What Data a Mesh Analytics Tool Stores

The question comes up early in any evaluation: before you connect your broker, before you enroll an observer, before anything flows — what does a tool like this actually keep?

It’s the right question to ask first. What doesn’t enter the database can’t be accessed, breached, or misused. The architecture’s privacy posture isn’t defined by what it promises to protect, but by what it declines to collect in the first place.

What arrives at the ingest edge

Your mesh observer receives every LoRa packet that passes through it and publishes those records to your MQTT broker. Waev subscribes to that broker. What arrives at Waev’s ingest edge is a stream of raw packet records: the source node’s name, the path the packet traveled, signal quality readings at each hop, and a timestamp.

That stream contains more information than Waev needs. The ingest edge’s job is to reduce it to the minimum that makes the product useful, before anything is written.

The three decisions at the gate

First: privacy markers. If the source node’s name contains a privacy marker — ⛔, 🛑, or 🚫 — the packet is discarded in full. Nothing is counted, nothing is stored, nothing is inferred from that observation. The marker is checked before any other processing, with no exceptions.

This is the hardest guarantee to make: not “we anonymize it” or “we aggregate it,” but “it never enters the database.” A node that opts out disappears from the system entirely.

Second: companion device scrub. MeshCore personal apps — phones and tablets running as companion devices — broadcast on the same RF mesh as repeaters. Their packets reach observers just like any other node’s packets. At the ingest edge, identity fields for companion devices are nullified before storage. The node name and device type are cleared. What survives is the signal record: SNR, hop count, timing. The device appears anonymously in Network Stats as traffic, but never on the Live Map, never with a name attached.

Third: topology verification. An observation only produces a map edge if it traces back to a verifiable source — an enrolled observer or an authenticated repeater. An observation that can’t be traced to a verified source doesn’t draw a line. This prevents inferred or spoofed topology from entering the map.

What actually gets stored

What passes all three checks is a deliberately narrow set:

• SNR per link — the signal-to-noise ratio as measured at each hop in the path. The number that tells you whether a link is healthy or marginal.
• Hop count — how many nodes the packet traversed to reach the observer.
• Packet timing — when the observation arrived, used for ordering the packet history and aging topology edges.
• Verified topology edges — which node was heard by which enrolled observer, on which path. The evidence that draws a line on the map.

No GPS coordinates. No message content. No device owner information. No persistent node identity beyond the name the node broadcasts on air, and only when that name doesn’t carry a privacy marker.

What that retained data powers

The retained set is small because it only needs to power a small set of surfaces.

Live Map draws topology from verified edges. An edge appears when an enrolled observer records a packet path; it ages when observations stop arriving. The map reflects what the network can prove about itself at a given moment.

Network Stats counts anonymous activity: unique nodes seen in the last hour, day, week. Companion signal records contribute to that count without identifying any device. The number tells you how busy the mesh is, not who’s on it.

Packet Search gives you a queryable history of non-private observations: which nodes were active, over what time window, at what signal quality. Useful for after-action review and link-quality analysis.

Outpost surfaces per-node signal history — SNR over time, heard-by records — for the nodes that appear on the map.

None of these surfaces require storing identity, location, or message content. The product is useful with signal metadata alone. That’s not a constraint the design works around — it’s the design.

---

The choice about what not to collect is made once, at the architecture level, and it determines what’s possible from that point forward. You can’t breach data that was never stored. You can’t misuse identity that was scrubbed before it was written. The privacy-by-default framing is the same one that governs who holds your broker credentials: the less the system knows, the more the operator controls.