Privacy policy

1. Who we are and what this policy covers

Offline Protocol, Inc. (“Offline Protocol”, “we”, “us”, “our”) is a Delaware corporation. This policy explains how we handle personal data across everything we operate for developers and businesses:

the website at www.offlineprotocol.com, including the documentation at www.offlineprotocol.com/docs (also docs.offlineprotocol.com);
the developer portal at dev.offlineprotocol.com;
the Offline Protocol CLI (npm package @offline-protocol/cli), its local MCP server, the hosted MCP server at mcp.offlineprotocol.com, and agent plugins we publish;
our hosted services at api.offlineprotocol.com and related hosts: OfflineID sign-in and identity, the hosted relay, telemetry ingestion and analytics, and Proof of Location.

It does not cover the Fernweh and MINE apps, which have their own privacy policies (Fernweh, MINE), or apps that other companies build with Offline Protocol. Those companies decide how their apps use your data and publish their own policies.

Words such as Customer, Organization, Application, End User, Customer Data, Account Data, and Service Data have the meanings in our Developer Terms of Service.

2. Our role: controller or processor

Data	Our role	Who decides how it is used
Website visitors, contact form, and calls you book	Controller	Offline Protocol
Developer Accounts, Organizations, Members, billing, and support (Account Data)	Controller	Offline Protocol
Logs, security events, usage meters, and billing records about the Services (Service Data)	Controller	Offline Protocol
CLI sign-in records and hosted MCP requests	Controller	Offline Protocol
Data that a Customer’s app sends to our hosted services about its End Users	Processor for the Customer	The Customer, under our Data Processing Addendum
The core OfflineID account (email or phone, username, sign-in security), which one person can use across several apps	Controller	Offline Protocol
Aggregated, de-identified statistics we derive from telemetry and usage	Controller	Offline Protocol (see Section 6)

If you are an End User of an app built on Offline Protocol and have questions about how that app uses your data, contact the company that makes the app. If you contact us instead, we will pass your request to them where we can identify them.

3. Information we collect

3.1 Website visitors

Data	When	Details
Pages viewed, referrer, clicks on calls to action, browser and device type, approximate location from IP, a random browser identifier	Only if you allow analytics in the banner	Collected by PostHog. We do not use session recording or advertising features, and we do not link analytics to your name or email.
Page views and page performance, without cookies or a persistent identifier	Every visit to the website, portal, and documentation	Counted by Cloudflare Web Analytics.
Name, email, company, role, use case, industry, fleet size, and timeline	When you submit the contact form	Delivered to our inbox by Web3Forms.
Name, email, and scheduling details	When you book a call	Collected by Calendly on calendly.com.
Your email and what you write	When you email us	Kept in our mailbox.
IP address, user agent, page requested, time	Every request	Logged by our hosting and network providers for security and reliability. Map tiles on the network map are loaded from OpenFreeMap, which receives your IP address.

3.2 Developer portal accounts and Organizations

Data	Source	Details
Email address	You	Your Account is identified by email. You sign in with a one-time code we email you.
Organization details: name, description, website, support email, logo, allowed membership domains	You	Visible to Members of the Organization.
Application details: name, description, icon, allowed web origins, bundle IDs, redirect URIs, product settings such as whether telemetry is on	You	Used to operate and secure the Application.
Members, roles, invitations, and per-Application access	Owners and admins	Invitation emails contain a link that is valid for 7 days.
API Keys	Generated by us	We store API Keys only as hashes. A key is shown in full once, when it is created, and cannot be shown again. Listings show a short preview only.
Commercial license requests: contact name and email, company, role, use case, industry, device scale, timeline	You	Used to respond to your request.
Billing: plan, subscription status, Stripe customer ID, invoices and usage charges, Organization name and billing email sent to Stripe	You and Stripe	Card details are entered on Stripe-hosted pages and never reach our servers.
Usage meters, analytics you view, quota warnings	Generated by the Services	Used to show usage, apply your Plan, and bill.
Support emails and feedback	You	Used to help you.
How you found us: your optional answer, the AI assistant if you name one, a chat share link or the question you asked if you choose to share it, and the site and campaign tags (utm_source, utm_medium, utm_campaign) that linked you to the portal	You, and your browser’s referrer when you first open the portal after signing up	Used to learn where developers hear about us. If you share a chat, our team may open the link to read that conversation, and if we approve it we add a credit worth one month of the Pro plan to an Organization you belong to; the credit is applied through Stripe as a balance on that Organization’s invoices. We keep only the referring site’s name, not the page address, and store nothing in your browser to do this.

3.3 The CLI, MCP servers, and agent plugins

CLI sign-in. offline login opens the portal in your browser, sends your computer’s hostname as the device name, and receives an application API key after you approve. We record the time, IP address, and user agent of CLI sign-in events as a security audit log.
Stored on your computer. The CLI saves your API key, email, and Account, Organization, and Application IDs in ~/.offline/config.json. On macOS and Linux the file is readable only by your user; on Windows it uses your folder’s default permissions. offline logout deletes the file and revokes keys that were created for the CLI.
No CLI telemetry. The CLI does not send usage analytics or crash reports. offline doctor checks your local tools and, unless you pass --offline, checks that your key works. offline update asks GitHub for the latest release. Creating a project runs npm and CocoaPods, which contact their own registries.
Local MCP server. offline mcp serve runs on your computer and sends nothing to Offline Protocol.
Hosted MCP server. Requests to mcp.offlineprotocol.com carry your application API key and application ID, which we check against the developer service. Requests to the public read-only endpoint at mcp.offlineprotocol.com/public/mcp need no account or key; we count requests per IP address in memory for rate limiting and keep nothing else about them. The server does not store request bodies, tool arguments, or API keys, and does not write them to its logs. It keeps short-lived rate-limit counters in memory. Our hosting provider records connection metadata such as IP addresses.
Agent sign-in (preview). When OAuth sign-in for the hosted MCP server is enabled, we store the agent’s registration details, including the IP address that registered it, and an audit record of each approval.

3.4 Documentation

The documentation is hosted by Mintlify, which provides us with aggregate analytics such as page views, search terms, and page feedback. If you use the documentation’s links to open a page in ChatGPT or Claude, that service’s privacy policy applies.

3.5 Hosted services used by apps

When an app built on Offline Protocol uses our hosted services, we process data about its End Users on the Customer’s behalf. What we receive depends on which services the Customer uses:

Service	Data we process
OfflineID	Email address or phone number, username, optional profile details (display text, picture, social links, and a location if the app sets one), connections between users and each person’s location-sharing choices, an optional `off1` device address, push notification tokens with device model, OS, and app version, which apps the person has signed in to, and daily sign-in counts per app. Phone sign-in codes are sent and checked by Twilio.
Relay	Message envelopes: sender and recipient addresses, usernames, group and message IDs, timing, and size. Message content is encrypted end to end by the SDK and we cannot read it. Undelivered messages are queued for up to 7 days. The relay also stores public identity keys, group membership, and when an address was last seen. If the app uses push notifications, notification details are sent through Firebase Cloud Messaging.
Telemetry (only if the Customer turns it on for the Application)	Measurements of how the mesh network behaves: message delivery results, latency, and hop counts; routing decisions and transport changes (Bluetooth LE, Wi-Fi Direct, internet); relay role changes; neighbor counts, queue sizes, and bytes sent and received per minute; per-session summaries; encryption session errors; and battery level and charging state. Each record carries the application ID, app version, operating system and major version, a country code, and a session identifier. If the app opts in, it also carries an install identifier. Both identifiers are random values created by the SDK, which we hash with a key that rotates every quarter before storing them. Our servers do not read the client IP address: the country code comes from our network provider (Cloudflare). Telemetry does not contain message content, contacts, names, usernames, email addresses, phone numbers, advertising identifiers, or location more precise than the country; peer, user, and group identifiers are hashed on the device before they are sent and are not stored.
Proof of Location	Username, the latitude and longitude the app submits, and the application ID. We convert the coordinates to a coarse geohash (about 5 km) and publish that geohash, the time, and a cryptographic commitment on a public blockchain. We do not store the raw coordinates. Witness operators receive the coordinates to check the claim.

Section 3.5 describes what the services can collect. The Customer decides which services its app uses and must tell its End Users. A detailed, per-service reference is in the documentation under data handling by service.

4. How we use information and our legal bases

Purpose	Data	Legal basis (EEA and UK)
Create and secure your Account, sign you in, and run the portal	Account Data, sign-in records	Contract
Provide the hosted services to Customers and their apps	Customer Data	Processed for the Customer, who determines the legal basis
Meter usage, apply Plans, bill, and collect payment	Account Data, Service Data	Contract; legal obligation for tax and accounting records
Send service emails: sign-in codes, invitations, quota and billing notices, security and policy notices	Email address	Contract; legitimate interests
Protect the Services: rate limiting, abuse and fraud prevention, audit logs, error monitoring	IP addresses, user agents, sign-in events, error reports	Legitimate interests in keeping the Services and their users safe
Understand and improve our products	Website analytics (with consent), sign-in funnel events, aggregated usage, how you found us (optional)	Consent for website analytics; legitimate interests for aggregated product analytics and how you found us
Answer enquiries, schedule calls, and handle license requests	Contact and request details	Steps at your request before a contract; legitimate interests
Create aggregated, de-identified statistics (Section 6)	Telemetry and usage	Legitimate interests
Comply with law and enforce our terms	Any relevant data	Legal obligation; legitimate interests

We do not sell personal information, share it for cross-context behavioral advertising, or use it to train generative AI models. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

6. Aggregated and de-identified data

We create aggregated, de-identified data from the use of the Services, such as network reliability benchmarks built from telemetry and usage across many apps. Aggregated telemetry is grouped by day, region, operating system, and transport, contains counts, sums, and percentiles only, and does not contain application or Customer identifiers. A group is kept only if it covers at least 100 distinct devices or app sessions; smaller groups are discarded, not stored. This data does not identify any Customer or any individual. We may use it to operate and improve the Services, publish it, and share or license it to third parties, who must agree not to attempt re-identification. We do not attempt to re-identify anyone from it.

7. How long we keep information

We keep personal data only as long as we need it for the purposes in Section 4, or as the law requires. The periods below are how the Services work.

Data	Retention
Developer Account	While the Account exists. You can delete your developer Account in the portal. Deletion ends your access immediately, and we permanently delete your Account Data within 30 days, except records we must keep for legal, tax, billing, or security reasons.
Organization and Application records, and the Customer Data of an Organization	While the Organization exists. An owner can delete an Organization in the portal once any outstanding balance is paid. Deleting it cancels the paid subscription, bills any overage for the final billing period, and deactivates the Organization and its Applications and API Keys immediately. Thirty days later we permanently delete its Customer Data and Organization records, except records we must keep for legal, tax, billing, or security reasons.
Billing records (invoices, payment and usage records, and records of acceptance of the Developer Terms, including the IP address)	7 years, for tax, accounting, and dispute purposes
Sign-in codes	10 minutes, single use
Portal session	Up to 100 days in your browser, or until you log out
CLI sign-in requests	A pending CLI sign-in expires after 5 minutes
CLI sign-in audit log (time, IP address, user agent) and agent approval records	12 months, then deleted automatically
Rate-limit and abuse-prevention records keyed by IP address	Between 1 hour and 24 hours. Addresses flagged for abuse are kept for up to 90 days.
Error reports (Sentry)	Deleted by Sentry at the end of its standard retention period, which is 90 days or less
Website and product analytics (PostHog)	Kept by PostHog under its standard retention. PostHog documents that it keeps events for at least 1 year on its free plan and 7 years on paid plans (PostHog events retention). We delete a person’s PostHog data on request.
How you found us	While the Account exists. A shared chat link or question is deleted 90 days after you share it. You can change or delete your answer at any time in Account settings, and it is deleted with your Account. A credit we granted for a shared chat is kept with the billing records.
Contact form and email correspondence	As long as needed to handle your enquiry and for a reasonable period after, then deleted
OfflineID account	Until the person deletes it. Deletion takes effect after a 30-day grace period, during which signing in cancels it. When the grace period ends, we delete the account together with its related records: profile details and connections, relay identity keys, group memberships, and queued messages, uploaded media and profile pictures, Proof of Location commitment secrets and off-chain records, and the person’s profile and events in our product analytics (PostHog). When our team deletes an account at the account holder's request, we keep a record of the deletion for 3 years to show that it was carried out. The email address and usernames in that record stay readable for 30 days, after which we keep only a keyed one-way hash of them, and the whole record is deleted automatically at the end of the 3 years.
Relay messages	Until delivered, and no more than 7 days
Relay identity keys, group membership, last seen	While the OfflineID account exists
Raw telemetry events	30 days
Per-minute telemetry and the live event feed	48 hours and 2 hours
Daily telemetry totals per Application	For the life of the Application. Daily breakdowns by operating system and country are kept for 2 years. Plans limit how far back you can view analytics (7, 30, or 90 days, or longer by agreement); that limit controls viewing only and does not delete data.
Proof of Location off-chain records	While the OfflineID account exists
Proof of Location on-chain records	Permanent. They cannot be changed or deleted by anyone.
Server and network logs	Kept by our hosting provider for its standard log retention period, which is 90 days or less
Backups	Deleted data may remain in backups until those backups expire in the normal course

8. Public blockchain data

Proof of Location is an early-access service on the Ethereum Sepolia test network. For each task, a random task ID, a geohash of about 5 km, the block time, and a commitment (a hash of the username, geohash, and a secret random value) are written to the public ledger. The username and exact coordinates are not published. Records written before September 29, 2026, when we changed to random task IDs, used identifiers derived from the username, so tasks from the same person could be linked. On-chain records are permanent and are outside our control once written: deleting an account removes our off-chain copies but not the on-chain records. Apps must get the End User’s informed consent before submitting a location.

9. International transfers

Offline Protocol, Inc. is a U.S. company. Our databases and hosted services run on Railway in Singapore, and the relay also runs servers in the United States. Our service providers process data in the United States, the European Union, India, and other countries (see the subprocessors page). When we transfer personal data from the EEA, the United Kingdom, or Switzerland to a country without an adequacy decision, we use the European Commission’s Standard Contractual Clauses, the UK Addendum, or another lawful transfer mechanism, together with our providers’ equivalent commitments.

10. Security

All connections to our sites and APIs use TLS. Sign-in codes are single use and rate limited. We store API Keys only as hashes. A key is shown in full once, when it is created, and cannot be shown again. Card details stay with Stripe. Access to production systems is limited to staff who need it. Relay message content is encrypted end to end by the SDK. No system is perfectly secure, and you are responsible for keeping your API Keys and the devices where the CLI stores them secure. The measures that apply to Customer Data are listed in Annex 2 of the Data Processing Addendum. To report a vulnerability, see our responsible disclosure policy.

11. Your rights and choices

11.1 Choices everyone has

Accept or reject website analytics in the banner, and change your choice later in Privacy preferences (see the cookie notice).
Edit your Organization and Application details in the portal, revoke API Keys, and remove Members.
Opt out of non-essential emails with the link in the email. Service emails such as sign-in codes and billing notices are part of the Services.
Change or delete how you found us in the portal’s Account settings.

11.2 EEA, UK, and Swiss residents

You have the right to access, correct, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. You can complain to your data protection authority, although we would like the chance to help first.

11.3 U.S. state privacy rights

Depending on where you live, including California, Colorado, Connecticut, Virginia, and other states with privacy laws, you may have the right to know what personal information we collect and how we use and disclose it, to access, correct, and delete it, to receive a portable copy, and to opt out of sale, sharing for targeted advertising, and profiling. We do not sell or share personal information and do not profile in ways that produce legal or similar effects. We will not discriminate against you for exercising your rights. You may use an authorized agent, and you may appeal a decision by replying to it.

11.4 How to make a request

Email legal@offlineprotocol.com from the email address on your Account if you have one. We may ask for information to verify your identity. We respond within the time the law requires, usually within 30 days in the EEA and UK and 45 days in the United States. You can delete your developer Account in the portal. Deletion ends your access immediately, and we permanently delete your Account Data within 30 days, except records we must keep for legal, tax, billing, or security reasons. End Users of an app built on Offline Protocol should contact that app’s developer, and we will help them respond.

12. California notice at collection

In the last 12 months we collected these categories of personal information, from the sources and for the purposes in Sections 3 and 4:

Category	Examples	Disclosed for a business purpose to
Identifiers	Name, email, phone number, username, IP address, account and device IDs	Service providers
Commercial information	Plan, subscription, invoices	Stripe and service providers
Internet or network activity	Website analytics (with consent), sign-in events, API requests, logs	Service providers
Geolocation	Approximate location from IP; for End Users of apps using OfflineID profile location or Proof of Location, precise location processed for the Customer	Service providers; coarse geohash published on a public blockchain for Proof of Location
Professional information	Company, role, Organization details	Service providers
Sensitive personal information	Account sign-in credentials (one-time codes); precise geolocation of End Users processed for Customers	Service providers. Used only to provide the Services, not to infer characteristics.

We do not sell or share personal information, and have not done so in the last 12 months. We do not knowingly sell or share the personal information of consumers under 16. We keep each category for the periods in Section 7.

13. Children

The website, portal, and developer tools are for adults and businesses, and we do not knowingly collect personal data from children through them. Customers may not use the hosted services in apps directed to children under 13 without a lawful parental-consent mechanism. If you believe a child has given us personal data, email legal@offlineprotocol.com and we will delete it.

14. Changes to this policy

We may update this policy as our services change. We will post the new version here and update the dates above. If a change is material, we will also notify developer Account holders by email or in the portal before it takes effect. The previous version of this policy, last updated July 27, 2026, covered the website only.

15. Contact

Offline Protocol, Inc. is the company responsible for this policy. For any privacy question or request, including from individuals in the EEA and the United Kingdom, email legal@offlineprotocol.com. EEA and UK residents may also contact their local data protection authority.

Questions about this document, privacy requests, and anything else policy related: email legal@offlineprotocol.com. Security vulnerabilities: security@offlineprotocol.com. All of our legal documents are listed on the legal page.