ForkMesh Privacy

What is public

Your node name, public identity key, explicitly public repositories, chosen profile fields, public issue and pull-request records, generalized presence, and any self-custodial payout address you publish may be visible to other users or visitors. Approximate IP-derived country is shown only as a flag or general region; raw IP addresses and precise location are never public.

What is stored

ForkMesh stores bounded account records, encrypted private profile fields, repository catalog and blind-index metadata, generalized presence, pending verification records, and minimized operational/security logs. Room frames marked for persistence are retained for up to 7 days, with at most 500 replayable frames per room. Default room keys are derived and distributed by the relay, so its operator can decrypt that history; default rooms are not end-to-end encrypted. Private repository names reach the Worker on authenticated control-plane requests and are encrypted at rest under the instance data key. Private repository content and new private-agent payloads use separate client-side owner-sealed boundaries; platform administrators do not automatically receive those recipient private keys. An upgraded deployment cannot report its D1-backed API ready while any historical wallet key remains: the explicit offline process must first export recoverable keys, reconcile every public address at zero, scrub the key fields, and leave only key-free public reconciliation evidence.

Install diagnostics

The desktop installer reports anonymous, aggregate diagnostics about each install — which step it reached, whether that step succeeded, and coarse platform facts. Each run uses a fresh random id that is never linked to your account, email, node name, or IP address. Opt out by setting FORKMESH_NO_DIAG=1 before running the installer.

Documentation feedback

If you use a documentation helpfulness control, ForkMesh stores the like/dislike choice, a generalized /docs/ section anchor, an optional message you deliberately submit, a broad client category, and a keyed network token used for abuse control. It does not retain the raw IP, browser user-agent, query string, search value, or a repository path in that record.

Wallets and community rewards

Joining ForkMesh does not require a payment. Solana transactions and public addresses are visible on the configured network. For community members, ForkMesh stores only a payout address you choose to publish; payout- and contribution-wallet private keys, seed phrases, mnemonics, and transaction approval remain on your device. Separately, the first instance operator may keep the community-pool signer encrypted in that operator’s local Qt client. Direct contributions go from the contributor’s wallet to the displayed public community-pool address. Pending reward allocations are ledger reservations, not custodial balances, and expire after 24 hours if the recipient does not provide a self-custodial address.

Third parties

We try our best not to use third parties. Today, these are involved:

• Cloudflare hosts the public website, Worker APIs, D1 data, cache, and relay infrastructure.
• PostHog product analytics is disabled by default. If you explicitly enable it below, ForkMesh loads it through b.forkmesh.com and sends one coarse page-category event. It does not send raw paths, query strings, referrers, clicks, form values, element text, account identifiers, or repository identifiers; it disables recording, automatic capture, person profiles, and persistent analytics storage.
• An instance operator may configure Sentry for server-error reporting. ForkMesh then sends a generalized/redacted route, method, status, service host, Cloudflare incident id and coarse edge colo, transport versions, and code stack location. The structured request envelope excludes raw IPs, country, timezone, browser/OS user-agent, cookies, authorization, and query strings; private-repository routes replace both identity and error detail with a fixed redaction.
• A configured Solana JSON-RPC endpoint is queried for public pool balances and finalized transaction verification.
• Bundled open-source font files are served locally by ForkMesh; no remote font service is used.
• Tailwind Play CDN is loaded by the current home page.
• The Solana network processes payment transactions.
• Git remotes you choose may receive network requests when you mirror or sync repositories.

Your choices

You can hide or generalize country, browser, operating system, activity, local time, device, and inactivity status where those controls are available; avoid optional profile fields and payout addresses; restrict private repositories to their owner and explicitly authorized collaborators; stop presence or the desktop node; operate your own mirror; disable optional analytics below; or skip install diagnostics with FORKMESH_NO_DIAG=1. Public blockchain transactions cannot be made private by ForkMesh after they are sent.

Read the terms