Privacy

This is a translation. The German version is legally binding.

This page explains which personal data we process when you visit onmesh.chat, use Mesh, have an account on onmesh.chat or contact us. Personal data is any information relating to an identified or identifiable person.

1. Controller

Yanick Stephan
Digital Services Stephan
Sängerbuchenweg 4
64291 Darmstadt
Germany
Phone: +49 6150 5589000
Email: info@dss-net.de

2. Visiting the website

Server logs

Each time a page is requested, our web server stores: IP address, date and time, the page requested, the amount of data transferred, status code, referrer and your browser's identifier. We need this data to run the website reliably and securely and to detect attacks. The legal basis is our legitimate interest in doing so (Art. 6(1)(f) GDPR). We store the logs of all our systems centrally in a log system we run ourselves (VictoriaLogs) and delete them there after 14 days. On the servers themselves they remain for 3 days. We keep logs for longer only if we need them to investigate a security incident.

Cookies and local storage

This website sets no cookies, stores nothing in your browser's local storage and uses no analytics or advertising services.

No third-party content

We serve fonts, scripts and images from our own servers. When you visit the website, your browser does not connect to any third party. We do not use a content delivery network. The website asks our download server for the current version of the desktop app. Our server makes that request; your IP address is not passed on.

3. Contact

If you email us or call us, we process the details you provide: name, contact details and the content of your message. If it concerns a contract, the legal basis is Art. 6(1)(b) GDPR. In all other cases it is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete enquiries once they have been dealt with and no statutory retention obligation applies.

4. Mesh apps

Mesh Web

Mesh Web (web.onmesh.chat) runs in your browser. Your session, your keys and part of your chats are kept in the browser's local storage (IndexedDB, local storage). This is necessary for the function (section 25(2) no. 2 TDDDG). The data leaves your device only towards your Matrix server. Mesh deletes it when you sign out. Section 2 applies to the server logs.

Desktop app

You download the desktop app from download.mesh.dss-net.de. It regularly checks there for updates. This produces the data described in section 2. The legal basis is our legitimate interest in delivering security and bug fixes to you (Art. 6(1)(f) GDPR).

5. Account on onmesh.chat

For an account on our Matrix server (matrix.onmesh.chat) we process:

• account: Matrix ID, password as a hash, email address if you provide one,
• profile: display name and avatar. They are visible to everyone you share a room with,
• messages, files and reactions in your rooms. In encrypted rooms only in encrypted form; we cannot read them. Who wrote in which room and when is visible to us there too,
• devices: for each signed-in device its name, last IP address used and the time,
• the key backup, if you set it up. It is encrypted with your recovery key.

We cannot provide the service without this data. The legal basis is Art. 6(1)(b) GDPR. We keep the server's logs, with IP addresses, for 14 days.

Federation

Matrix is federated. If you write in a room with members on other servers, those servers receive the room's messages, your Matrix ID and your profile. This is necessary for the message to arrive (Art. 6(1)(b) GDPR). The operators of those servers are responsible for the processing there. Those servers can be anywhere in the world.

6. Mesh Plus and payment

For Mesh Plus we additionally process: name, email address, address where applicable, the plan booked, invoices and payment status. We cannot conclude a contract without this data. The legal basis is Art. 6(1)(b) GDPR. We keep invoice data for the statutory periods (Art. 6(1)(c) GDPR), see section 12.

Mesh Plus cannot be booked yet. Before it can, we will add here who processes the payment and which data they receive for it.

7. Bridges

Bridges come with Mesh Plus. When you connect WhatsApp, Signal, Telegram or Discord, a bridge on our server signs in to that service on your behalf. To do so it stores the session with that service and passes messages both ways, and on request your past history too. To do that it has to read the messages: chats through a bridge are not end-to-end encrypted on that path. The legal basis is Art. 6(1)(b) GDPR. The operators of WhatsApp, Signal, Telegram and Discord process your data on their own responsibility under their privacy policies. If you sign the bridge out in Mesh or Mesh Plus ends, we end the session and delete the bridge's data.

8. Push notifications

So that your iPhone tells you about new messages, our push gateway (push.onmesh.chat) sends a notification to the Apple Push Notification service of Apple Inc., USA. The iOS app only sends room and message IDs, no content. The iPhone fetches and decrypts the message itself. Once the Android app exists, this works there through Firebase Cloud Messaging of Google Ireland Limited. Apple or Google see the device token and the time. The push gateway logs the IP address of the server sending the notification. Section 2 applies to the logs. The legal basis is Art. 6(1)(b) GDPR.

9. Calls

Audio, video and shared screens in calls and voice channels go through our call server (rtc.onmesh.chat). Calls are end-to-end encrypted: Mesh encrypts every participant's audio and video with their own keys. The server only forwards encrypted data and cannot read it. It sees IP addresses and who is in a call with whom. We do not record calls. The legal basis is Art. 6(1)(b) GDPR. We delete the server's logs after 14 days.

10. Abuse and reports

If you report illegal content or a breach of the Acceptable Use Policy to us, we process your details and the data on the reported matter. Where we are obliged to do so under Regulation (EU) 2022/2065 (Digital Services Act) or Regulation (EU) 2021/784, the legal basis is Art. 6(1)(c) GDPR. Otherwise it is our legitimate interest in preventing misuse of our services (Art. 6(1)(f) GDPR). Where necessary for handling the report, we pass it on to the user concerned, without your name if you wish.

11. Recipients and locations

Website, Mesh Web and push gateway run on our own hardware in Frankfurt. The Matrix server runs on our own hardware in our office in Darmstadt, at the address in the imprint. We use the following service providers. Where they process data on our behalf, we have concluded a contract with them under Art. 28 GDPR.

• Cherry Servers (Lithuania): rented servers in Amsterdam for the call server
• Servperso Systems, Place du marché 31, 2A, 4651 Battice, Belgium: IP tunnel (L2TP) for the network connection of our own systems
• Apple Inc. (USA) and, once the Android app exists, Google Ireland Limited (Ireland): delivery of push notifications, see section 8

All other service providers of Digital Services Stephan are listed in section 9 of the privacy policy of dss-net.de.

Data is received on their own responsibility by: other Matrix servers, when you write with their users (section 5), and WhatsApp, Signal, Telegram and Discord, when you connect a bridge (section 7). We also pass on data where we are legally obliged to, for example to authorities.

Our own systems and the call server are located in the European Union. Data is transferred to third countries for push notifications to Apple (section 8), for messages to Matrix servers outside the EU and for bridges to services outside the EU. In each case this happens because you initiate it in order to use the service.

12. Storage period

We store data for as long as we need it for the respective purpose. The data of your account on onmesh.chat remains until you delete the account. After that we delete it without undue delay, at the latest after 30 days. Copies of messages in shared rooms that other Matrix servers have received are kept there, not by us. We delete logs after 14 days (section 2). We delete contract data for Mesh Plus after the contract ends, once the statutory retention periods have expired: 6 years for business letters, 8 years for invoices and accounting records, 10 years for books and annual financial statements (section 257 HGB, section 147 AO).

13. Your rights

You have the right to:

• access to your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object: Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop the processing if we have no compelling legitimate grounds for it and do not need it for legal claims.

To do so, write to info@dss-net.de.

You can also lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information)
Postfach 3163
65021 Wiesbaden
Phone: +49 611 14080
Email: poststelle@datenschutz.hessen.de

14. Automated decisions

We do not make any decisions with legal effect for you that are based solely on automated processing. No profiling takes place.

15. Changes

We update this policy when our services or the legal situation change. The version on this page applies.

Last updated: 20 October 2026