Effective 2026-10-05
Starling is a location sharing app built so that the people running it cannot see your location, and there is nothing to sell because there is nothing collected to sell. This page says exactly what the app and its relay know about you, in plain language.
Starling does not ask for a name, email address, phone number, or any sign-up. There is no user database. A "circle" is created by generating a random secret on your device; nothing about you is attached to it.
Positions are encrypted with AES-256-GCM using a key derived from your circle's secret before they are sent anywhere. That secret is made on your device and never travels in an invite link: an invite carries a one-time code, and a new member receives the circle's keys only after you compare a safety number with them and accept. The relay that moves messages between your circle's devices stores and forwards ciphertext it cannot decrypt. Names, avatars, and status text travel inside that same ciphertext.
Running any server means the server sees some things. The relay sees:
The relay never sees a position, a name, or which people belong to a circle together. All ciphertext rows expire automatically after 24 hours, and there are no backups kept beyond that window by design.
Circle members never see each other's IP addresses; everything moves through the relay. If you also want the relay not to see yours, route the Android app through Orbot: there is a toggle in settings, and Orbot's per-app VPN mode works with no setup at all.
The default relay runs on Cloudflare Workers, with its database in Cloudflare D1. Cloudflare carries every request to it, so Cloudflare sees the same things the relay does: IP addresses, timing, and ciphertext sizes. It cannot read the ciphertext any more than the relay can. The relay's own request logging on Cloudflare is switched off, but Cloudflare handles the traffic it carries under its own privacy policy. Routing the app through Orbot keeps your IP address from Cloudflare as well.
Location sharing happens in the Starling apps only: the Android app, and an iOS app you can build from source. This website is a landing page and a demo; it will not create or open a circle. The demo runs entirely on your device with invented data and makes no network requests, unless you ask it for a real map, which loads OpenStreetMap tiles of its Central Park stage. Sharing done here by older versions of the web app stays encrypted in your browser's storage until you erase it from the page.
When the street map basemap is on, the app fetches map tiles from
tile.openstreetmap.org to draw the background map. That request
reveals your IP address and the rough area you are viewing to OpenStreetMap's
tile hosts, the same as any map app that uses their tiles. Switch to the
Off-grid basemap in settings and the app renders the map locally and makes
no tile requests at all.
If you set "Your own server" in the Android app, your phone also sends your own position, in OwnTracks format, straight to the address you give, while you share. It never goes through the relay or anywhere we run. That server is yours, and what it keeps is up to you. If you set a tracker ID, it goes along with each position. Nothing is sent while Tor mode is on.
The Android app has two switches, both off by default, that bring a share back by itself after the phone restarts or the app updates. Turning one on asks Android to let Starling use your location all the time, not only while the app is open. A share that comes back sends the same encrypted posts to the same relay as any other share: nothing new is collected and nothing goes anywhere new. It always shows the sharing notification while it runs, and an alert that it came back. With both switches off, Starling uses that permission for nothing, even if Android has granted it, and a panic wipe gives it back.
Your circle memberships, the app lock's wrapped key (never the passcode itself), cached member positions, and any local settings live in your device's local storage only. Starling does not run analytics, crash reporting, or advertising code, and makes no network requests beyond the relay and, optionally, map tiles.
Places, the named spots like Home or School that the app can announce arrivals at, are part of that same local-only data. Their names and coordinates are never sent to the relay, to other circle members, or anywhere else; arrival detection runs entirely on your device against positions that were already arriving as part of sharing. Alerts about them are built locally too: the Android app posts notifications through the operating system on your phone, not through any push service.
There is no account to delete because there is no account. To leave a circle, stop sharing and remove it from your device; its ciphertext on the relay expires within 24 hours regardless. Panic wipe, available from the app, immediately clears everything Starling has stored on your device. If you self-host your own relay, deletion of that relay's data is entirely under your own control.
Starling does not sell, rent, or share any data with advertisers, data brokers, or any third party, because it does not have your data to share in the first place. The people who run the default relay cannot read your location even if compelled to hand over everything they have.
The relay is open source. If you would rather not use the default relay at all, you can run your own and point the app at it in settings, on Cloudflare Workers or a plain server of your own. This policy describes the default relay at starlingmap.app; a relay you run yourself is governed by whatever you choose to do with it.
If this policy changes, the effective date at the top of this page changes with it. Material changes will be noted in the project's changelog.
Questions or concerns: Munzzyy1@proton.me.