Privacy Policy

Effective date: July 10, 2026
Applies to: the CruiseMesh mobile apps, the optional internet relay at relay.davidjacobson.work, and this website (cruisemesh.davidjacobson.work).

1. Who operates CruiseMesh

CruiseMesh is an open-source project operated by David Jacobson (“we,” “us”). Source code is published at github.com/davidmjacobson/cruisemesh. You may also self-host the relay; if you do, you are the operator of that instance and this policy describes the design of the software, not every third-party host’s practices.

2. Scope of this policy

This policy covers three surfaces:

• Mobile apps (Android / iOS) that store data on your device and optionally sync over Bluetooth or the internet relay.
• Internet relay (cruisemesh-relayd), a mailbox that holds sealed envelopes until devices fetch and acknowledge them.
• This website, a static landing page. It does not require an account and does not set cookies for analytics or advertising.

3. What we do not collect

Based on the current software:

• No email address, phone number, or password account is required to use the app.
• No advertising identifiers, crash-reporting SDKs (e.g. Firebase, Sentry), or product-analytics SDKs are bundled in the apps.
• The Android app requests Bluetooth with neverForLocation and does not request location permission for scanning.
• The relay server does not open sealed message bodies. It does not store plaintext message text, read/delivery receipt content, or sender identity in the public envelope header.
• This website serves static HTML only (no third-party scripts, no cookies for tracking).

4. Data on your device (app)

CruiseMesh is designed so cryptographic identity and conversation data live primarily on your phone:

• Identity keys. Ed25519 signing and X25519 encryption keypairs are generated on device. In the current design they do not leave the device (no multi-device account sync in v1).
• User ID. A short ID derived from your public signing key (displayed for friending, e.g. base32 form). This is not a government ID or phone number.
• Profile. Display name you choose (default may be your device model until you set one) and optional profile photo (small square image used as contact metadata).
• Contacts & groups. Friend cards (name, public keys, optional relay URL/token), group membership, and group keys.
• Messages & media. Chat history, delivery/read state, and any photos or voice memos you attach—stored locally and sealed before leaving the device for another peer or the relay.
• Relay configuration. If you use an internet relay, the app stores the relay URL and family bearer token.

Deleting the app (or clearing app data) removes on-device data subject to your OS. CruiseMesh app data is not included in Android Auto Backup. iOS device backups (if enabled) may still include app data under Apple’s backup rules.

5. Permissions the apps request

• Bluetooth — discover nearby CruiseMesh peers and exchange sealed mesh traffic without internet.
• Camera — scan friend QR codes and take photos for chat / profile use.
• Microphone — record short voice memos for chat (when you use that feature).
• Photo library (iOS) — choose an existing photo to send or use as profile.
• Internet / network state — optional flush of sealed envelopes to the relay when a network path exists.
• Notifications — alert you about new messages when the OS allows.
• Foreground service / battery exemptions (Android) — keep mesh sync more reliable in the background; you can decline system dialogs with reduced background reliability.

Permissions are used for the features above, not for advertising or cross-app tracking.

6. Data other devices may process (mesh)

CruiseMesh uses delay-tolerant networking. Depending on how a message is delivered, the following can happen:

• Direct Bluetooth. Your phone exchanges sealed envelopes with a peer in range. A brief unauthenticated “hello” announces your User ID so the peer can map the link to a known contact for routing/UI. Message contents remain sealed for the intended recipient’s keys.
• Data mule. Another CruiseMesh device (typically a family member) may temporarily store and carry sealed envelopes it cannot read, until they reach the recipient or expire.
• Internet relay. Any device that has your family’s relay configuration and network access can upload/download sealed envelopes for matching recipient hints (see §7).
• Broadcast mode (if used). Traffic on the public broadcast channel is intentionally readable by any CruiseMesh app. Treat it as public, not private messaging.

Nearby Bluetooth observers may learn that CruiseMesh devices are present and may see transient User IDs or public envelope headers (msg_id, hop TTL, expiry, rotating recipient hint, ciphertext). They cannot open sealed family traffic without the recipient keys.

7. Internet relay (mailbox)

The hosted relay at relay.davidjacobson.work is a content-agnostic mailbox. Authenticated clients (shared family bearer token) may post and fetch envelopes. What is stored per envelope is essentially:

• msg_id (opaque id for deduplication)
• hop_ttl and expiry_ms
• recipient_hint — an 8-byte hash of the recipient identity salted by calendar day (rotates daily; not a permanent public username on the wire)
• sealed — ciphertext only
• server-side creation time and a per-family token scope for access control

Sender identity and plaintext (including delivery/read receipt details) are inside the seal, not in the public header. A compromised or honest-but-curious relay can observe traffic timing, volume, and approximate social-graph size for a family token—not message contents or read state.

Retention on the relay:

• Clients typically set envelope expiry around 7 days.
• The server enforces a hard ceiling of 30 days from creation.
• Rows are removed when a client acknowledges delivery (POST /envelopes/ack) or when expiry/retention pruning runs.

Access uses a long random family bearer token (often shared via friend QR / contact setup). Anyone who holds that token can use the family’s mailbox. Protect QR codes and tokens like a household shared secret.

8. Website and infrastructure logs

• This website does not set first-party analytics cookies and does not embed third-party trackers.
• HTTPS reverse proxies (nginx) in front of the site and relay may keep standard access logs (IP address, timestamp, URL path, user agent, response status). That is ordinary server logging for security and operations, not product analytics.
• Prefer sending the family token in the Authorization header (as native clients do). Putting tokens in URL query strings can cause them to appear in proxy logs; avoid that pattern when you control the client.
• TLS certificates are issued by Let’s Encrypt for the relevant hostnames.

9. How data is used

• To deliver messages and receipts between people you deliberately friend or group with.
• To operate the optional relay mailbox and keep the service secure and available.
• Not for advertising, selling personal data, or building marketing profiles.

10. Sharing

We do not sell your personal data. Message contents leave your device only as sealed ciphertext to peers you interact with on the mesh, or to a relay you configure. Infrastructure may involve a VPS host and certificate authority that process connection metadata under their own terms. Open-source distribution via GitHub is separate from app message data.

We may disclose information if required by law, to protect rights and safety, or to defend against abuse of the relay—keeping in mind the relay holds sealed blobs, not message plaintext.

11. Your choices and controls

• Do not configure a relay if you want only local Bluetooth delivery.
• Rotate or revoke family relay tokens on the server if a token is exposed (self-host operators control CRUISEMESH_RELAY_TOKENS).
• Unfriend / leave groups on device; remove the app to delete local data (subject to OS backups).
• Verify contacts with the short fingerprint phrase shown after friending (Signal-style verbal check).
• Treat broadcast channels as public.

Because there are no cloud accounts, there is no central “download my data” portal. Your authoritative copy of chats is on participating devices. Relay contents are sealed and time-limited as described above.

12. Children

CruiseMesh is intended for family use. It is not directed at children under 13 as a general audience product, and we do not knowingly collect personal information from children under 13 through accounts (we do not offer accounts). Parents and guardians who install the app for family messaging control the devices and friending choices.

13. International and self-hosted use

The hosted relay and website described here are operated from infrastructure under our control (currently associated with davidjacobson.work). If you point the app at a different relay URL, that operator’s privacy and logging practices apply to envelopes you send there.

14. Security

We use end-to-end sealing (libsodium-style seal constructions as implemented in the open-source core), HTTPS for relay transport, and minimize what the relay can see. No method of transmission or storage is perfectly secure. Threat model for v1 prioritizes “no internet / untrusted carriers of ciphertext,” not nation-state anonymity. See DESIGN.md for technical detail.

15. Changes

We may update this policy as the software evolves (for example if store distribution, multi-device sync, or optional telemetry is ever added). The effective date at the top will change; material changes should be reflected here and, when practical, in app release notes.

16. Contact

Questions about this policy or the hosted relay: open an issue on the CruiseMesh GitHub repository, or contact the operator of davidjacobson.work.