TZX MESH

PRIVACY

What we store, and what we never see

TZX Mesh exists so your traffic stays yours. This page says in plain words what the service handles, for the console at app.tzxmesh.com, the desktop and mobile apps, and this website. Last updated 15 September 2026.

The short version

  • Your traffic is end-to-end encrypted between your devices. WireGuard® keys live on your devices; the control plane never has them and cannot read your traffic.
  • No advertising, no trackers, no analytics scripts, no sale of data. Not on this site, not in the console, not in the apps.
  • We store the minimum a mesh needs to work — your account identity and metadata about your devices, listed below.

What the control plane stores

To coordinate your mesh, the control plane keeps:

  • Account: the email address and name from your sign-in, and password hashes when you use the built-in sign-in rather than your own identity provider.
  • Devices: device name, operating system and app version, WireGuard public key, assigned mesh address, the public address the device connects from, connection timestamps, and the approximate location the console derives from that address to label your device list.
  • Activity: an audit trail of account events — sign-ins, device approvals and removals, configuration changes — shown to your workspace admins in the console.

What passes through, without being readable

When two devices cannot reach each other directly, encrypted packets pass through a relay we operate. The relay forwards ciphertext; it has no keys and keeps no copy. Signalling servers exchange the connection offers devices use to find each other.

What the apps send

  • The desktop apps check tzxmesh.com/dl/version for updates — a plain version read; no identifier beyond the request's network address.
  • Diagnostic bundles leave a device only when you explicitly create one, and the flag that allows collection is off by default.
  • The mobile apps talk to your workspace's control plane and to nothing else.

Where and how long

Servers are hosted in Nuremberg, Germany. Device and account records live until you delete them or your workspace; encrypted backups rotate on a fourteen-day cycle. Delete a device in the console and its record, keys and addresses go with it.

This website

Static pages served through Cloudflare, whose edge keeps standard, short-lived request logs. The site sets no cookies and runs no analytics. Your theme choice stays in your browser.

Your rights and our door

Ask for a copy of what we hold about you, or ask us to delete it: [email protected]. We answer within thirty days. Operated by TECHZONEX L.L.C-FZ, Meydan Free Zone, Dubai, UAE.

If we ever need to change this page in a way that matters, the change lands here first and the date above moves.