Privacy Policy
Last updated: 2026-07-19
Privacy is a feature of meshcheck, not an afterthought. This policy states what we store, for how long, and who else processes it. The retention behavior below is a product commitment — stated here, repeated on the homepage and in llms.txt, and enforced in code.
What we keep, and for how long
These commitments match the ones on our homepage and never weaken them:
- Uploaded model bytes: deleted immediately after processing completes (success or failure). Never written to logs or backups.
- Reports (JSON): retained 30 days, then hard-deleted.
- Screenshots: stored 30 days, served only via signed URLs bound to report expiry.
We do not use your uploaded models, reports, or screenshots to train machine-learning models.
Account data
When you create an account we store:
- your email address;
- your plan;
- hashes of your API keys — keys are shown to you once at creation and stored only as a hash, so we cannot see or recover the key itself;
- your credit ledger — the record of credits granted and consumed that produces your balance.
The /inspect endpoint and third-party AI processing
The optional /inspect endpoint answers semantic questions about a model ("does this look like a barrel?"). It is the only part of meshcheck that sends your content to a third party, and it runs only when you call it.
When you call /inspect, we render images of your model and send those rendered images, server-side, to Anthropic's API to produce the answer. This processing is isolated to the/inspect endpoint — the deterministic validation and rendering endpoints never call a third-party AI service. Anthropic processes the images under its own terms as a service provider to us. If you do not want your model's rendered images sent to Anthropic, do not call/inspect.
Infrastructure and processors
We run meshcheck on third-party infrastructure that processes data on our behalf:
- Vercel — hosting, serverless functions, and blob storage (uploaded models and screenshots);
- Neon — the Postgres database holding accounts, API-key hashes, and the credit ledger;
- Polar — our merchant of record for payments and subscriptions (see below);
- Anthropic — the AI service behind
/inspect, used only when you call that endpoint.
The website itself loads no third-party fonts, scripts, or CDN resources — all page resources are served from our own origin.
Our hosting provider (Vercel) processes request logs — IP address, user agent, request path — to serve and secure the service. We also use a log-management and uptime-monitoring service that receives this same request metadata for reliability and abuse monitoring. We do not run browser analytics, ad trackers, or session recording on this site.
Payment and billing data
Payments are handled by Polar, our merchant of record. Polar is the seller of record on your card statement and collects the payment and billing details needed to process your purchase, calculate tax, and issue invoices; we do not receive or store your full card details. Polar makes your invoices available through its customer portal. Polar processes this data under its own privacy terms.
Your choices
You can delete your account by contacting us; deleting an account removes your account record on the schedule we operate for deletions, and any reports still within their retention window are swept as described above. You can also request a copy of the account data we hold about you. Depending on where you live, you may have legal rights to access, correct, export, or delete your personal data. We honor such requests regardless of location where reasonably possible — contact us at the address below and we will respond within 30 days.
Changes to this policy
We may update this policy. Material changes are posted here with a new "last updated" date, and we will not weaken the retention and deletion commitments above without saying so clearly.
Contact
Privacy questions or data requests: support@meshcheck.dev.