Legal

Privacy Policy

Last updated: October 21, 2026

This Privacy Policy describes how Eyecandy (“we,” “us,” “our”) collects, uses, and protects information when you use the MESH mobile application (the “App”) and the MESH fitness band it connects to.

1. Who We Are

MESH is developed, sold and operated by Eyecandy, a business registered in Lahore, Pakistan. If you have questions about this policy or your data, contact us at info@mesh-fit.com.

2. Information We Collect

We only collect data needed to make the App work. We do not collect data for advertising, and we do not sell your data.

Account information

Email address — used to create and sign in to your account (via Firebase Authentication).

Health and fitness data

Heart rate
Heart rate variability (HRV)
Blood oxygen (SpO2)
Body temperature
Motion and activity data (steps, workouts, sleep)

This data is collected from the MESH band via Bluetooth and synced to our servers so you can view trends, history, and recovery information in the App.

Location data

Precise location — collected only while an active workout is in progress, to log workout routes and distance. We do not collect your location in the background or when no workout is active.

Device and diagnostic information

Standard technical information needed for the App to function, such as app version and device timestamps for sync. We do not use this for tracking or advertising.

3. How We Use Your Information

We use the information above solely to:

Create and maintain your account
Sync, store, and display your health, fitness, and workout data back to you
Operate core App features, including band pairing, history, and trends
Maintain the security and reliability of the App and backend

We do not use your health or fitness data for advertising, marketing to third parties, or sell it to data brokers.

4. Data Sharing

We do not share your personal or health data with third parties, except:

Service providers who host our infrastructure strictly to operate the App. They do not have independent rights to use your data.
If required by law, to comply with a valid legal request.

We do not use third-party advertising or analytics SDKs in the App.

5. Data Storage and Security

Your data is stored on servers operated by our hosting provider, accessed only over encrypted HTTPS connections.
Authentication tokens are stored securely on your device using the platform’s secure storage (iOS Keychain), excluded from device backups.
We do not use custom encryption beyond standard platform-provided transport encryption (HTTPS/TLS).

6. Your Rights

Account and data deletion

You can permanently delete your account and all associated data directly within the App: go to Profile → Delete account and data. This immediately and permanently removes your account, health data, and workout history from our systems in a single operation.

If you are unable to use the App, you may also request deletion by emailing info@mesh-fit.com from your account’s registered email address.

Access and correction

You may request a copy of the data associated with your account, or request correction of inaccurate data, by contacting us at the email above.

GDPR (EU/UK users)

If you are located in the EU or UK, you have the right to access, correct, delete, restrict, or port your data, and to object to processing, under the General Data Protection Regulation. Our lawful basis for processing your health and fitness data is your explicit consent, given when you create an account and pair your band. You may withdraw consent at any time by deleting your account.

CCPA/CPRA (California users)

If you are a California resident, you have the right to know what personal information we collect, to request deletion, and to opt out of the “sale” or “sharing” of personal information. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA.

7. Data Retention

We retain your data for as long as your account is active. If you delete your account, your data is permanently removed from our active systems immediately; backups, if any, are purged on our standard backup rotation schedule.

8. Children’s Privacy

MESH is not directed at, and we do not knowingly collect data from, children under 13. If we learn we have collected data from a child under 13 without appropriate consent, we will delete it.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above. Continued use of the App after a change constitutes acceptance of the updated policy.

10. Contact Us

Eyecandy
24-A Gosha Ahbab Society, Inside Tech Society, Canal Bank Road, Lahore 54590, Pakistan
info@mesh-fit.com
mesh-fit.com

11. Website cookies and preferences

The Mesh website currently uses no optional analytics or advertising cookies. Selecting Accept optional or Decline optional does not activate any tracking service.

We store your selection in your browser’s local storage under mesh-cookie-choice-v1 for 180 days, solely to remember your preference. This record contains your choice and its expiry time, not your name or email address. If browser storage is unavailable, the choice applies only to the current page.

You can change your preference at any time using Cookie settings in the footer. If we introduce optional services, we will describe their purposes and ask for fresh consent before enabling them.