Your plans sync between machines. Never through ours.
Mesh is not storage. Plan contents move device to device over an encrypted connection and are signed at the source. What we hold is the boring half — who is on your team and who may read what.
The flanner client — CLI, MCP server, local web UI — is free, open source and needs no account. Start there if you are one person on one machine. Mesh earns its price once two machines need the same plans.
Where your plans actually go
Three paths, and only one of them carries plan contents.
What we hold, and what we cannot
The right-hand column is not a policy we promise to keep. It is a consequence of never receiving the data in the first place.
On our servers
- Who is on your team, and their handles
- Which devices each person enrolled, by public key
- Which workspaces exist, and who may enter them
- Billing: how many seats, and whether they are paid
Never on our servers
- The text of any plan, in any version
- Plan names, titles, or the repositories they came from
- Comments, review decisions, or who proposed what
- Anything at all after you cancel — none of it was ever here
How one sync happens
Four steps, in this order, every time.
- 01
You ask
Syncing is a pull. Nobody can put a plan on your machine without you requesting it.
- 02
They answer with a list
Their device replies with an inventory of what it holds. Not the contents — just the list.
- 03
You fetch the gaps
Your device pulls only the versions it is missing, so a second sync moves almost nothing.
- 04
You verify every signature
Each version was signed by the machine that wrote it. Yours checks it against that machine's public key, rather than trusting whoever handed it over.
Two machines usually reach each other directly, through home routers and office firewalls alike. When they genuinely cannot, an encrypted relay forwards the bytes. It sees two devices exchanging something, and not what.
What it is not
You do not edit files on somebody else’s computer. There is no shared cursor and no live document. This is closer to git than to a collaborative editor: you work on your copy, and versions move between machines when somebody asks for them.
That is a deliberate trade. Live co-editing needs a server that can read your work, which is the one thing this design refuses to build.
Seats, devices, and leaving
Your second machine
A seat is a person, not a device. Your laptop and your desktop cost one seat between them. Each still enrols separately, because each generates its own key.
Revoking a device
An admin can revoke a device or remove a member, and future syncs stop at the next renewal. Entitlements are short, which is what makes that quick.
What revocation cannot do
Reach backwards. A plan already pulled onto a machine stays on that machine. Anyone claiming otherwise, about any product, is describing a wish rather than a mechanism.
If you stop paying
Team sync stops. Everything local keeps working exactly as before — plans, versions, history, CLI, MCP server, web UI. Nothing is deleted or held hostage, because none of it was ever anywhere else.
Not open yet
Mesh is on the roadmap. The planned price is $19seat / month per member, with a 14-day trial. Seats are per person, not per device.