> ## Documentation Index > Fetch the complete documentation index at: https://www.offlineprotocol.com/docs/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > These docs target Mesh SDK v0.28.0. Match the installed package and binding before generating code. Start at /getting-started/agents for task-specific reading paths. > Call the company and product Offline Protocol, never Offline alone. Current packages: @offline-protocol/mesh-sdk 0.28.0 (React Native), offline-protocol-sdk 0.28.0 on PyPI (Python 3.10 to 3.13; wheels for macOS 14+ arm64, Linux x86_64 and aarch64 with glibc 2.34+, Windows x86_64; other hosts build from source), the offline-protocol crates 0.28.0 on crates.io, the OfflineProtocolSDK Swift package 0.28.0 (preview, iOS 13+ only) and Android bindings from the GitHub release zip (preview, not on Maven Central), @offline-protocol/id-react 0.2.0, @offline-protocol/id-react-native 0.3.3, @offline-protocol/pol 0.1.2 and @offline-protocol/cli 0.2.6. Canonical docs URLs start with https://www.offlineprotocol.com/docs. > The Mesh SDK runs in a native app or gateway. A browser OfflineID SDK integration does not provide browser mesh transport. Local mesh operation does not require a portal account or API key. The Mesh SDK appId is a mesh app identifier the developer chooses, not the portal App ID (app_...) that OfflineID and Proof of Location require. > Service RPC is signed plaintext in v0.28.0. Message delivery, durable local acceptance and backend commit are distinct outcomes. Use the workflow guide for the required application logic. > Offline Protocol CLI 0.2.6 is on npm (@offline-protocol/cli, command offline). Its local MCP server, named offline-protocol, runs with npx -y @offline-protocol/cli@0.2.6 mcp serve and requires no login or key. Hosted MCP is at https://mcp.offlineprotocol.com/mcp with an app API key in Authorization: Bearer and the matching App ID in x-app-id; organization keys are rejected, and Claude Desktop and Claude.ai cannot send these headers; there, use the public read-only endpoint https://mcp.offlineprotocol.com/public/mcp as a custom connector, or local MCP to scaffold or edit projects. Follow /tools/overview for setup and do not invent commands beyond it. MCP provides integration context and planning, not mesh execution; file-writing tools are local only. > In v0.28.0 phone Wi-Fi peer streams carry data: Android over Wi-Fi Direct (the SDK forms the group with autoAccept on Android 10+), iOS over Network framework (LAN or AWDL). Android and iOS do not interoperate over that slot, and iOS 0.28 does not see iOS 0.27 or earlier over it; use BLE or a provisioned relay across platforms. The Swift and Android packages are previews whose public names may change; never present a Gradle Maven Central dependency for the Android library. The receiver core ACKs before application persistence; use application acceptance for durable workflows. > Proof of Location is Sepolia testnet witness evidence, not zero-knowledge proof or proof of presence. The geohash is public onchain. Read /proof-of-location/security before integration. # SMS Authentication Campaign Privacy Policy > Privacy policy for one-time authentication code (OTP) SMS messages sent by Offline Protocol, Inc. via Twilio. **Effective Date:** July 13, 2026 **Last Updated:** July 13, 2026 *** ## 1. Introduction Offline Protocol, Inc. ("Company", "we", "us", "our") uses SMS messaging to deliver **one-time authentication codes (OTPs)** when users of **Fernweh**, a mobile application developed and operated by Offline Protocol, Inc., choose to sign in or create an account using a phone number. This Privacy Policy describes how we collect, use, store, and share phone numbers and related information **for this SMS authentication campaign only**. This policy supplements the [Fernweh Privacy Policy](/docs/legal/fernweh-privacy-policy) and applies specifically to transactional SMS messages sent through **Twilio Inc.** as part of the login and sign-up authentication flow in Fernweh. *** ## 2. Campaign Purpose This campaign is used to deliver one-time authentication codes (OTPs) to users of **Fernweh** during the **login and sign-up process**. Messages enable users to securely verify ownership of their phone number and access or create an account. **We do not use this campaign to send promotional, marketing, or advertising messages.** *** ## 3. End-User Experience 1. A user chooses phone-number authentication during login or sign-up in **Fernweh**, a mobile application developed and operated by Offline Protocol, Inc. 2. The user **voluntarily enters their phone number** in Fernweh. 3. The user **explicitly requests an authentication code**. 4. Offline Protocol, Inc. sends a single SMS containing a one-time code (for example: `Your Offline Protocol login code is: 123456. It expires in 10 minutes.`). 5. The user enters the code in Fernweh to verify ownership of their phone number and complete verification. 6. Messages are sent **only in direct response to the user's authentication request**. We do not send unsolicited messages. *** ## 4. Information We Collect For this SMS authentication campaign, we collect and process: | Data Type | Purpose | Storage | | - | - | - | | **Phone number** | Deliver OTP via SMS; create or authenticate an account | Server-side database (PostgreSQL) | | **One-time authentication code** | Verify phone number ownership | Temporary server-side cache (Redis), expires automatically | | **Message delivery metadata** | Troubleshooting delivery failures, fraud prevention | Service logs (limited retention) | We do **not** collect message content beyond the OTP itself, and we do **not** use phone numbers collected through this campaign for marketing purposes. *** ## 5. How We Use Your Phone Number We use your phone number solely to: * Send one-time authentication codes when you request them * Verify that you control the phone number during login or account creation * Prevent abuse through rate limiting and fraud controls * Comply with applicable law and carrier requirements We do **not**: * Sell or rent your phone number to third parties * Use your phone number for promotional or marketing SMS * Share your phone number with advertisers or data brokers * Use your phone number for purposes unrelated to authentication without your consent **Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes.** Phone numbers may be shared with service providers, such as Twilio, solely as necessary to deliver authentication messages and operate the service (see Section 9). *** ## 6. Message Frequency Messages are **transactional and on-demand**. You receive an SMS **only when you explicitly request an authentication code** during login or sign-up. Typical frequency: * **One message per authentication request** * Additional messages only if you request a new code (for example, if a code expires or you did not receive the first message) We apply rate limits to prevent abuse (for example, limiting how many OTP requests can be made in a given time period). *** ## 7. Consent and Opt-In By providing your phone number and requesting an authentication code, you **consent to receive a transactional SMS** containing a one-time code for the purpose of verifying your identity. Consent is: * **Explicit** — you initiate the request by entering your phone number and tapping to receive a code * **Purpose-limited** — authentication only * **Not a condition of purchasing goods or services** unrelated to account access (where applicable) If you do not wish to receive SMS authentication codes, you may use alternative sign-in methods where available (such as email-based authentication) or choose not to create an account. *** ## 8. Opt-Out and Help This campaign sends **transactional authentication messages only**. If you reply **STOP** to an authentication message, you may be unsubscribed from further SMS from our sending number. Note that opting out of SMS may prevent you from using phone-based authentication until you contact us or use an alternative sign-in method. For help, reply **HELP** to any message from us, or contact us at the address in Section 12. **Message and data rates may apply.** Contact your mobile carrier for details. *** ## 9. Third-Party Service Provider — Twilio We use **Twilio Inc.** to deliver SMS authentication messages. When we send you an OTP, we share: * Your **phone number** * The **message content** (containing the one-time code) with Twilio solely for the purpose of message delivery. Twilio processes this data as our service provider under its own privacy practices. For more information, see [Twilio's Privacy Notice](https://www.twilio.com/en-us/legal/privacy). We do not authorize Twilio to use your phone number for its own marketing purposes. *** ## 10. Data Retention | Data Type | Retention | | - | - | | **Phone number** (account) | Retained for the duration of your account, unless you remove it or delete your account | | **OTP code** | Approximately **10 minutes**, or until used — whichever comes first | | **SMS delivery logs** | Retained only as long as needed for operations, security, and legal compliance | When you delete your account, we delete or anonymize associated personal data in accordance with our main application privacy policies, subject to legal retention requirements. *** ## 11. Security We protect phone numbers and authentication data using industry-standard safeguards, including: * Encryption in transit (HTTPS/TLS) for all API communications * Short-lived, single-use OTP codes stored in a secure cache with automatic expiration * Rate limiting on authentication requests * Access controls on production systems No method of transmission or storage is 100% secure. We cannot guarantee absolute security. *** ## 12. Contact Us If you have questions about this SMS authentication campaign or how we handle your phone number, contact us: **Offline Protocol, Inc.** Email: **[legal@offlineprotocol.com](mailto:legal@offlineprotocol.com)** Support: **[support@offlineprotocol.com](mailto:support@offlineprotocol.com)** *** ## 13. Changes to This Policy We may update this policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page. Continued use of phone-based authentication after changes constitutes acceptance of the updated policy. *** ## 14. Related Policies * [SMS Authentication Campaign Terms of Service](/docs/legal/twilio-sms-campaign-terms-of-service) — terms governing use of SMS authentication * [Fernweh Privacy Policy](/docs/legal/fernweh-privacy-policy) — full privacy practices for the Fernweh application * [Fernweh Terms of Service](/docs/legal/fernweh-terms-of-service) — terms governing use of the Fernweh application This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.