What we hold, and what we never touch.

Effective date: June 15, 2026

This policy explains what KO Studios LLC ("we") collects when you use MeshBoard — the meshboard.ai sites, the app at app.meshboard.ai, and the relay at api.meshboard.ai — and what we do with it.

What we collect

Account

Your email address (used for magic-link sign-in) and sign-in timestamps.

Mesh and relay metadata

The device names/identifiers you enroll, push notification tokens for your phone, and timing/delivery metadata needed to route messages between your devices. The contents of away-from-home control messages (approvals, asks, decisions) are end-to-end encrypted between your phone and your mesh — the relay delivers them but cannot read them.

What never reaches us

Your source code, repositories, files, local model prompts and outputs, live streams of agents working, and your job history and receipts all stay on your machines. They are not uploaded to our servers.

Cloud model slices (opt-in only)

If you connect a cloud AI provider and opt a job in, the slice of data that job needs is sent directly from your devices to that provider — it does not pass through our relay. The job is labeled before it runs and receipted after. Receipts are stored on your machines, not our servers.

Web basics

Like every website, our servers (Cloudflare) log requests: IP address, browser user-agent, pages requested, timestamps. We use first-party cookies/local storage only to keep you signed in. We use Cloudflare's privacy-first, cookieless web analytics for aggregate traffic counts — it sets no cookies and does not track you across sites or over time. We run no advertising or cross-site tracking cookies.

Email you send us

If you email support or legal, we keep the thread.

How we use it

To operate MeshBoard: signing you in, waking your devices, delivering notifications and control messages, preventing abuse of the relay, fixing problems, and sending transactional email (magic links, important account or policy notices). If we ever send product news, it will be opt-out-able.

Who we share it with

• Infrastructure: Cloudflare, Inc. hosts our sites, app, and relay.
• Email delivery: Resend, Inc. delivers our magic-link and account emails (your email address and the message content pass through them).
• AI providers you configure: when you opt a job in, the job's data slice goes to the provider you chose (e.g. your Anthropic or OpenAI account). That transfer is governed by your agreement with them; your receipt names the provider and what was sent.
• If the law requires it: we comply with valid legal process, and where allowed we'll tell you before handing anything over.
• If the business changes hands: account data may transfer in a merger or acquisition; this policy continues to apply until replaced with notice.

We do not sell personal information and have not in the past. We don't share it for cross-context behavioral advertising.

Retention

Account and relay metadata are kept while your account is active. If you delete your account, we delete or de-identify your account data within 30 days, except minimal records we need for security, abuse prevention, or legal compliance. Edge/server logs rotate on the order of 30 days. Data on your own machines is yours and untouched by any of this — deleting your account never deletes your local work.

Your choices

• Delete your account: email legal@meshboard.ai from your account email (in-app deletion is coming). We'll confirm when relay-side data is gone.
• Access/export: ask and we'll send you what we hold about you — it's short: your email, devices, and timestamps.
• Local-only mode: MeshBoard's local-only setting is enforced, not cosmetic — a local-only job cannot use a cloud model.

We honor reasonable access and deletion requests from anyone, not just residents of states that mandate it. California residents: we don't "sell" or "share" personal information as the CCPA defines those terms. We don't collect health data. If you use MeshBoard from the EEA/UK, we process account data to perform our contract with you and for legitimate interests like security; contact us to exercise GDPR rights.

Security

The control channel is end-to-end encrypted; transport is TLS everywhere; and the cheapest data to protect is data we never collect, which is the design. No system is perfectly secure — report concerns to security@meshboard.ai.

Children

MeshBoard isn't for children under 13, and we don't knowingly collect their information. If you think a child has an account, tell us and we'll delete it.

Where data lives

We're a US company. Our infrastructure runs on Cloudflare's network (US and global edge). By using MeshBoard you understand your account data is processed in the United States.

Changes

We'll post updates here and, for material changes, give notice via the site or email before they take effect.