Privacy
Last updated 25 October 2026
meshgg lets a person share the GPU of their PC so friends can play their game library through Moonlight. The control plane (accounts, permissions, pairing and signaling) runs on meshgg.com; the game stream itself travels directly between the host's PC and the player's device and never passes through our servers.
What we store
| Data | What and why | Kept |
|---|---|---|
| Account | Email, display name and avatar URL as given by the identity provider you sign in with (Pocket ID, Steam, Discord or Google), plus the provider's user identifier so we can recognise you next time. | Until you delete your account. |
| Steam profile | Your SteamID, public persona name and avatar URL, fetched once per Steam login from Steam's public profile or Web API. We never see your Steam password or your Steam library. | Until you delete your account. |
| Hosts | Name, GPU model, agent version, LAN address, the public address the agent connects from, the public hostname label and whether Moonlight ports answer from the internet. | Until the host is removed. |
| Game catalog | Titles, store identifiers and install paths of games installed on a host, as scanned by the host's agent. Owned by the host owner. | Until the host is removed or the game uninstalled. |
| Sharing | Who may play on which host (grants and invites). | Until revoked or expired; invites expire after 7 days by default. |
| Moonlight devices | The identifier and IP address of each Moonlight client paired through meshgg, linked to the account that confirmed the PIN. | Until unpaired. |
| Sessions | When you played on which host, the network path (LAN, direct, P2P tunnel or relay), the connection preset and coarse stream statistics (resolution, frame rate, bitrate, GPU load). | 90 days. |
| Audit log | Security-relevant events on a host: sessions, pairings, grants, tunnel tickets, with the acting account and timestamp. Visible to the host owner. | 90 days. |
| Tunnel tickets | Short-lived tokens and WireGuard public keys exchanged to open a P2P tunnel. Private keys never leave your device or the host. | Minutes to hours; deleted when the tunnel closes. |
| Password accounts | For self-hosted deployments that enable email/password login: a bcrypt hash of the password. Never the password itself. | Until the account is removed. |
What we never store
- Video, audio or input of a game session. The stream goes from the host to the player, or through a TURN relay that forwards encrypted packets without decoding them.
- Passwords of Steam, Epic, Discord, Google or Pocket ID. Sign-in happens on the provider's site.
- Game files or save games. They stay on the host's PC.
- Private keys of the P2P tunnel. Each end generates its own and shares only the public half.
Where it lives
Data is stored on servers operated by meshgg in the European Union. Sign-in uses the provider you choose; what they do with your login is covered by their own policies. Steam data is used under the Steam Web API Terms of Use and is only fetched when you sign in with Steam.
Who sees what
- A host owner sees who is playing on their host, the device they paired, their session history there and the host audit log.
- A guest sees the hosts they were granted, the installed games and the live GPU load of those hosts.
- Administrators of this deployment can see every host to operate the service.
- We do not sell or share data with third parties, and we do not use it for advertising or unsolicited messages.
Cookies
One session cookie keeps you signed in and one short-lived cookie protects the sign-in redirect. No analytics or advertising cookies.
Your choices
- Unpair a device, revoke a grant or remove a host at any time from the dashboard; the change reaches the host within seconds.
- Ask us to export or delete your account and everything linked to it by writing to [email protected].