Meshin Privacy Policy

Last updated 15 October 2026 · Version 1

In short

Meshin needs a server: players join from a link on any phone, the score is confirmed by the people who played, and ratings must stay anonymous. That server is ours, and every piece of data Meshin stores stays on it. It holds your account, your profile and card, your crews and matches, and, only if you add them, a photo and your district. Your photo is checked on our server before anyone sees it, and only people you play with can see it. Discover is off until you turn it on, and then shows your district, never your location. Nobody ever sees who rated whom. There are no ads, no analytics and no third-party SDKs. You can delete your account in the app or on the web, and your profile, photo and sign-in are deleted right away.

Meshin never handles money and has no betting of any kind.

1. Who is responsible

Meshin is made by Burak Özaslan at 1801 Labs, Maltepe, İstanbul, Türkiye, who is the data controller. Email: support@1801labs.com. For any privacy question or request, write to that address.

2. What this policy covers

This policy covers the Meshin app for iPhone and the Meshin player web app at meshin.1801labs.com, which players can use in any browser without installing anything. Both use the same account and the same server, so everything below applies to both unless a section says otherwise.

3. Your account

There are no passwords. In the iOS app you sign in with Apple or with a link we email to you; on the web, with an email link.

Sign in with Apple: we store the user identifier Apple gives us, the email address Apple shares (which can be a private relay address), and a token from Apple, encrypted, which we use to end Sign in with Apple for Meshin when you delete your account. We don't store the name Apple shares.
Email link: we store your email address. The link works once, for 15 minutes. We store only a one-way hash of its code, and delete that record a day after the link expires.
Sessions: for each sign-in we store a one-way hash of the session token, when it was created and last used, and the kind of device ("iPhone" or "web").

In the iOS app you can link more than one sign-in method in Sign-in methods, so you always land in the same account.

4. What our server stores

Your profile: the nickname that goes on your card, your real name if you add it, your year of birth, your country and language, your positions, preferred foot and shirt number.
Your card: your rating, tier, matches, goals, assists, MVPs, wins and recent form, worked out by the server from confirmed matches.
Your crews: the crews and teams you belong to, your role (organiser, coach or player) and shirt number in each. For organisers and coaches, the private captain ratings they give players for balancing. For organisers, how often each player didn't show up or cancelled late.
Players without the app: an organiser can add a player by nickname and positions. That person can take over those matches later with a link from the organiser.
Your matches: date, time and time zone, the pitch, format, capacity and price per head, who is in, out or on the waitlist, the teams, who played, who has paid, the score, goals and assists, the score confirmations, MVP votes and invites.
Ratings you give (section 10).
Your photo, if you add one (section 8).
Discover, if you turn it on: whether you're looking for a game, your district area, your district name and when you can play (section 9).
Payment details, if you're an organiser and add them: the kind (IBAN, Pix, alias or CVU, PayPal, Revolut, Bizum or a payment link) and the details, encrypted, so players in your matches can copy them and pay you from their own bank or app.
Safety records: people you block and reports you send (section 7).
Your devices: the push notification tokens Apple gives the iOS app, with their language, so we can send you notifications.
Group Pro, if an organiser buys it: for that crew, the product, when it expires and Apple's original transaction ID. The crew's identifier is passed to Apple with the purchase, so the subscription is matched to the right crew. We also keep the notices Apple sends about it.
Technical data: to limit abuse, the server keeps short-lived counters by account, by IP address and by a hash of the email address, for up to a day.

5. What Meshin never collects

No exact location. Discover uses a district-sized area (section 9).
No contacts and no phone numbers.
No messages: Meshin has no chat. Players talk wherever they already do, and share Meshin links there.
No payment card or bank data of yours. Meshin never holds, moves or processes money between players.
No health data and no advertising identifier.
No analytics, advertising or tracking SDKs, no tracking cookies, and no tracking across apps or websites.
We never sell or share personal data, use it for advertising, or make decisions about you with legal or similarly significant effects by automated means.

6. Why we use it

To run your crews and matches: who's in, the waitlist, the teams, the score, the money owed and the match history.
To keep the score honest: a score counts only when more than half of the registered players who played confirm it within 48 hours.
To keep your card: ratings and stats from confirmed matches.
To show your photo to the people you play with, after it has been checked.
To let crews nearby find you, only if you turn on Discover.
To send you sign-in links and notifications.
To keep Group Pro on for a crew while its subscription is active.
To keep Meshin safe: check photos, handle reports and blocks, prevent abuse and keep the server secure.

7. What other people see

Anyone with a match link, even signed out, sees the crew's name, the organiser's nickname, the date, time, pitch and format, and how many players are in. No other names.
Players in your crews, teams, leagues and matches see your nickname, positions, shirt number, your card (the number appears after 3 rated matches; before that it says "New"), your photo once it's approved, whether you're in, out or on the waitlist, the teams, the score, goals and the MVP.
Organisers and coaches also see who didn't play and who has paid (you see your own), and the crew's private captain ratings, which nobody else sees. Only the organiser sees no-show and late-cancel counts.
Players in matches you organise see your payment details, so they can pay you.
In Discover, if you turn it on, players who use Discover nearby see your nickname, positions, a tier band (New, Bronze, Silver, Gold or Elite), your district name and when you can play. They don't see your photo or your card number. Organisers and coaches among them can invite you to a match; nothing changes until you accept.
Nobody else sees your email address, real name, year of birth or country, and nobody, ever, sees the ratings you gave or received.

Block: when you block someone, you won't see each other in Discover, invites or photos. You can unblock them in Blocked.

Reports: you can report a player's photo. A reported photo is hidden at once until we review it. To report a person or a name, write to support@1801labs.com. We review every report and remove content that breaks our terms.

In the iOS app, share images (the teams, a result, your card) are made on your phone. What you share, and where, is up to you.

8. Photos

A card photo is optional. Before it uploads, Meshin tells you how it is stored and who can see it, and asks for your consent.

The photo is re-encoded as a square JPEG and its metadata, including location data, is removed.
It is stored on our own server, encrypted at rest.
Before anyone else sees it, it is checked on that server: automatically, by an image classifier for sexual content that runs on our server, and by us where the classifier can't decide. Photos are never sent to an outside moderation service. A photo that doesn't pass is deleted.
Only people who share a crew, team, match or league with you can see it, and never someone you have blocked or who has blocked you. They get it through a link that stops working after 10 minutes.
You can change or remove it at any time with Change photo or Remove photo. A removed or replaced photo is deleted from our server.

9. Discover and your district

Discover is off until you turn it on. When you tap Find my district, the iOS app asks for permission to use your location while you use the app, takes one low-accuracy reading, turns it into an area of about 5 km on your phone, and asks Apple's map service for the name of the town or district. On the web, your browser gives a low-accuracy location to the page (your browser may use its own location service for this), the page works out the same area in the browser, and you type the district name yourself. Only the area code and the district name reach our server, never your coordinates. We never show the area code to anyone; other players see only the district name.

You can turn off Looking for a game at any time. Your district stays saved until you change it or delete your account.

10. Ratings

After a match whose score is confirmed, the players who played can rate each other from 0 to 100, within 48 hours. Rating is optional.

Ratings are stored with the match, the person who rated and the person rated, so each player can rate once per match.
No screen, link or export shows who gave which rating, to anyone. Only the server's card process reads them; the part of the server that answers the app can store ratings but can't read them.
With 5 or more ratings, the highest and the lowest are dropped. A card moves by at most 5 points per match. Your data export shows your card, never rating values.

11. Notifications and email

The iOS app sends push notifications when the teams are out, a score is in or confirmed, you move up from the waitlist, your card gets its first number, moves up a tier or you're voted MVP, or someone invites you to a match. They are sent from our server through Apple's Push Notification service, which delivers them and processes their text (for example, your crew's name or a nickname) to do so. You can turn them off in iOS Settings.

We send email only for sign-in and linking links, through an email delivery provider (section 13). The web app doesn't send notifications.

12. Cookies on the web app

The player web app uses only the cookies it needs to work. There are no analytics, advertising or third-party cookies.

Sign-in cookie: keeps you signed in. Not readable by scripts. 15 minutes.
Renewal cookie: renews your sign-in. Not readable by scripts. 60 days.
Security cookie: protects your actions from requests made by other websites. 60 days.
Language cookie: remembers the language you choose. 1 year.
Return cookie: remembers the page to return to after you sign in. 30 minutes.

Because these cookies are strictly necessary, the web app doesn't ask for cookie consent. Signing out deletes the sign-in cookies.

13. Who else processes data

DigitalOcean hosts our server in Frankfurt, Germany. The database, the photos and their backups stay on servers we run there.
Cloudflare handles DNS and the encrypted connection (TLS) for meshin.1801labs.com, so it processes your IP address and the requests in transit. It stores none of your Meshin data.
Apple provides Sign in with Apple, delivers notifications (section 11), handles purchases (section 14), and names your district from an approximate location in the iOS app (section 9), each under Apple's privacy policy.
An email delivery provider (to be named here before launch) delivers sign-in emails. It processes your email address and the email it sends.

No one else receives your data.

14. Purchases

Group Pro is bought in the iOS app through the App Store with StoreKit. Apple handles payment; we never see your payment details or your Apple Account. Apple sends our server signed notices about the subscription (for example, renewals and refunds), which we use only to keep Group Pro on or off for that crew. The web app doesn't sell anything.

15. How long we keep data

Your account, profile, card, crews, settings and discovery: until you delete your account.
Match history (who played, scores, goals, votes and invites): kept as part of the history of the crews and matches you played in. When you delete your account, it is no longer linked to your name, email or photo (section 16).
Email link records: deleted a day after the link expires.
Sign-in sessions: they expire after 60 days without use, or when you sign out; their records are deleted with your account.
Push tokens: until you sign out, Apple reports them as no longer valid, or you delete your account.
Photos: until you remove or replace them, or delete your account. A photo that doesn't pass the check is deleted at once.
Reports and blocks: blocks until you unblock; reports are kept as a record of our review.
Backups: the server makes an encrypted backup of the database and approved photos every night and deletes each one after 14 days. After you delete your account or a photo, it is gone from the backups within 14 days.
Abuse counters: up to a day. Technical logs, which may include IP addresses, are kept briefly for security and rotated automatically.
Emails you send us: as long as needed to answer you.

16. Deleting your account

In the app or on the web: You → Settings → Delete account, then confirm. Right away, we delete your profile, photo, sign-in methods, sessions, push tokens, Discover settings and payment details, and end Sign in with Apple for Meshin. In past matches and crews you show as "former player"; the records of those matches stay for the other players, without your name. Ratings you gave stay anonymous, and changes they already made to other players' cards stay.

If you organise a crew with Group Pro, the subscription stays with Apple: cancel it first in your Apple Account settings. Deleting the app alone doesn't delete your account.

You can download a copy of your data at any time with Download my data.

17. Legal bases

Under the GDPR, we use your data to provide the service you asked for, Art. 6(1)(b). Your photo and Discover are based on your consent, Art. 6(1)(a); you can withdraw it at any time by removing the photo or turning off Discover. Checking photos, handling reports and blocks, preventing abuse, keeping the server secure and keeping match history for the other players after you leave are our legitimate interests, Art. 6(1)(f). Under the Turkish data protection law (KVKK), we process your data to perform our contract with you, for our legitimate interests, and, for your photo and Discover, with your explicit consent.

18. International transfers

Our server is in Germany, in the European Union. We are based in Türkiye, so storing your data there is a transfer abroad under the KVKK, which you agree to by using Meshin. Apple, Cloudflare and our email delivery provider may process data in other countries, including the United States, under their own safeguards, such as the EU Standard Contractual Clauses.

19. Security

Connections are encrypted (TLS). Session tokens and email link codes are stored only as hashes. Payment details and Apple tokens are encrypted in the database, and photos are encrypted at rest. The database can't be reached from the internet, and the part of the server that answers the app has no right to read ratings. Backups are encrypted. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

20. Your rights

Depending on where you live, including under the GDPR (EU and UK), the KVKK, Brazil's LGPD, Argentina's data protection law and US state privacy laws, you have the right to access, correct, delete and receive a copy of your personal data, to object to or restrict processing, to withdraw consent at any time, and to complain to a data protection authority. You can change your profile, download your data and delete your account in the app or on the web. For anything else, write to support@1801labs.com; we answer within one month.

21. Age

Meshin is for people aged 16 and over. When you set up your profile, we ask for your year of birth; if you are under 16, the account is deleted right away. If you think someone under 16 has an account, write to us and we will delete it.

22. This website

1801labs.com, where this policy lives, sets no cookies, runs no analytics and loads nothing from third parties. It is served by Cloudflare, which processes your IP address and technical request data to deliver the page and protect it from abuse.

23. Changes to this policy

If this policy changes, we will update this page and the date above. If a change is significant, we will also tell you in the app before it applies.

24. Contact

Burak Özaslan, 1801 Labs, Maltepe, İstanbul, Türkiye. support@1801labs.com.