CONTENT STAYS PRIVATE.

Public game record

For 30 days, fronts and defences may show the credited handle, gangs, public H3 cells, coalesced area gained, and rounded time. Hidden operators become “redacted operator.” After 30 days, cell-level events are deleted; only weekly aggregates, ranks, and earned cosmetics remain.

Radio pulses, operations, and badges

A public radio pulse contains only a gang, opaque zone identifier, traffic class, score delta, a deterministic generalized point inside the public zone, and time rounded down to 15 minutes. It never returns the receiver H3 cell or names an operator, device, packet, origin, exact reception time, exact GPS, or trail, and it expires after seven days. Ownership-transition H3 cells remain public because the territory itself is public.

Signal Frontiers, regions, HQs, and carried evidence

Beta 1.7.5 recomputes still-valid seven-day Beta 1.7.1 evidence under the immutable Signal Frontiers profile while retaining each epoch's original time and expiry. The carry creates no migration capture, RF ranking credit, or award. Public maps may show contiguous owned contours, charging haze, generalized core proof, normalized strength, fading state, front stage, public owned H3 cells, a gang's curated-region HQ, regional control, and a FORTIFIED badge. They never reveal a member's private home region, collector identity, exact receiver/core position, or exact siege-start time.

The default repeater view shows locally heard repeaters and gang claims; the wider Canadian network remains optional. Claims publish a gang name, bucketed recent-hearing share, pressure state, and trace from a generalized gangzone anchor to the repeater's public signed location. They never publish a receiver cell, hearing time, operator, device, or raw count.

Phone Patrol

Received packet bytes exist only long enough in client memory to compute SHA-256. Collection is live-only, with no disk queue or saved trail. The PWA uses a screen wake lock but cannot guarantee BLE or GPS after its page is hidden. The Android APK uses a visible location + connected-device foreground service so live Patrol can continue with the screen off; it does not request permanent background-location access. The self-test verifies BLE, precise GPS, and server reachability without creating an Observation or influence.

Patrol requests include a coarse client name, release version, and random session identifier so retries can reuse the same server session and the player can receive an exact debrief. The identifier is not a radio address, hardware identity, credential, or location. Exact session relations are private and follow the existing observation retention boundary.

Network repeater registry

The registry was seeded once from CoreScope and is refreshed only by signed repeater adverts received from the two MeshCore Canada MQTT brokers. MQTT envelopes are parsed in memory; non-adverts and invalid signatures are discarded, and raw packets or message content are never stored. The public layer may show a repeater's exact self-signed location and network freshness. It never shows public keys, fingerprints, observers, or a gang's exact local reception point.

External registry traffic cannot create an Observation, score, field, claim, or capture. It may validate public metadata only. Bounded repeater reach and map claims exist only after exact local gang hearing satisfies the two-epoch, freshness, stability, quarantine, and distance rules; verification and the claim itself still add no RF points.

Retention and reports

Ordinary packet metadata, public radio pulses, and peppered repeater fingerprints are kept seven days. Quarantined metadata is kept 30 days. Exact phone GPS is scrubbed within 24 hours. Sanitized repeater registry metadata remains while useful for the public network map. Signed-in players may report profiles, gangs, recruiting listings, or battle events for audited operator review.

Map tiles

The dark-styled map requests standard tiles from OpenStreetMap. OpenStreetMap receives tile coordinates and ordinary network information such as your IP address; MeshGangs sends it no account, device, observation, or patrol data.

Compatibility test and notifications

The anonymous radio test performs BLE, GPS, and server checks locally, then records only a rate-limited pass or categorical failure count. It rejects coordinates, packet data, and device identifiers and cannot create an account, Observation, or influence.

Notifications are off until enabled in Settings. Web Push endpoint and browser key material are encrypted at rest; the push provider receives encrypted delivery metadata needed to deliver the alert. Android uses a device-local best-effort HTTPS check instead of Firebase. Opted-in lock screens may show a public curated region name, but never an H3 cell, GPS, device, packet, or observer. Quiet-hour suppression leaves the event available in the private in-site inbox.