# VeloraMesh Privacy Notice

Effective date: 2026-09-05
Version: v1.0.0-rc2

VeloraMesh is a self-hosted P2P mesh VPN. It is designed to avoid unnecessary
telemetry, but it must process operational metadata to authenticate devices,
build network membership, and negotiate peer-to-peer connectivity.

## Telemetry

VeloraMesh v1 does not include third-party analytics, advertising SDKs, crash
reporting SDKs, or product telemetry callbacks.

## Server-Side Metadata

The self-hosted VeloraMesh server can store or observe:

```text
network names and IDs
device IDs and device display names
network membership state
virtual IPv4 assignments
blocked/removed device state
session expiry timestamps
reported peer endpoints
public IP/port observations
UDP discovery timestamps
control-plane request logs
server operational logs
```

The server does not act as a data-plane relay in v1. Direct peer traffic is
encrypted between peers and is not routed through the control server.

## Client-Side Data

Clients can store:

```text
device identity
network membership
server URL
optional SPKI pin
session token
local tunnel/service settings
local logs
```

Secret storage differs by platform:

```text
Windows: DPAPI protected private-key storage
Android: Android Keystore protected private-key storage
macOS/Linux: restricted local secret files
```

## Peer Visibility

Peers in the same network can learn operational metadata required for direct
connectivity, including virtual IPs and endpoint candidates. This is necessary
for P2P negotiation.

## Logs And Doctor Bundles

Logs and doctor bundles are intended for troubleshooting. Default background
tunnel logs record aggregate event classes, counters, retry timing, and latency;
they omit peer and network identifiers, virtual addresses, underlay endpoints,
and raw remote error text.

Doctor bundles contain check names and outcomes, product/platform version data,
and a configuration summary limited to booleans and counts. They do not include
service-log tails, server addresses, device or network names and identifiers,
virtual IPs, endpoint addresses, local filesystem paths, session tokens, private
key material, or join secrets. The detailed doctor output shown directly to the
local operator can contain operational topology data.

Share support bundles only with trusted maintainers.

## Join Secrets

Join secrets are used for onboarding. They should be treated as confidential.
The official client processes the secret locally to derive a signed enrollment
proof; the secret itself is not placed in the HTTP request or stored by the
control plane. Rotate the network join secret when access should be limited to
future installations only.

## Data Removal

Server data can be removed by purging the VeloraMesh server install and store.
Client data can be removed by purging the client install and configuration on
each device. Purge operations intentionally do not delete Let's Encrypt
certificate source directories.
