Answers to the questions people actually ask about how Mylo handles privacy and security. For the full legal details, see the privacy policy.
Mylo is designed so that a breach of our servers reveals nothing readable about your location, your identity, or who you share with. The security model assumes we are compromised, and holds anyway.
No. Your location is encrypted on your device before it leaves your phone. Our servers store only ciphertext. We have no key with which to decrypt it, so we cannot see where you are — not now, not ever, not even if legally compelled.
Each group has a symmetric encryption key that exists only on the devices of its members. Your location, named places, and group member list are all encrypted with this key using 256-bit authenticated encryption (XSalsa20-Poly1305) before being uploaded.
When a new member joins, they receive the group key wrapped to their personal public key using X25519 elliptic-curve key exchange — so only their device can unwrap it. The key is never sent to our servers in a form we can read.
Yes. Alert notification payloads are encrypted end-to-end. Apple and Google route the notification to your device, but the content of the alert is encrypted so neither they nor we can read it.
Mylo's servers never see it in readable form. But to actually draw a map and label where people are, your phone talks to a map provider — Apple Maps / Apple location services on iOS, Google Maps on Android. Showing the map and turning coordinates into place names sends coordinates (including other members' coordinates, when they aren't at a saved place) to Apple or Google, under their privacy policies — not to us. That's an unavoidable part of any map; we keep it to the platform's own provider and only geocode when needed to label a spot. Similarly, Apple and Google deliver push notifications, so they see routing metadata (which device, and when) even though the alert contents are encrypted.
No. Our servers hold only your current location — an encrypted snapshot of where you are right now. Each new update overwrites the previous one. There is no log of where you have been.
A 24-word phrase (a BIP39 mnemonic) generated on your device when you first open Mylo. Everything — your encryption keys, your user ID, your ability to decrypt your own backup — is derived from it. We never see it. Mylo can display it as a QR code for easy scanning, or you can write the words down. Either way, keep it somewhere safe.
Yes, for two reasons. First, there is no account database for an attacker to breach — there are no credentials to steal. Second, your identity is derived from a secret that lives only on your device, rather than from a server-issued credential. Account takeover, the most common way people lose access to things, is not possible.
No. Your Mylo ID is a public fingerprint of your key — safe for the people in your groups to see, and useless without your private key, which never leaves your device. Claiming an ID requires proving you hold the matching private key through a cryptographic challenge, and once bound, an ID is locked to that key for good. Knowing someone's ID doesn't let you become them, read their data, or take over their account.
On iOS: your recovery seed syncs to iCloud Keychain automatically. Set up a new phone with the same Apple ID and Mylo restores itself — no phrase needed.
On Android: your recovery seed syncs via Block Store, Google's end-to-end encrypted credential store. Switch to a new phone with the same Google account and Mylo usually restores itself the same way — Block Store restore is best-effort (it requires a screen lock and Google backup to be enabled), so keep your recovery phrase saved too.
Universal fallback: your recovery phrase works on any device, any platform, regardless of whether Block Store or iCloud Keychain is available. Save it as a QR code or write down the 24 words and keep it somewhere safe. Without it, and without platform sync, your groups are unrecoverable — we cannot decrypt them on your behalf.
To make restoring to a new device seamless, Mylo encrypts your app data — group memberships, named places, alert rules, and settings — and stores it on our servers. The backup is encrypted with a key derived from your recovery seed, so it is completely unreadable to us. It exists solely so that once you restore your seed on a new device, your groups and settings reappear automatically.
Your location blob on the server is overwritten immediately with an encrypted "paused" status containing no coordinates. Other group members see that you have paused but cannot see where you are. No location data is retained for the period you were paused. When you resume, your device starts publishing again from that moment forward.
The behavior is the same either way: the group key rotates and all stored content is re-encrypted under the new key. The departing member's devices stop receiving updates and cannot decrypt anything published after they left. Their previously cached data on their own device is not erased remotely — Mylo cannot reach into another device.
No. Sharing is strictly scoped to groups you belong to. There is no public profile, no discoverability, and no way for someone outside your group to find or view you.
No. Alerts are visible to the person being watched: your group screen shows a "watching me" list of every alert anyone has set on you, and an eye icon appears next to members who are watching you. You can block any watcher's alerts with a tap — their rules simply stop firing.
Most location sharing apps require an account tied to your email or phone number, and the service itself can read your location. Mylo can't — everything is encrypted before it leaves your device, and we have no account linking you to your data.
Many of these apps have business models built on monetizing user data. Mylo has no third-party analytics, no advertising SDKs, and no data to sell. The business model is the app, not you.
We would comply with any valid legal order, but there is very little of value to hand over. We store only encrypted blobs we cannot decrypt, random user IDs with no real-world identity attached, which IDs share a group with which, push notification tokens, and timestamps. We have no name, email address, phone number, or readable location to provide.
We do not store your name, email, phone number, contacts, or location history, or any usage analytics tied to you — only anonymous, aggregate counts (e.g. daily app opens by platform) that contain no user IDs or location. (An optional avatar or place photo you choose to set is stored end-to-end encrypted, like everything else above.)
Your encryption keys live on your device. Your locally cached group data remains readable as long as your device and the app exist. Live location sharing would stop working since it relies on our relay servers, but nothing about your key or your locally cached data would be affected. We would give reasonable notice before shutting down.
Settings → Delete my account wipes your server-side data, authenticated with your on-device key: it leaves or deletes your groups (removing your encrypted location, place, and alert blobs), then removes your push notification tokens and preferences. Deleting the app also clears your local data. And because everything on our servers is encrypted with your recovery seed, anything left is permanently inaccessible to anyone — including us — without it.
Not yet. We use well-established open cryptographic primitives (libsodium, XSalsa20-Poly1305, X25519) rather than anything novel or proprietary, which limits the attack surface that an audit would need to cover. An independent audit is something we are open to and expect to pursue as the app grows.
No advertising, attribution, or third-party analytics SDKs. We have no business model that depends on your data, and we intend to keep it that way. The only diagnostic tool is Sentry crash reporting, which is opt-out (Settings → Send crash reports) and scrubbed of all identifiers — coordinates, keys, IDs, display names, and tokens — before anything is sent.
One platform exception worth noting: on Android, Mylo uses the Google Maps SDK for map rendering and geocoding. Google independently collects device metadata and usage data through that SDK per their own privacy policy — this is outside our control. On iOS, Apple Maps and Apple location services are used instead, which Apple describes as privacy-preserving by design.
No. Mylo was built by experienced engineers using Claude Code to move faster. Every architectural decision, especially the encryption scheme and keyless server design, was made, reviewed, and owned by a human.
Vibe coding means shipping what the model produced without understanding it. Engineering with AI means using it to execute decisions you made and can defend. Mylo is the second one.
If there's a bug, the responsibility is ours.