Privacy Policy · meshnote

1. Who we are

Meshnote ("we", "us") is operated by Doteli LLC, a Wyoming limited liability company, 30 N Gould St, STE R, Sheridan, WY 82801, USA. Questions and requests: hi@meshnote.io.

This policy covers the hosted service at meshnote.io: the website, the web app, and the MCP endpoint at https://meshnote.io/mcp. If you run Meshnote yourself — the meshnote command-line tool on your own computer, or a self-hosted Team server — your wiki stays on your machine or server. A self-hosted Team server sends only its licence key to our licence server to check that the licence is valid.

2. What we collect

Account data. Sign-in is handled by Firebase Authentication, a Google service, with Google sign-in or an email address and password. We store your email address, your display name if one is provided, your Firebase user ID, and when you created your account and last signed in. We never receive your password.
Your content. The projects, wiki pages, sources and log entries that you or your AI agents create. When a page is changed, we keep the previous version, up to 20 versions per page. When a source is replaced, we keep up to 5 previous versions.
Sharing. If you invite someone to a project, we store their email address and send them an invitation email. Project invitations expire after 7 days. Publicly published pages and folders can be read by anyone with the link. Private links require current project access. Published pages ask search engines not to index them.
AI client connections. When you connect an AI client (for example Claude, Cursor or Codex) over MCP, we issue it an API key. We store only a SHA-256 hash of the key, the first few characters so you can tell keys apart, its label, when it was created, and which projects it can use and whether it is read-only. Keys created through the OAuth connect flow expire after 30 days. When a client registers itself with us, we store its name and its redirect addresses.
Tool calls. Your AI client sends Meshnote tool calls, such as a search query or the text of a page to save. We use them to run the tool, and what they write becomes part of your wiki. Meshnote cannot see your conversations with your AI client, its chat history or its memory — only the tool calls it sends.
Notion. If you connect Notion, we store the Notion workspace ID and name, the integration's bot ID, and the access token Notion gives us (and a refresh token, if Notion issues one). Tokens are encrypted before they are stored. Notion also sends details about the Notion user who connected; we do not keep them. Meshnote can see only the pages you have shared with its Notion integration. It reads from Notion only when you open Choose pages, which lists those pages, or when you start an import, which copies them. It never changes anything in Notion. Each imported page is copied with its title, its Notion link, when it was last edited, and its text as Markdown. Images, files and databases are not copied.
GitHub. If you connect GitHub, we store your GitHub user ID and username, and the access and refresh tokens GitHub gives us, with the dates they expire. Tokens are encrypted before they are stored, and when the access token expires we use the refresh token to get a new one. GitHub also sends other profile details; we do not keep them. Meshnote can see only repositories that you can access and that the Meshnote GitHub app is installed on. Apart from connecting and disconnecting, it reads from GitHub only when you open Choose repositories, which lists those repositories, or when you start an import. An import reads the file list of each chosen repository's default branch. If you chose a folder, it reads the file lists of that folder and of the folders above it. It copies the Markdown files (.md and .markdown) of up to 1 MB each from the repository, or from the chosen folder only. Meshnote never changes your repositories, and it does not receive webhooks from GitHub. Each imported file is copied with its repository name, its path, its GitHub link and its text. If a file is later deleted on GitHub, the copy in Meshnote is kept and marked as deleted.
Google Drive. If you connect Google Drive, we ask Google only for your Google account ID, your email address, and access to the Drive files you choose (Google's drive.file permission). Meshnote cannot see any other file in your Drive. We store your Google account ID and email address, and the access and refresh tokens Google gives us, with the date the access token expires (and the refresh token's, if Google gives one). Tokens are encrypted before they are stored, and when the access token expires we use the refresh token to get a new one. Google also tells us whether your email address is verified; we do not keep that. When you click Choose files, your browser loads Google's file picker from Google's servers, and Meshnote gives your browser a short-lived Google access token for it — never the refresh token. The picker shows your Drive; the files you pick in it are the only ones shared with Meshnote. Apart from connecting and disconnecting, Meshnote reads from Google Drive only when you start an import. An import reads each chosen file's name, type, version, size, last-change time, link and whether it is in the trash, then copies Google Docs as Markdown and .md and .txt files as text, up to 50 files and 1 MB of text each. Images in Google Docs are not copied. Meshnote never changes anything in your Drive. Each imported file is copied with its name, its Drive link, its Drive file ID, type, version and last-change time, and its text. If a file is later moved to the trash or can no longer be opened, the copy in Meshnote is kept and marked as unavailable.
Imported sources. Each imported Notion page, GitHub file or Google Drive file becomes a source in the project you chose. Imports run only when you start them; there is no automatic sync. If Notion, GitHub or Google is busy, or our server restarts during an import, that same import is retried by itself. Anyone who can open that project can read these sources, including the people you share the project with and the AI clients you give access to it. Importing again updates the same sources, and we keep up to 5 previous versions of each, as for any other source. We also store which project you import into, which pages, repositories (and folders) or Google Drive files you chose last time, and a record of each import: its status, counts, and short notes that can name a Notion page, a repository, a file path, or a Google Drive file name or ID.
Connection records and analytics. We keep an audit record when you connect or disconnect Notion, GitHub or Google Drive, and when you start an import. Like other audit records, it includes your IP address and browser user agent. Connect and disconnect records include the Notion workspace ID and name, your GitHub user ID and username, or your Google account ID and email address. Import records include the project and the number of pages, repositories or files chosen, not their names. If that project belongs to an organization, the organization's admins can see the import record in their audit log. These private app actions are not sent to analytics providers.
Payments. Payments are handled by Stripe. You enter card details on Stripe's pages, and they never reach our servers. From Stripe we store your customer ID, subscription ID and subscription status. When you buy a Team licence, we also keep the buyer's email address and the licence details, and we email the licence key.
Technical data. Our servers keep operational logs of requests: the time, the path, the status code, your IP address, and your user ID when you are signed in. When a request fails, the error log can include details of that request. For some account actions, such as deleting a project, we keep an audit record that includes your IP address and browser user agent.
Analytics. See section 5.

3. How we use it

To run the service: sign you in, store and show your wiki, run the tools your AI clients call, and send invitation and licence emails.
To bill you for paid plans.
To keep the service secure and to prevent abuse.
To understand how people find and use Meshnote, so we can improve it.

We do not sell your personal information, and we do not use it for advertising. We do not use your wiki content to train AI models, and the hosted service does not send your wiki content to any AI model provider.

Google user data. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. In practice: we use what we receive from Google Drive only to import the files you choose into the project you choose and to show them to you, your project members and the AI clients you connect. We do not sell it, use it for advertising, or use it to train AI or machine-learning models. We do not transfer it to anyone else except as needed to run this feature, for security, or when the law requires it. People at Meshnote do not read it unless you ask us to, or when it is needed for security or by law.

4. Service providers

We use these services to run Meshnote. Each one receives only what it needs for its job.

Amazon Web Services (AWS) — the servers that run Meshnote and store your content, and our database. They are in the United States.
Google (Firebase Authentication) — sign-in. The sign-in script loads from Google's servers.
Stripe — payments and subscriptions.
Resend — sends invitation and licence emails.
PageDuel — analytics and A/B testing on anonymous marketing pages without query parameters. Its script does not load on private app, sign-in, subscription, or shared-content pages.
Google Fonts - anonymous marketing pages without query parameters load fonts from Google. Private screens use system fonts. Charting code and published-page styles are served by Meshnote.
Notion, GitHub and Google Drive — only if you connect them. Google's file picker loads from Google's servers (apis.google.com and docs.google.com) only after you click Choose files.

Your AI client is not one of our providers. Content that your AI client reads from or writes to Meshnote also passes through that client and its provider (for example Anthropic or OpenAI), under their own terms and privacy policies.

We may also share information if the law requires it, or when it is needed to protect the rights or safety of our users or others.

5. Cookies and browser storage

meshnote.session — keeps you signed in. It expires after 14 days without a visit.
An anti-forgery cookie — protects forms in the app from cross-site request forgery.
Firebase — the sign-in script can keep your sign-in state in your browser's storage.
PageDuel - on eligible anonymous marketing pages, its script keeps an anonymous visitor ID in local storage. Our tracking script keeps redacted referral information in session storage. Analytics scripts do not load on private screens, sign-in, subscriptions, shared links, or pages with query parameters.
Google file picker — only after you click Choose files. It opens in a frame from docs.google.com, where Google's own cookies and privacy policy apply.

We do not use advertising cookies.

6. How long we keep data

Your account and content stay as long as your account exists. They are not deleted automatically when a subscription ends.
Page history keeps up to 20 previous versions of each page and 5 of each source. Older versions are removed as new ones are saved.
When you delete a page or a source, it is removed together with all of its saved versions, and it cannot be restored. When you delete a project, all of its files are removed.
API keys stay until you revoke them or they expire.
Server logs and audit records are kept for security and troubleshooting. We have not set a fixed deletion schedule for them yet.
If we hold backups of our database or servers, deleted data can remain in them until those backups are replaced.

7. Your choices and rights

Export. While your subscription is active, you can export any project as a zip of plain markdown files from the web app.
Delete. You can delete pages, sources and whole projects yourself. To delete your account, email hi@meshnote.io from the address on the account, and we will delete your account and its content.
Revoke AI access. You can revoke an AI client's key at any time under API keys in Settings.
Disconnect Notion, GitHub or Google Drive. Disconnecting removes the stored tokens from our database and stops any import that has not finished. If an import was paused and you reconnect the same account before it resumes, that import continues. Sources already imported stay in your project until you delete them. We keep the Notion workspace, GitHub account or Google account ID and name or email address, and the records of past imports. For GitHub, we also try to cancel Meshnote's authorization with GitHub, unless another Meshnote account is still connected to the same GitHub user; if that request fails, you can revoke it in your GitHub settings. For Google Drive, we also try to revoke Meshnote's access at Google, unless another Meshnote account is still connected to the same Google account; if that does not work, you can remove Meshnote's access in your Google Account settings. To also remove Meshnote's access on Notion's side, remove the connection in your Notion settings. To remove the Meshnote app from your repositories, uninstall it in your GitHub settings.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, or to object to how we use it. To use any of these rights, email hi@meshnote.io.

8. Security

All traffic to meshnote.io uses HTTPS.
API keys are stored only as SHA-256 hashes, and Notion, GitHub and Google tokens are encrypted before they are stored.
Each account's content is stored separately, and every request is checked against the signed-in account.

No system is perfectly secure. If you find a security problem, please email hi@meshnote.io.

9. Where your data is stored

Our servers and database are in the United States. If you use Meshnote from another country, your data is transferred to and processed in the United States.

10. Children

Meshnote is not meant for children. You must be at least 18 to create an account.

11. Changes to this policy

We may update this policy. When we do, we will post the new version on this page and change the date at the top.

12. Contact

Doteli LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA — hi@meshnote.io.