Privacy Policy

Effective Date: July 29, 2026
Last Updated: November 3, 2026
Publisher: Total Overwatch Productions (“we”, “us”, or “our”)
Application: MeshFlow (com.meshflow.app)
Contact Email: info@totaloverwatchproductions.com
Website: https://totaloverwatchproductions.com

1. Overview & Core Philosophy

MeshFlow is a video orchestration platform designed for tactical Mobile Ad-hoc Networks (MANET) using B.A.T.M.A.N.-adv and decentralized peer-to-peer (P2P) WebRTC overlays.

Our privacy policy is simple and transparent: MeshFlow is built with an offline-first, local-mesh architecture. Your video streams, screen captures, and audio travel over your local mesh network or over direct peer-to-peer connections — never through our servers. We do not sell, track, or harvest your video feeds.

Two things do reach us, and §4 describes both in full.

Peer discovery. When the device has internet access, MeshFlow contacts our signaling service so peers can find each other. It carries the encrypted messages two peers need to negotiate a connection; it never carries your media.

Connection performance metrics. While you are using our servers to find peers, MeshFlow reports how each connection went — how long it took to connect, whether it succeeded, and why it failed when it didn’t — so that we can make connections work better. On our service we do not record who you connected to: not the other person, not the network you joined, not where either of you were.

If your organization runs MeshFlow on its own infrastructure, that deployment is under its control and may be configured to keep fuller records — see §4.1.

2. Information Handled & Permissions Requested

To provide real-time video broadcasting and mesh discovery, MeshFlow requests access to specific device hardware features. All data processed by these features remains under your local control:

A. Camera & Microphone (CAMERA, RECORD_AUDIO)

• Purpose: Enables live video and audio capture from your device’s front or rear camera to broadcast to other authorized nodes on your local mesh network or P2P session.
• Storage & Transmission: Streams are encoded in real time and transmitted directly to connected mesh nodes or P2P peers via RTSP/WebRTC. No camera footage is recorded to external cloud servers without your explicit action.

B. Screen Recording & Foreground Service (FOREGROUND_SERVICE_MEDIA_PROJECTION, FOREGROUND_SERVICE_MICROPHONE)

• Purpose: Allows operators to broadcast their device screen (maps, tactical feeds, or diagnostic apps) to authorized mesh participants.
• Scope: Screen capture runs as an active, visible Foreground Service with an ongoing notification. Capture begins only when you explicitly tap Start Screen Share and ends when you tap Stop.
• On Android, your microphone is part of a screen share. When you share your screen on Android, MeshFlow also sends your microphone, so the people watching can hear you explain what is on it. MeshFlow asks for microphone permission when you start the share; if you decline, the share continues as video only and the Screen Share page says so.
  • Only while you share, only to your viewers. Your voice is sent only while the share is running, and only to the people watching that share: directly, through another MeshFlow device or mesh node that passes the share on to its viewers, or through a TURN relay when a firewall blocks a direct path. It keeps going while you switch to the app you are sharing — that is why the screen-share service also carries the microphone type — and it stops when you tap Stop.
  • You can mute it at any time with the Mute Mic button on the Screen Share page. While muted, your viewers receive silence.
  • We do not record or store it. Your voice never passes through our signaling service, and our TURN relay only passes the stream along to your viewers; it keeps no copy. MeshFlow does not save the audio on your device, and the mesh node software we provide is not configured to record streams. An organization that runs its own nodes (§4.1) decides how those nodes are configured.
  • iPhone: a screen share on iPhone sends your screen only, not your microphone.

C. Bluetooth & Nearby Device Access (BLUETOOTH_SCAN, BLUETOOTH_CONNECT)

• Purpose: Enables discovery, pairing, and control of tactical action cameras (e.g. GoPro devices) over local Bluetooth Low Energy (BLE) channels.

D. Fine Location (ACCESS_FINE_LOCATION)

• Purpose:
  1. Required by the Android operating system to perform local Wi-Fi and Bluetooth Low Energy scans.
  2. Optional stream geotagging to display node positions on the tactical MeshFlow map view.
• Control: Location sharing can be toggled off at any time in the app Settings tab.

3. Data Storage & Security

• Local Entitlements & Licenses: Pro license status and subscription receipts are stored locally on your device using encrypted storage (SecureStore / AsyncStorage). Once verified, licensing works 100% offline without requiring connection to external servers.
• Encryption: Peer-to-peer media streams are protected by WebRTC DTLS-SRTP, and underlying HaLow and Wi-Fi mesh links use WPA3/SAE. Signaling payloads exchanged through our cloud service are additionally encrypted with AES-256-GCM under a key derived from your network password (PBKDF2-HMAC-SHA256), so the service that routes them cannot read them.

4. Third-Party Services & Analytics

MeshFlow contains no third-party ad networks, social media trackers, analytics SDKs, or data brokers. It uses exactly the following infrastructure endpoints:

• Google Play Store / Apple App Store: Handles subscription billing and in-app purchase verification through standard store APIs (react-native-iap).
• AWS Cloud Infrastructure (peer discovery): When the device has internet access, MeshFlow connects to our signaling service (wss://) automatically on launch so that peers can find each other and exchange the handshake needed to open a direct connection. This is how discovery works with no setup, and it is not currently something you turn off in the app; a device with no internet path simply operates on its local mesh instead.
  • What that connection carries: a per-session peer identifier assigned by the server; the network identifier you joined — a one-way HMAC of your network name computed under your network password, so we never receive the name or the password themselves; a small amount of routing metadata (whether the device can see a local mesh, and how many relay slots it offers); and the encrypted signaling messages peers exchange to negotiate a connection. Your callsign, your stream’s details, and any location you have chosen to share travel inside that encrypted payload, addressed to your peers and not readable by us.
  • What it does not carry: your video or audio. Media never traverses our signaling service. It flows directly between peers, or through a TURN relay when a firewall or carrier-grade NAT blocks a direct path — and a relay forwards the encrypted stream without being able to decrypt it.
• AWS Cloud Infrastructure (connection performance metrics): When your device is using our servers to find peers, MeshFlow reports a short summary of how each connection went, over that same signaling connection. Its only purpose is making connections succeed more often and connect faster — during the alpha this is how we find and fix the cases that fail in the field but not on our test benches.
  • What is included: whether the connection succeeded; if it failed, which of a fixed list of reasons applies; how many milliseconds it took to reach each stage; counts of the network addresses your device produced and received; whether a relay was needed and which kind of network path carried the video; and video quality figures — frame rate, bitrate, packet loss, round-trip time. Plus your app version, platform, and major OS version, so we can tell whether a problem is specific to one of them.
  • What is excluded, deliberately: who you connected to. No peer identifiers, no network identifier (not even the one-way hash — it would still tell us which team a device belongs to), no stream or channel names, no callsigns, no location, and no network addresses. Your device’s own IP addresses appear inside the technical details of a connection, and those details are never sent — we send only counts and the type of path used. We also send no clock times, so these reports cannot be lined up against each other to reconstruct your activity.
  • Session grouping: each app launch generates a random, throwaway identifier so the connections from one session can be counted together (“one of this session’s two connections failed”). It is not stored, not derived from your device, and changes every time you open the app, so it cannot be used to recognise you or link one session to another.
  • In short: on our service we measure the quality of the road, not where you drove.
  • Scope — this describes the public MeshFlow service that we operate. Organizations can also run MeshFlow on their own private infrastructure (§4.1). Those deployments are configured by the organization that runs them, and some — public safety and defense operators in particular — are required to keep detailed connection and mission audit records. In that case the organization decides what is recorded and is responsible for it; this policy does not govern their systems, and we do not receive that data.
• AWS Cloud Infrastructure (support): Support ticketing, when you submit a request from Settings.

4.1 Private and organization-operated deployments

Everything above describes the public MeshFlow service that we operate, which is what you are using unless your organization has told you otherwise.

MeshFlow can also be deployed onto an organization’s own infrastructure, or run entirely on a local mesh with no internet path at all. In those configurations:

• The organization operating it decides what is recorded, and is responsible for it. Some are obliged to record a great deal — public safety, defense and critical-infrastructure operators frequently have legal or operational requirements to retain detailed connection and mission audit records, including who communicated with whom and when. MeshFlow supports that, because for those users it is a requirement rather than a preference.
• This policy does not govern those systems. Your organization’s own policy does. If you are using MeshFlow through an employer or agency, ask them what their deployment records.
• We do not receive that data. A deployment on someone else’s infrastructure reports to them, not to us.
• A fully local or air-gapped deployment sends nothing anywhere, including to us — there is no path for it to do so. This is a property you can verify by blocking egress and confirming the system still works.

4.2 The MeshFlow TAK server (Connect ATAK)

This section applies only if you tap Connect ATAK to use our TAK server. If you never do, none of it applies to you.

ATAK and other TAK apps share positions, markers and chat through a server. When you connect to ours, it works the way any TAK server does: our server can read what your TAK app sends through it, because it has to route that traffic to the other people on your network. That is different from the rest of MeshFlow, where your video and signaling stay end-to-end encrypted and we cannot read them.

• When you tap Connect ATAK: your phone sends us a short request to get a certificate for ATAK.

  • The request carries a key derived from your network password. It lets us confirm you belong to that network, and it cannot decrypt your MeshFlow traffic.
  • It also carries a signature from your install’s own key.
  • We never receive your network name or password.
  • The certificate we issue names your install by a code derived from that install’s key, and names your network’s group on the server by a one-way code. It does not contain your callsign, name or phone number.

• What our server sees while ATAK is connected: everything your TAK app sends it: your position and callsign, the markers and routes you share, and your chat messages. It relays them to the other TAK users on your network only; users of other networks never see them.

• What it keeps, and for how long:

  • Positions: the latest position of each connected user is held in memory only, so someone who joins late sees where everyone is. Nothing is written to disk. Each position is dropped when it goes stale, when you disconnect, or when the server restarts.
  • Chat messages and markers: relayed and not stored. Only the latest position of each marker is held, in memory, for the same reason as positions.
  • Files (data packages): files you share from ATAK are stored in our cloud storage (Amazon S3) and deleted automatically after 72 hours. The person who shared a file can delete it, and our record of it, before the 72 hours are up. Only users on your network can list or download them. Files that could reconfigure or install software on someone else’s phone are refused. So that shared files survive a restart of our server, it also keeps a record of each file on its own disk (the file’s name, the code that names your install in its certificate, your ATAK’s device ID, your network’s group code, a fingerprint of the file’s contents and whether it was marked private; never the file itself), and deletes that record when the file expires (it checks every 10 minutes).

• Connecting ATAK to your MeshFlow network: for some networks our server also passes map traffic between the TAK server and the MeshFlow app itself, so TAK users and MeshFlow users see each other. Today that is only our own test network. For those networks our server holds that network’s key and can read its map traffic, the same as above. We will say here before any other network is added.

• What we log:

  • when our TAK service starts and stops;
  • when our server’s own link connects or drops;
  • the network address of anyone who tries to connect to that link without the right certificate;
  • for the networks we pass through to MeshFlow, the type of each relayed item (for example “position” or “chat”).

  Logs never contain positions, callsigns, message text, device identifiers or file contents. Logs held in our cloud are kept for 30 days.

• Turning it off: remove the MeshFlow server from ATAK, or simply never tap Connect ATAK. Nothing about the TAK server runs unless you do.

4.3 Go Live (sending a stream to YouTube or another service)

This section applies only if you use Go Live. If you never do, none of it applies to you.

• Where the stream goes: when you go live, your phone sends that video and audio directly to the streaming service you chose, under that service’s own terms. The stream does not pass through our servers.
• Stream keys: kept in your phone’s secure storage and never sent to us. A key goes only to the service you chose, when you go live. Check only tests the connection and does not send the key.
• Going live with a teammate’s feed: tells that teammate and your network’s chat your callsign and the service’s name (for example “TALON 7 is sending TALON 6’s camera live to YouTube”). A server you added yourself is shown only as “RTMP”, never by its address or your name for it. These notices travel encrypted between the phones of your network.
• The teammate’s feed itself reaches your phone the way any feed you watch does (§4): directly, or through our TURN relay when a direct path is blocked, encrypted so the relay cannot see it.

4.4 Our website (analytics)

This section is about our website, not the MeshFlow app.

Our website (totaloverwatchproductions.com) counts page views and clicks on links to Amazon, Google Play and the MeshFlow web app (/app), using GoatCounter, an open-source, privacy-focused analytics service (goatcounter.com). For each view or click it records the page, the referring site, the browser and operating system, screen size, language, and an approximate country. GoatCounter sets no cookies, does not store your IP address, and does not build a profile of you or track you across other websites. Repeat visits are recognised only in memory for up to 8 hours, then forgotten; data is stored in the EU (Finland and Germany). We use these counts only to see which pages people find useful. The MeshFlow app itself does not include this analytics.

5. Data Retention & User Controls

• Zero Cloud Retention: Video streams and screen recordings are transient live feeds and are not retained on our servers.
• Revoking Permissions: You can grant or revoke camera, microphone, location, or screen recording permissions at any time via your device’s native OS Settings (Settings -> Apps -> MeshFlow -> Permissions).

6. Children’s Privacy

MeshFlow is intended for professional, industrial, tactical, and field operators. MeshFlow does not knowingly collect or solicit personal information from children under the age of 13.

7. Changes to This Privacy Policy

We may update our Privacy Policy periodically to reflect app updates or legal requirements. Any changes will be published at https://totaloverwatchproductions.com/privacy.

8. Contact Us

If you have any questions or concerns regarding this Privacy Policy or MeshFlow’s privacy practices, please contact us at:

Total Overwatch Productions
Email: info@totaloverwatchproductions.com
Website: https://totaloverwatchproductions.com