing to consent to.
- No analytics. No Google Analytics, no Plausible, no Fathom, no pixel, no beacon, no server-side analytics product. We genuinely do not know how many people read this page.
- No third-party requests. The typeface is IBM Plex and it is served from
this domain, not from Google Fonts. Every byte this page loads comes from
meshmeshlabs.com. - No fingerprinting, no A/B tests, no session recording, no heatmaps.
- No advertising, and no sale or sharing of personal information — in the ordinary sense and in the specific sense California law gives those words. We have never done it and there is no mechanism here that could.
- No forms, no accounts, no comments. There is nowhere on this site to type anything, which removes an entire category of risk.
- No automated decision-making and no profiling.
This one is a mechanism, not a
promise. The site is served with a Content-Security-Policy that permits scripts,
styles, fonts and images from this origin only, and sets connect-src 'none' — so
the page is forbidden by your own browser from making a network request to anywhere else, even
if someone later pasted a tracker into the source by mistake. You can check it yourself: open
the network inspector, or read the response headers. We would rather you did.
4. What happens anyway
This site is served by Cloudflare Pages. Like any web host, Cloudflare has to receive and answer the request, and in doing so it processes and briefly logs the things a request is made of:
- your IP address (which is personal data, and which roughly indicates your city),
- the page you asked for and the time you asked for it,
- your browser's user-agent string and requested language,
- the referring page, if you arrived from a link.
Cloudflare acts as our processor for this: it handles the data to deliver the service to us, under its own terms, and it uses it for delivery, caching, and blocking attacks. We do not have a dashboard showing who visited, we do not build profiles from it, we do not export it, and we never combine it with anything from an app. Cloudflare's own privacy policy governs its side of that processing.
That is the honest floor. It is not possible to serve a page to you without your device telling a server where to send it, and any site that implies otherwise is being imprecise.
5. The one thing kept in your browser
The light/dark button in the header saves your choice, so the site does not fight your
preference on the next page. That is stored as a single localStorage entry:
| Name | Value | Set when | Lives until |
|---|---|---|---|
theme | light or dark |
Only if you press the toggle. Never on page load. | You clear site data for this domain. |
localStorage is not a cookie: it is never attached to a request, so it is never
transmitted to us or to anyone else, and it cannot be read by another site. It stays in your
browser. If you never press the button, nothing is stored at all — the site simply follows your
operating system's light/dark setting. The whole of the code that does this is one small file
you can read: /theme.js.
6. If you email us
Mail to hello@, support@ or [email protected] is
routed by Cloudflare Email Routing to a Google (Gmail) mailbox
that a person reads. Both act as processors for us.
We necessarily receive whatever you put in the message — your email address, your name if you sign it, and anything you choose to tell us. Please do not send us more than the question needs: we do not want your passwords, your identity documents or your medical details, and a support question almost never requires them.
We answer, we keep the thread while it is useful for supporting you, and then it goes. You are not added to a mailing list, because there is no mailing list and no software here capable of sending one.
7. Why we are allowed to
Under Jordan's Personal Data Protection Law No. 24 of 2023, and for readers covered by the GDPR under Article 6, the grounds are these — and there are only two:
| What | Ground | In plain words |
|---|---|---|
| Serving you this page, and the logging that is inseparable from it | Legitimate interests | We have to answer the request to show you the page, and we have to be able to block an attack. We collect nothing beyond what that requires, and we have weighed it against your interests — it is hard to imagine a lower-impact processing. |
| Reading and answering your email | Legitimate interests, or taking steps at your request | You wrote to us; answering you is the point. |
The theme setting | Your action | Stored only because you pressed the button, and only in your own browser. |
There is no processing here that relies on consent, because there is no tracking to consent to. Providing personal data is not a statutory or contractual requirement on this site, and nothing is withheld from you if you provide none — you can read every page without giving us anything.
8. How long anything is kept
| What | Held by | For how long |
|---|---|---|
| Edge request logs (IP, path, user-agent, time) | Cloudflare, as our processor | Cloudflare's own operational retention. We keep no copy at all — there is no server of ours in the path and no log we could produce if asked. |
| Your email, and our reply | Google (Gmail), as our processor | As long as it is useful for supporting you. Threads that are plainly finished are deleted; the mailbox is reviewed at least once a year. |
| A privacy or deletion request, and what we did about it | Same mailbox | Kept as the record that we honoured it, then deleted. |
theme | Your browser, not us | Until you clear site data. We cannot see it and cannot delete it for you. |
9. Where it physically goes
We are in Jordan; the internet is not. Cloudflare and Google both operate globally, so a request from you may be served from an edge location, and mail may be stored on a server, outside your own country — including in the United States and the European Union.
Both providers publish their own cross-border safeguards, including standard contractual clauses, and those govern the transfer. We choose providers that publish them rather than providers that do not, and this is one of the reasons the site holds no data of its own: the less there is, the less a transfer can be about. If you would rather not have your IP address reach a content delivery network at all, the only complete answer is a VPN or Tor, and we do not mind at all if you use one — nothing on this site will break.
10. Your rights
Jordan's Personal Data Protection Law No. 24 of 2023 grants you eight rights, and you may exercise any of them without paying anything and without any consequence to you. If you are in the EU, the UK, or another place with comparable law, the equivalents are in the same list:
Access
Ask what personal data of yours we hold, and get a copy of it.
Correction
Have anything inaccurate or out of date about you put right.
Erasure
Have it deleted. For this website that is a short job — the only thing we hold is an email thread, if you have written to us.
Restriction
Have processing narrowed to a defined scope while a question about it is resolved.
Objection
Object to processing you consider unnecessary or excessive, including anything done on the legitimate-interests ground above.
Withdrawing consent
Withdraw any consent you have given, at any time. On this site there is none to withdraw, which is the intended state.
Portability
Receive your data in a usable form, or have it moved to another controller.
Being told about a breach
Be notified if a breach occurs that compromises the security of your data. See section 13.
If you are in California: we do not sell or share personal information, we do not use it for cross-context behavioural advertising, we do not offer financial incentives for it, and we do not process sensitive personal information for inferring characteristics — so there is no "Do Not Sell or Share My Personal Information" link, because there would be nothing behind it. Your rights to know, delete and correct are covered by the list above.
11. How to exercise them
Write one sentence to [email protected] saying what you want. There is no form to fill in and no account to create.
- We reply within 30 days, and usually within a few.
- It is free. We will not charge you and we will not make it awkward.
- We will ask you to confirm you are who you say you are only if we genuinely cannot tell — normally, replying from the address you wrote from settles it. We will not demand an identity document to answer a question about an email thread.
- If we cannot do what you asked, we will say so plainly and tell you why, and tell you where to take it further.
12. How to complain
Tell us first, at the privacy address — most things are a misunderstanding that one reply fixes, and we would rather fix it than have you go away unhappy.
If that does not resolve it, you can complain to a regulator. In Jordan, that is the Personal Data Protection Council established under Law No. 24 of 2023, which sits with the Ministry of Digital Economy and Entrepreneurship; the Council's complaint procedures are still being stood up at the time of writing, so write to us as well and we will help you find the current route. In the EU or the UK, complain to your national supervisory authority — for the UK, the Information Commissioner's Office. Your right to complain does not depend on asking us first.
13. If something goes wrong
If a breach occurs that compromises the security of personal data we are responsible for, we will tell the people affected within 24 hours of discovering it, and the regulator within 72 hours, with what we know about the source of the breach, who is affected, and what was involved — those are the clocks Jordan's law sets, and we are not going to treat them as a ceiling to be reached.
We will say what happened in plain words even when it makes us look bad. A studio that hides a breach has already told you everything you need to know about it.
14. Children
This is a website about software for grown-ups making software decisions. It is not directed at children, it collects nothing that would identify anyone, and we do not knowingly process a child's personal data here. If you believe a child has sent us personal information by email, write to the privacy address and we will delete it.
15. Changes to this page
If what we do changes, this page changes first and the date below moves. We do not quietly reissue a policy and call it an update: if a change is material, it will be described here in a sentence rather than buried in a diff. This page has no version history you can browse, so the date is the honest signal — and it is the date the words were last verified against the build, not the date a template was copied.