Privacy Policy

1. Information We Collect

This section describes what Meshbound actually holds today. Where a category is narrower than you might expect from a product of this kind, that is deliberate: we have written down what the system does, not what it might one day do.

Account Information

Meshbound does not operate its own user directory. Accounts are held in Supabase Auth, and the only identifier Meshbound stores alongside your data is the account's user ID. In practice that means we hold:

• your email address, as the identifier you sign in with; and
• the account's user ID, used to scope every row of your data to you.

We do not collect your name or organization, and we do not collect or process payment or billing information. Meshbound has no payment processing of any kind.

Connected Services

Meshbound is useful only once you connect the systems you want reviewed. You authorize each connection separately, and each grants a specific, named level of access:

• GitHub — we request the repo scope. This is read and write access to the repositories your account can reach. We use the read half to analyze code, configuration, dependencies, routes, and existing security policy. We use the write half for exactly one thing: opening a pull request on a branch, and only when you approve a specific proposed fix. Meshbound does not commit to your default branch and does not merge.
• Supabase — we request the all scope on the Management API, which is the scope granularity Supabase's organization app registration offers. We read database schema, row-level security policies, table grants, and authentication configuration. Changes are applied only when you approve a specific proposed fix.
• Firebase — we request firebase.readonly and datastore. We read your project list, your Firestore security rules, and a small sample of documents needed to evaluate those rules against realistic data. Candidate rules are evaluated through Google's rules-testing endpoint, which returns a verdict and deploys nothing. Meshbound does not have, and does not request, permission to deploy Firestore rules.

Access tokens for connected services are encrypted before storage and are deleted when you disconnect the service. See Security.

Repository and Application Information

Within the access you have granted, the information we process includes source code, configuration files, dependency information, repository metadata, branches and pull requests, application routes and endpoints, database schemas, security policies and grants, authentication configuration, and the security findings and verification results we derive from them. The exact set depends on which services you connect and which checks you run.

Live Application Scanning

If you submit a deployed application URL, we process what that application returns from its publicly accessible endpoints: HTTP responses, headers, status codes, client-side bundles, and the evidence needed to demonstrate a finding. Where a finding requires showing that data was reachable, we limit what we retain and display to what demonstrates the finding.

We keep an append-only record of each scan run against a submitted target. That record contains the timestamp, the target URL, the IP address the request came from, the detected backend URL and key type, the table names found and the subset found to be exposed, and the outcome. This log exists so that every scan we perform against an endpoint is attributable; it is a compliance record, not a product analytics feed.

Findings and Workspace Data

We store the output of your work so you can return to it: projects you have created, findings and their history, fixes you have dismissed, answers you have given to setup questions, and records of the domain-ownership checks you have completed. Every one of these rows is keyed to your user ID.

Aggregate and Operational Data

We keep a per-day count of public scans by detection outcome. These are counts only — no URL, user, or IP is recorded against them. We also keep short-lived rate-limiting counters so that sign-in, sign-up, and scanning cannot be abused; their keys are hashes, so these counters contain no email address, IP address, or user ID.

Meshbound does not collect browser or device information, operating system, location, page-view history, referring pages, or feature-usage telemetry. There is no analytics code in the product.

2. How We Use Information

We use information to:

• authenticate you and keep you signed in;
• connect to the services you have authorized;
• analyze code, configuration, and deployed applications for security vulnerabilities;
• generate proposed remediations and verify them before presenting them to you;
• open pull requests and apply approved changes at your instruction;
• monitor connected repositories for changes, where you have enabled that;
• keep a record of scans performed against submitted targets;
• maintain the reliability and security of Meshbound;
• detect and prevent abuse and unauthorized access, including rate limiting;
• comply with legal obligations; and
• enforce our agreements.

We do not use your information for advertising, and we do not profile you.

3. We Do Not Sell Your Source Code

In short. We do not sell your source code, repository contents, security findings, or application data. We do not use the contents of your private repositories to build a dataset or make them publicly available. We do not sell personal information.

We may use aggregated or de-identified information — such as the per-day scan counts described above — to understand product usage and improve our detection and verification systems, provided the information is not reasonably identifiable to you or your organization.

4. Automated Processing

Meshbound's security detection is deterministic. Each check is a rule written against a specific, known vulnerability class, and each proposed fix is generated from a template and then tested before it is shown to you. Findings are not produced by a language model's judgment.

Meshbound does not send your source code, repository contents, database schemas, or application data to any third-party AI provider. There is no such integration in the product. Your code is not used to train any model, ours or anyone else's.

If that ever changes, we will disclose it here and obtain any consent required by applicable law before it takes effect.

5. How We Share Information

Service Providers

Meshbound's own infrastructure is deliberately small. We rely on vendors for:

• application hosting;
• database hosting; and
• authentication.

These providers process information only as necessary to run the Service and are subject to contractual obligations. We do not use analytics providers, error-monitoring providers, marketing or email platforms, payment processors, or customer-support platforms, because Meshbound has none of those systems.

Connected Services

When you connect GitHub, Supabase, or Firebase, Meshbound exchanges information with that service to perform the function you requested — reading what you authorized us to read, and writing only what you approved. Nothing is shared with a service you have not connected.

Legal and Safety Reasons

We may disclose information where reasonably necessary to:

• comply with applicable law or legal process;
• respond to lawful requests from authorities;
• enforce our agreements;
• investigate fraud or abuse;
• protect the rights, property, or safety of Meshbound, our users, or others; or
• detect, investigate, or prevent security incidents.

Business Transfers

If Meshbound is involved in a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar transaction, information may be transferred as part of that transaction, subject to applicable law.

6. Repository and Application Data Is Confidential

The repositories and applications you connect to Meshbound may contain confidential business information. We restrict access to such information to personnel and service providers who require it to perform their responsibilities, and we use technical and organizational safeguards designed to prevent unauthorized access.

No system can guarantee absolute security.

7. Security

Connected-Service Tokens

Access tokens and refresh tokens for GitHub, Supabase, and Firebase are encrypted with AES-256-GCM before they are written to the database. Each record is bound to the account and service it belongs to, so a token row cannot be lifted and replayed under a different account. Tokens are deleted when you disconnect the service.

Data Scoping

Every row of your data is keyed to your account. Row-level security is enabled on the underlying tables as a second layer beneath the application's own scoping, so that a request carrying your credentials can reach only your rows.

Session Cookies

Session cookies are set HttpOnly, Secure, and SameSite=Lax, so they are not readable by page scripts, are sent only over HTTPS, and are not sent on cross-site requests.

Your Responsibilities

The security of your own systems remains yours. You are responsible for the credentials, tokens, repositories, and deployment platforms you connect to Meshbound. If you believe your Meshbound account has been compromised, contact us promptly at security@meshbound.dev.

8. Data Retention

We retain information for as long as reasonably necessary to provide the Service and for legitimate business, security, legal, and dispute-resolution purposes. Retention differs by type:

• Connected-service tokens — held until you disconnect the service, at which point the record is deleted.
• Projects, findings, and workspace data — held while your account is active, so you can return to your work.
• Scan records — retained as a compliance record of scans performed against submitted targets.
• Rate-limiting counters — short-lived, and pruned once their window has passed.
• Aggregate scan counts — retained indefinitely; they contain no identifiers.
• Backups — may retain information for a limited additional period after deletion from active systems.

We do not retain billing records, because we do not create any.

9. Verification Environments

Meshbound does not present a fix it has not tested. How a fix is tested depends on what is being fixed:

• Database policy fixes are rehearsed against a scratch schema, which is created for the test and removed afterwards. Your production data is not copied into it.
• Code fixes are tested against a fixture — a minimal reconstruction of the vulnerable pattern — rather than against your application.
• Firestore rule fixes are evaluated through Google's rules-testing endpoint. Candidate rules are sent for evaluation and nothing is deployed. The test uses fields read from a document in your project so the evaluation reflects your real data shape; the evaluation itself happens inside Google's service.

Verification environments are temporary and isolated, are deleted after verification or after a short retention period, and are never a production environment or a backup.

10. Cookies and Local Storage

Meshbound sets four things in your browser. Two are cookies strictly necessary to keep you signed in; two are preferences stored locally that never leave your device. There are no analytics cookies, no advertising cookies, and no third-party cookies.

Because we set no non-essential cookies, Meshbound does not show a cookie consent banner — there is nothing to consent to. The two local-storage preferences are not cookies, are readable only by your own browser on this site, and can be cleared at any time through your browser's site-data controls.

The Meshbound marketing site at meshbound.dev sets nothing at all. You can clear or block cookies through your browser settings; blocking the two session cookies will prevent you from signing in.

11. Google API Services and Limited Use

When you connect Firebase, Meshbound receives data from Google APIs. Meshbound's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Data Meshbound receives through Google APIs is used only to provide the features you requested — reading your Firestore security rules and a sample of documents in order to detect misconfigurations and to evaluate a candidate fix. Specifically:

• we do not transfer that data to others except as necessary to provide the feature, for security purposes, or to comply with applicable law;
• we do not use that data for advertising, and we do not sell it;
• we do not allow humans to read that data, except with your explicit consent for specific items, where necessary for security purposes such as investigating abuse, or to comply with applicable law; and
• we do not use that data to develop, improve, or train generalized artificial intelligence or machine-learning models.

You can revoke Meshbound's access at any time by disconnecting Firebase in the Meshbound workspace, which deletes our copy of your tokens, or through your Google account permissions.

12. Your Choices and Rights

Depending on where you live, you may have rights regarding your personal information, including rights to:

• access personal information we hold about you;
• request correction of inaccurate information;
• request deletion of certain information;
• request restriction of certain processing;
• object to certain processing;
• request portability of certain information; and
• withdraw consent where processing is based on consent.

Two of these you can exercise directly in the product. Disconnecting a service deletes the tokens we hold for it immediately. Deleting a project removes it and its findings.

Account deletion is currently handled by request. Meshbound does not yet offer a self-service delete-my-account control. Email privacy@meshbound.dev from the address on the account and we will delete your account and associated data. We would rather say this plainly than imply a control that does not exist.

These rights are subject to applicable legal exceptions and limitations, and we may need to verify your identity before fulfilling a request.

13. Canadian Privacy

Where applicable, Meshbound handles personal information in accordance with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

Where Meshbound processes information on behalf of a business customer, the customer may remain responsible for determining the purposes and means of processing and for responding to certain requests from individuals.

14. International Processing

Meshbound and its service providers may process information in countries other than the country in which you reside. Where information is transferred across borders, we use safeguards appropriate to the circumstances and applicable law.

By using Meshbound, you acknowledge that information may be processed in jurisdictions where privacy laws may differ from those in your jurisdiction.

15. Children's Privacy

Meshbound is intended for businesses, developers, and other professional users. It is not directed toward children under the age of 13, and we do not knowingly collect personal information from children under 13.

If you believe a child has provided personal information to us, contact us so that we can investigate and take appropriate action.

16. Third-Party Links and Services

Meshbound links to and integrates with third-party services. We are not responsible for the privacy practices of third parties. You should review the privacy policies of services before connecting them or providing them with information.

17. Do Not Track

Some browsers send a "Do Not Track" signal. Meshbound does not track you across sites in the first place — there is no analytics or advertising technology in the product — so there is nothing for the signal to turn off.

18. Data Processing Agreements

If you use Meshbound on behalf of an organization and require a Data Processing Agreement ("DPA"), contact us at privacy@meshbound.dev.

Where applicable, the DPA and other written agreements between Meshbound and the customer may establish additional privacy, security, confidentiality, retention, or processing obligations.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice, such as by posting an updated policy or notifying users through the Service. The updated policy will indicate its effective date.

20. Contact Us

If you have questions, concerns, or requests relating to privacy or this Privacy Policy, contact:

Meshbound
Privacy: privacy@meshbound.dev
Security: security@meshbound.dev
Legal: legal@meshbound.dev