Privacy Policy

Mesher gives you a page to publish on and to sell from. This policy explains what we hold about you, who else can see it, and how to get it back or get rid of it.

It covers three kinds of person, and the difference matters: creators who have an account with us, buyers who pay for something on a creator's page, and subscribers who leave an email address to hear when a creator publishes.

2.1 Your account

• Your name, email address and handle
• Your password, stored only as a bcrypt hash - we never hold the password itself and cannot read it
• What you put on your page: profile photo, bio, and links to wherever else you post
• If you sign in with Google, the name, email address and profile picture Google gives us

2.2 What you publish and sell

• Posts and product listings, including drafts, which stay private until you publish them
• Images and files you upload, held in Amazon S3 under a folder belonging to your account
• The hours you mark yourself free, and the bookings made against them

2.3 Selling and being paid

• The identifier of the Stripe account you connect, and the status flags Stripe reports back about it
• Your subscription with us: the Stripe customer and subscription identifiers, and whether it is active

We never see or store card numbers. Card details are entered on Stripe's own checkout and never reach our servers.

2.4 Orders

When someone buys from a creator, we record what was bought, the amount, the buyer's email address, the name and phone number Stripe collected at checkout, any note the buyer wrote, and - for a session - the time booked.

2.5 Subscribers

An email address left on a creator's page, the date it was left, and whether it has since been unsubscribed. No account and no password: a subscriber never signs up to anything of ours.

2.6 Technical

Server logs recording requests and errors, and the cookies described in section 7.

• To run your page and show it to the people you share it with
• To let people buy from you, and to tell you when they have
• To send transactional email: verification, password resets, receipts, order and booking notices
• To send your subscribers the message you asked us to send, when you tick the box on a publish
• To take the subscription payment that lets you sell
• To keep the service working and secure, including rate limiting and abuse prevention

Where the law asks for a basis: most of the above is necessary to perform our contract with you. Security and abuse prevention rest on our legitimate interests.

Google Calendar. If you sell sessions you can connect a calendar so bookings land in it with a meeting link. We store the refresh token Google issues, encrypted, and use it only to read your availability and write booking events. You can disconnect it at any time, and you can revoke our access from your Google account independently of us.

A creator selling on Mesher is the seller. When a purchase is made, the buyer's email address, name, phone number and note are shown to that creator, because otherwise they cannot deliver what was bought or answer a question about it.

For that data the creator decides what happens next, and we hold it on their behalf. Buyers with a question about how a particular creator handles their details should ask that creator; write to us at [email protected] if you cannot reach them.

People subscribe to a creator, not to us. A subscriber of one creator is not a subscriber of any other, and no creator can see anyone else's list.

Every email we send on a creator's behalf carries a working one-click unsubscribe. Unsubscribing marks the address as unsubscribed rather than deleting the record, so that the same address is not silently re-added later.

We set a session cookie that keeps you signed in, and a small companion cookie the interface reads to know that you are. Both are necessary for the service to work, and clearing them signs you out.

We also use two third-party tools that set their own cookies:

• Meta Pixel (Meta Platforms), on mesher.store and on the sign-in and sign-up pages of app.mesher.store. It records which pages are visited and when an account is created, so we can measure and improve our advertising on Facebook and Instagram. Meta may link these events to your Meta account if you have one, and uses them under its own Privacy Policy. You can limit how Meta uses them for ads in your Meta ad preferences. It does not run inside your signed-in dashboard.
• Yandex Metrica (Yandex), on mesher.store and app.mesher.store, for visit statistics: which pages are visited, from where, and how people move through them, including recordings of page activity (clicks, scrolling and what the page displays). We use it to find what is confusing or broken.

Neither tool ever sees card details, which are entered only in Stripe's own checkout. You can block both with your browser's tracking protection or an ad blocker without losing any part of the service.

We use these providers, and no others hold your data on our behalf:

• Stripe - payments, payouts and our own subscription billing
• MongoDB Atlas - the database
• Amazon Web Services - file storage and our secret store
• Google - sign-in, and Calendar if you connect it
• Our email service - transactional mail and the broadcasts you send, delivered through Amazon SES
• Meta Platforms - advertising measurement through the Meta Pixel (see section 7)
• Yandex - visit statistics through Yandex Metrica (see section 7)

We do not sell, rent or trade personal information. We share it only with the providers above, with the creator a purchase was made from, where the law requires it, or in connection with a merger or sale of assets - in which case this policy travels with it.

Passwords are hashed with bcrypt and never stored in readable form. Traffic runs over HTTPS. Secrets live in a managed secret store, not in the code. Google refresh tokens are encrypted before they are written. Sensitive endpoints are rate limited.

No service can promise perfect security. If a breach affects your personal data we will notify you and the relevant authority as the law requires.

Deleting your account from your settings does all of this at once:

• Your posts, product listings, subscriber list and settings are deleted
• Your uploaded files are removed from storage
• Your handle is released, and becomes available to somebody else
• Your profile is replaced with a placeholder that identifies nobody

Order records are kept. A completed sale is a financial record, ours and the buyer's, and we retain it to meet accounting and tax obligations - no longer attached to a live profile. Stripe keeps its own records of payments under its own policy.

An active subscription has to be cancelled before the account can be deleted.

Depending on where you live, you may have the right to see, correct, export, delete or restrict what we hold, to object to processing, and to complain to your data protection authority.

Several of these you can exercise yourself, without asking us:

• See and correct - your settings pages hold everything on your profile
• Export - your subscriber list downloads as a CSV from the subscribers page
• Delete - account deletion is in your settings and takes effect immediately

For anything else, write to [email protected]. We answer within 30 days.

We keep your account data for as long as the account exists. After deletion, only the order records described in section 10 remain, plus anything the law requires us to keep. Server logs are kept for a limited period for security and debugging.

Our providers process data in the United States. If you are elsewhere, using the service means your information is transferred and processed there, under the safeguards those providers operate.

The service is not intended for children under 13, and we do not knowingly collect their personal information. If you believe a child has given us personal data, write to [email protected] and we will remove it.

We may update this policy. The date at the top always says when it last changed, and a material change will be announced in the app or by email before it takes effect.

Questions about this policy, or a request about your data:

Email: [email protected]
Website: mesher.store