Mylo is a privacy-first, end-to-end encrypted location sharing app for iOS and Android. This policy explains what data the app accesses, how it is used, and what we — the operators of the backend — can and cannot see.
The short version: Mylo has no accounts — no email, phone number, or name. Your identity is a cryptographic key generated on your device, and the only identifier our servers see is derived from it. Your location, places, display names, and alert rules are end-to-end encrypted before they leave your phone, so our servers store only ciphertext they cannot read. The honest exception: to draw a map and turn coordinates into place labels, your phone sends coordinates to Apple or Google, and to deliver push notifications, Apple and Google see routing metadata. Those are covered in detail below.
Mylo lets you share your location with small groups of people you trust. All sharing is scoped to groups — there is no bilateral 1-to-1 connection model. Your device publishes its current location to the groups you belong to, and receives the locations of other members of those groups. You can also create named places, set alert rules ("notify me when Alice arrives at home"), and pause sharing at any time.
Every piece of group content — your live location, your named places, your group's member list, and your display name within a group — is encrypted on your device with a per-group symmetric key before it ever leaves your phone. The encryption uses 256-bit authenticated encryption (XSalsa20-Poly1305) via the libsodium cryptographic library.
The group key never leaves the devices of group members in plaintext. New members receive the key wrapped to their personal public key, which is itself derived on-device from a recovery seed that we never see.
This means our servers store only ciphertext. We cannot read your location, your places, the names or members of your groups, or any messages exchanged through the app, even if compelled to do so. We have no key with which to decrypt them.
Mylo uses Supabase and Firebase as backend infrastructure to relay encrypted blobs between devices and to deliver push notifications. The only things our servers see are:
Like any server, ours can see the shape of that data even though it cannot read it: which anonymous IDs belong to which group, which ID has set an alert on which, and when encrypted blobs change and how big they are. That is the routing skeleton the service needs in order to work — none of it names, or can be traced to, a person. Requests naturally arrive with an IP address; it is handled transiently by our infrastructure and is not stored with your data.
We do not store an account, an email address, a phone number, your real name, or your contacts. The only usage data we keep is anonymous, aggregate counters that are not tied to you — for example, how many devices opened the app on a given day, broken down by platform. These contain no user IDs and no location.
Mylo requests location access — including background location — so it can publish updates to your groups while the app is not in the foreground. Updates are throttled: while the app is running, small movements (under about 30 meters) are suppressed and larger movements publish promptly; if the app has been closed, a 150-meter background geofence triggers updates. A keepalive is also published every 5 minutes to confirm you are still in the same location. When you pause a group, your device overwrites its location blob on the server with an encrypted "paused" status containing no coordinates, and stops publishing to that group until you resume.
On iOS, location updates continue in the background automatically. When you fully close the app, a notification is sent reminding you to reopen Mylo; background location processing continues quietly in the meantime.
On Android, a background service with a persistent notification keeps location running while you use other apps. After a device reboot, the service cannot restart automatically, so Mylo sends a notification asking you to tap to resume.
The camera is used only during onboarding and restore, to scan your recovery seed QR code. No photo is captured or saved in that process. You can also scan from a saved image instead of using the live camera.
If you choose a photo from your library as your avatar or for a saved place, Mylo reads only that one image — it never scans or otherwise accesses your library. The photo is end-to-end encrypted before it's stored, so it's unreadable to us.
Notifications are used to alert you when an alert rule fires (for example, when a group member arrives at or leaves a place). Push notifications are delivered via Apple Push Notification service (APNs) on iOS and Firebase Cloud Messaging (FCM) on Android. Notification payloads are encrypted end-to-end, so neither Apple, Google, nor we can read the contents. However, because Apple and Google operate the delivery network, they necessarily see routing metadata — which device a notification is going to, and the associated timing — under their own privacy policies.
This is the most important nuance to understand. Mylo's own servers never see your location in readable form — but to actually show people on a map, your phone has to talk to a map provider, and that provider is not Mylo:
These requests go to Apple or Google, not to Mylo, and are governed by their respective privacy policies. We do not see or intercept them. This is an unavoidable consequence of showing a real map; we minimize it by only geocoding when needed to label a location, and by relying on the platform's own map provider rather than a third-party one.
Mylo stores the following locally on your device:
Your identity in Mylo is derived from a recovery seed (a BIP39 mnemonic) that is generated on your device. We never see this seed. On iOS, the seed is also mirrored to iCloud Keychain (if you are signed into an Apple ID), allowing automatic restore on a new device. On Android, it is mirrored to Block Store — Google's end-to-end encrypted credential store — so it can restore on a new device set up under the same Google account; this is best-effort, since it requires a screen lock and Google backup to be enabled. As a universal fallback on either platform, you can save the seed as a QR code or write down the 24 words and keep them somewhere safe. If you lose your device without any way to restore your seed, the groups you belong to are unrecoverable, because we cannot decrypt them on your behalf.
When a member leaves a group — whether they leave themselves or are removed by the organizer — the group key is rotated and all stored content is re-encrypted under the new key, so the departing member cannot read any subsequent updates. Their prior decrypted cache on their own device is not erased remotely — Mylo cannot reach into their device.
Mylo uses the following third-party services:
We use no advertising, attribution, or third-party analytics SDKs. The only diagnostic service is Sentry crash reporting, described next.
To keep background location delivery reliable across the wide range of devices and OS versions in the wild, the app reports a small amount of technical health data about how it is running. A record can include the app build number, what woke the app up, whether the app is in the foreground or background, the accuracy radius of the last GPS fix (a precision value in meters — not a position), and background-task and battery state. It contains no location coordinates and no message content. It is keyed to your anonymous user ID so we can distinguish one device's reliability from another's, and it is automatically deleted after 30 days.
To help us find and fix bugs that crash or break the app, we use Sentry (Functional Software, Inc.) to collect crash reports. A report includes your device model, OS version and locale, the Mylo build number, the stack trace where the error occurred, and a short trail of recent in-app navigation events.
Before a report leaves your device, Mylo automatically scrubs anything that could identify you or your contacts — user and group identifiers, location coordinates, display names, push notification tokens, authentication tokens, and encrypted message contents are stripped or never collected. We do not send Sentry your email address, IP address, or any personally identifying information. Sentry retains crash reports for 90 days.
You can turn this off entirely in Settings → Send crash reports. When disabled, nothing is sent to Sentry. Sentry's privacy policy: sentry.io/privacy.
Mylo is designed for families and trusted groups, and a child using Mylo does so within a group set up and managed by a parent or guardian. Because Mylo has no accounts and never collects a name, email, or phone number, the information associated with any user — including a child — is limited to the anonymous, end-to-end encrypted data described throughout this policy. We do not knowingly collect personal information from children beyond that, and we do not build advertising or marketing profiles of anyone. If you are a parent or guardian with questions about your child's use of Mylo, contact us at privacy@luci.blue.
Wherever you live, you can access, export, or delete your data yourself, directly inside the app:
Because Mylo does not store your name or email address, we cannot look up your account from an email alone — please use the in-app tools, which are authenticated with your on-device key. For anything they don't cover, email privacy@luci.blue. We do not sell or share your personal data for advertising or any other purpose, so there is nothing to opt out of on that front.
Because the data on our servers is encrypted and not tied to your real-world identity, a breach of our servers would expose ciphertext and anonymous identifiers rather than readable personal information.
If this policy changes, the updated version will be posted at this URL with a new "Last updated" date.