Effective 2026-08-31
Starling is a location sharing app built so that the people running it cannot see your location, and there is nothing to sell because there is nothing collected to sell. This page says exactly what the app and its relay know about you, in plain language.
Starling does not ask for a name, email address, phone number, or any sign-up. There is no user database. A "circle" is created by generating a random secret on your device; nothing about you is attached to it.
Positions are encrypted with AES-256-GCM using a key derived from your circle's secret before they are sent anywhere. That secret lives only inside invite links, in the part of the URL that browsers never transmit to a server. The relay that moves messages between your circle's devices stores and forwards ciphertext it cannot decrypt. Names, avatars, and status text travel inside that same ciphertext.
Running any server means the server sees some things. The relay sees:
The relay never sees a position, a name, or which people belong to a circle together. All ciphertext rows expire automatically after 24 hours, and there are no backups kept beyond that window by design.
Circle members never see each other's IP addresses; everything moves through the relay. If you also want the relay not to see yours, route the Android app through Orbot: there is a toggle in settings, and Orbot's per-app VPN mode works with no setup at all.
Location sharing happens in the Android app only. This website is a landing page and a demo; it will not create or open a circle, and the demo runs entirely on your device with invented data and no network requests. Sharing done here by older versions of the web app stays encrypted in your browser's storage until you erase it from the page.
When the street map basemap is on, the app fetches map tiles from
tile.openstreetmap.org to draw the background map. That request
reveals your IP address and the rough area you are viewing to OpenStreetMap's
tile hosts, the same as any map app that uses their tiles. Switch to the
Off-grid basemap in settings and the app renders the map locally and makes
no tile requests at all.
Your circle memberships, the app lock passcode, cached member positions, and any local settings live in your device's local storage only. Starling does not run analytics, crash reporting, or advertising code, and makes no network requests beyond the relay and, optionally, map tiles.
There is no account to delete because there is no account. To leave a circle, stop sharing and remove it from your device; its ciphertext on the relay expires within 24 hours regardless. Panic wipe, available from the app, immediately clears everything Starling has stored on your device. If you self-host your own relay, deletion of that relay's data is entirely under your own control.
Starling does not sell, rent, or share any data with advertisers, data brokers, or any third party, because it does not have your data to share in the first place. The people who run the default relay cannot read your location even if compelled to hand over everything they have.
The relay is open source. If you would rather not use the default relay at all, you can run your own and point the app at it in settings. This policy describes the default relay at starlingmap.app; a relay you run yourself is governed by whatever you choose to do with it.
If this policy changes, the effective date at the top of this page changes with it. Material changes will be noted in the project's changelog.
Questions or concerns: Munzzyy1@proton.me.