← MESH

MESH Privacy Policy

Last updated: October 23, 2026

MESH ("we", "us") is an artist-workspace service operated by MESH Music Ltd. (Quebec, Canada) and available at app.meshformusic.com and through our mobile and desktop apps. This policy explains what we collect, why, and what we do with it.

What we collect

Account information. Your email address (used to sign you in and to send you sign-in codes and invitations) and a display name if you set one. We use passwordless sign-in, so we never store a password you chose. When you create an account you also give your date of birth (to confirm that you are 18 or older; we keep the date), your country, and, if you choose, what best describes you and whether you want product news by email; we also record which version of the terms you agreed to.

Content you add. Everything you put into the artists you belong to: songs, recordings, releases and credits, lyrics, tabs and song structures, rights splits, shows and events, to-dos and the comments on them, finances and receipts, files you upload, links, and the band's roster and gear. This is your data; we store it to show it back to you and to the people you share an artist with.

The roster. Every artist has a roster of the people in its world, on MESH or not, entered by its members. A roster entry holds a name (or, once the person has an account, that account's display name), the roles they play for the band, and whatever else the band adds: an email address, other names they go by, a colour, a picture, notes. When someone is invited, the entry also records the access offered and who invited them, and the invitation goes to the address on it. The roster is the band's address book: every member of that artist can see it. Owners, admins and editors can see roster email addresses. Viewers can see their own address, but do not receive other people's roster email addresses through the app or its API.

Catalogue and audience data. When an artist is linked to its streaming profiles, we retrieve facts about that artist's catalogue (releases, dates, identifiers, credits) and audience statistics from Soundcharts and public music-platform endpoints (such as Spotify's and Deezer's public APIs) and store them with the artist, marked as coming from there. This is data about the artist's public presence, not about you personally.

Technical basics. Our hosting providers keep standard server logs (IP address, request time, user agent) for security and operations. We do not run advertising trackers, third-party analytics scripts, or sell data to anyone.

The waitlist. If you ask on meshformusic.com to be emailed when sign-ups open, we keep your email address, the time you asked, the exact wording you agreed to, the page's language, a keyed hash of your IP address and your browser type (the form's limit on abuse, and the record of your consent; the address itself is not stored), and whether and when you confirmed. We send one email to confirm the address; an address not confirmed within 30 days is deleted. A confirmed address receives the announcement that sign-ups are open and, at most, the occasional update about the launch, each with an unsubscribe link, and nothing else. When you unsubscribe, the address is kept only on the list of addresses we must not email. The waitlist is deleted no later than twelve months after public sign-up opens.

What we do NOT collect

No precise location, no contacts from your device, no advertising identifiers, no tracking across other apps or websites. The mobile app requests no device permissions beyond what displaying the app requires.

No AI or automated decisions

MESH uses no artificial intelligence, machine learning or automated decision-making on your data, and sends none of it to AI services. MESH does no profiling. The only things MESH does automatically are the rules set out in the Terms of Service and in this policy, applied the same way to everyone: a trial ends when its 30 days are up, bands made during a trial that was not converted are deleted after their retention period, anything in the trash is erased 30 days after it was trashed, and an artist can be shared with at most ten people besides its owner. The figures on a receipt in Files (merchant, date, total and currency) are typed by you; MESH does not read them out of the document.

Browser storage

MESH stores a few preferences on your device, in your browser's local storage: your theme, your chosen font, and view choices such as your last selected artist. Your sign-in session is also kept in local storage by Supabase Auth, the authentication service we use; it is not a cookie. MESH sets no advertising or analytics cookies and runs no third-party tracking scripts. MESH's own fonts are served by MESH. If you choose a custom font in Settings, that font is loaded from Google Fonts, which sends your IP address to Google; the default fonts are never loaded this way.

Who processes it for us

We use a small set of infrastructure providers to run MESH, each processing data only on our instructions:

If you choose a Google font in Settings, Google receives your IP address and browser details when the font loads, under Google's own privacy terms; MESH's own fonts are served by MESH and send nothing to Google.

International data transfers

MESH's infrastructure providers store and process data in the United States: Supabase's database and file storage run in AWS us-west-2 (Oregon), and Vercel, Stripe, Resend and Google (the mail sent to our role addresses) also process data there. Your data may also be processed in other countries where these providers operate. These transfers rely on our providers' own contractual safeguards; email privacy@meshformusic.com for details.

How sharing inside MESH works

Artists are shared with the specific people you invite, at the access level you give them (owner, admin, editor, or viewer). Members of the same artist share its roster: each other's names and roles. Roster email addresses are available to owners, admins and editors; viewers receive only their own. Access is enforced at the database layer, not just in the interface.

Retention and deletion

Your content stays with the artist it belongs to until you delete it or ask us to. What you delete goes to that artist's trash, where a member can put it back or delete it for good; deleting for good erases it at once, and the band's history keeps no copy of it. To delete your account, use Delete my account in Settings, under Your data: it signs you out everywhere and ends any paid plan at once, and MESH keeps the account for 30 days, so you can sign in and keep it; then it erases your login and what is yours alone, and each band keeps its own records. An account MESH staff remove is kept the same 30 days before it is erased. Download my data, in the same place, saves a copy of what MESH holds about you first. You can also email privacy@meshformusic.com and we will remove your account within 30 days. Backups are kept for a limited time: our database provider keeps its own daily backups for seven days, and we delete our own copies within 35 days of taking them.

Anything in an artist's trash is erased for good 30 days after it was deleted, with its stored files, and the band's history keeps no copy of it. A date skipped from a recurring series stays in the trash while its series exists, because it is what keeps the series from making that date again, and is erased with the series.

When MESH staff act on an account (adding an address to the access list, or granting or changing a plan), a record of the action, naming that address, is kept for one year and then erased. When the account is deleted, the address in those records is replaced with the account's internal id.

Your rights

You can download your data and delete your account yourself in Settings, under Your data. You can ask us what we hold about you, ask us to correct it, or ask us to delete it: email privacy@meshformusic.com. If you are in a jurisdiction with statutory data-protection rights (such as Québec's Law 25, GDPR or PIPEDA), those rights apply and we will honour them.

Children

MESH is not intended for anyone under 18 and we do not knowingly collect their personal information. A parent or guardian who believes a child under 18 has an account can write to privacy@meshformusic.com and it will be removed.

Changes

If this policy changes materially we will note it in the app and update the date above.

Contact

MESH Music Ltd., Montréal QC, Canada

The person in charge of the protection of personal information at MESH is our Privacy Officer, reachable at privacy@meshformusic.com.

privacy@meshformusic.com