Privacy Policy

Last updated: May 2026

Data controller

Inspirify Limited, a company registered in Hong Kong, is the data controller responsible for your personal data for the purposes of GDPR and applicable data protection laws.

Contact: privacy@oakenmesh.com

What we collect

To provide Oaken Mesh, we collect the minimum needed for the service to function:

  • Email address (for account authentication and billing)
  • Device public keys (for mesh network authentication)
  • Mesh coordination metadata (which devices belong to your network, connection timestamps)

What we do not collect

Your mesh traffic is end-to-end encrypted with WireGuard. We cannot see it even if we wanted to. We do not collect:

  • Traffic content or packet payloads
  • Browsing history, sites visited, or apps used
  • DNS queries on mesh traffic
  • IP addresses beyond what is needed to establish connections

No-logs policy

Oaken Mesh is a strict no-logs VPN and mesh networking service. We do not log, monitor, record, or store:

  • Your browsing activity, traffic destinations, or DNS queries
  • Connection timestamps tied to specific activity
  • Originating IP addresses after connection establishment
  • Session duration or bandwidth usage tied to specific sites or services

Our architecture makes logging technically impossible for mesh traffic — WireGuard encryption is end-to-end between your devices. For exit node traffic, the tunnel terminates inside an isolated microVM with no persistent storage and no logging daemon. We have nothing to hand over because nothing is recorded.

Security practices

We implement multiple layers of security to protect your data and privacy:

  • End-to-end encryption — all mesh traffic is encrypted with WireGuard (Curve25519, ChaCha20-Poly1305) between your devices. We never hold your private keys.
  • Isolated exit nodes — each managed exit node runs as a dedicated microVM with no shared resources. Nodes have no persistent storage and no logging capability.
  • Encrypted at rest — account data stored on Cloudflare D1 is encrypted at rest using AES-256.
  • Minimal attack surface — our coordination server handles key exchange and mesh topology only. It never sees or touches your traffic.
  • Automatic key rotation — coordination metadata and device registrations rotate every 30 days.
  • No shared infrastructure — exit nodes are not multi-tenant. Your node is yours alone.

Managed exit nodes

Each managed exit node runs as an isolated microVM with a dedicated public IP address. We manage the VM lifecycle — provisioning, health checks, and replacement — but we have no access to your traffic and no logging capability by design. The node runs WireGuard end-to-end; we never see the tunnel contents.

Exit nodes are persistent until you delete them. We may automatically replace a node if health checks detect it is down, or migrate it to faster infrastructure when available. In both cases, the replacement node is a fresh, isolated instance — no session data carries over because none is stored.

Abuse prevention monitoring

To enforce our Acceptable Use Policy, we collect aggregate, non-identifying metadata per exit node:

  • Total bandwidth usage (bytes transferred, not destinations)
  • Connection counts and rate (number of connections, not where they go)
  • Blocked-port attempt counters (e.g., number of blocked SMTP attempts)

This data is used solely for detecting abuse patterns (DDoS, spam relay, infrastructure overload) and is not linked to browsing activity, destinations, or traffic content. We do not perform deep packet inspection.

Third-party services and subprocessors

We do not run third-party tracking or analytics in the Oaken Mesh apps. The landing page uses Cloudflare Web Analytics, which is privacy-preserving and sets no cookies. We will never sell your data.

We use the following third-party service providers (subprocessors) to operate Oaken Mesh:

  • Cloudflare (USA/Global) — infrastructure hosting, D1 database, DNS, DDoS protection, web analytics
  • Paddle (UK) — payment processing and subscription billing
  • Apple (USA) — Sign in with Apple authentication (when you choose this method)

Exit node infrastructure is self-managed on dedicated bare metal servers running Firecracker microVMs. No third-party provider has access to exit node traffic or user data.

Each subprocessor is bound by data processing agreements that require them to protect your data to GDPR standards. We do not share your personal data with subprocessors beyond what is strictly necessary for the service to function.

Data storage and retention

Account data is stored on Cloudflare D1 (EU/US regions), encrypted at rest. Account data is retained only while your account is active.

For abuse prevention, we maintain a temporary mapping of exit node IP addresses to account identifiers in volatile memory. This mapping is automatically purged within 72 hours and is never written to persistent storage. Per-account abuse report counts are retained for the lifetime of the account to enforce our repeat-infringer policy.

Coordination metadata (device registrations, mesh topology) is automatically rotated every 30 days.

Apple Sign-In

If you authenticate with Sign in with Apple, we receive a unique, stable user identifier and, if you choose to share it, your email address. Apple does not share your Apple ID password or other account information with us. If you use Apple's private relay email, we only see the relay address.

Legal basis for processing (GDPR)

We process your data under the following legal bases:

  • Contract performance — processing necessary to provide the Oaken Mesh service (account data, device keys, mesh coordination)
  • Legitimate interest — security monitoring, fraud prevention, and service improvement
  • Consent — where required for optional communications (e.g., product updates by email)

International data transfers

Your data is processed on Cloudflare's global network. Cloudflare maintains EU-US Data Privacy Framework certification and Standard Contractual Clauses for international transfers. Exit node traffic is encrypted end-to-end with WireGuard and never decrypted outside your devices.

Law enforcement and government requests

Inspirify Limited is incorporated in Hong Kong. We will only comply with data requests that are legally valid under Hong Kong law.

Our response to government or law enforcement requests:

  • We require a valid court order or equivalent legal process under Hong Kong law before disclosing any user data.
  • We evaluate every request for legal validity, scope, and proportionality.
  • We reject overly broad or legally deficient requests.
  • Due to our no-logs architecture, we have no traffic data, browsing history, or connection logs to provide — even under valid legal process.
  • Where legally permitted, we will notify affected users of any request for their data.

The data we could provide in response to a valid order is limited to: email address, account creation date, and subscription status. We cannot provide traffic logs, browsing history, IP connection logs, or mesh activity because we do not collect or retain this information.

Transparency

We publish a transparency report at least annually disclosing the number of government and law enforcement requests received, complied with, and rejected. As of our launch, we have received zero requests for user data from any government or law enforcement agency.

Warrant canary: As of May 2026, Inspirify Limited has not received any national security letters, FISA orders, or equivalent secret government demands for user data. We have not been subject to any gag orders that prevent us from disclosing the existence of a government data request. If this statement is removed from a future version of this policy, draw your own conclusions.

Data breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms:

  • We will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
  • We will notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms, as required by GDPR Article 34.
  • Notification will include: the nature of the breach, categories of data affected, likely consequences, and measures taken to mitigate the breach.

Your rights under GDPR

If you are in the European Economic Area (EEA) or United Kingdom, you have the right to:

  • Access — request a copy of the personal data we hold about you
  • Rectification — correct inaccurate data
  • Erasure — request deletion of your data ("right to be forgotten")
  • Restriction — limit how we process your data
  • Portability — receive your data in a structured, machine-readable format
  • Objection — object to processing based on legitimate interest
  • Withdraw consent — where processing is based on consent, withdraw it at any time
  • Lodge a complaint — you have the right to lodge a complaint with your local data protection supervisory authority if you believe our processing of your personal data violates GDPR

To exercise any of these rights, contact privacy@oakenmesh.com. We will respond within 30 days.

Your rights under CCPA

If you are a California resident, you have the right to:

  • Know — what personal information we collect, use, and disclose
  • Delete — request deletion of your personal information
  • Opt-out of sale — we do not sell personal information, so this right is automatically satisfied
  • Non-discrimination — we will not discriminate against you for exercising your rights

To make a verifiable request, contact privacy@oakenmesh.com.

Children's privacy

Oaken Mesh is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

Account deletion

When you delete your account, all associated data — including device keys, mesh configuration, and authentication records — is removed from our active systems within 30 days. Backups containing your data are purged within 90 days.

Changes to this policy

We may update this policy from time to time. Material changes take effect 30 days after we notify you by email. The "Last updated" date at the top reflects the most recent revision.

Contact

Questions about this policy: privacy@oakenmesh.com

Inspirify Limited
Hong Kong