End-to-end encrypted location sharing means your location is scrambled on your phone and only unscrambled on the phones of the people you share with. The company running the app passes the scrambled data along but cannot read it. That protects you if a server is breached or misused. It does not hide everything, and it does not protect you from someone you chose to share with.
The plain-language version
Think of a locked box. You put your location in the box on your phone and lock it. The box travels through the internet and sits on a server for a moment. Only the phones in your circle hold a key that opens it.
The Electronic Frontier Foundation describes the same idea for messages: with end-to-end encryption, a message is scrambled on the sender's device and only the final recipient can decode it, and even the app's servers cannot listen in. It contrasts this with encryption that only protects data on each leg of the trip, where the provider in the middle can still read it. See the EFF's guide to what you should know about encryption.
Location is just another message. The same principle applies.
Why it matters for a family app
A family location app holds a very personal record: where you sleep, where your children go to school, which doctor you visit, when you are away from home. If that record sits readable on a company's server, it is only as safe as the company, its staff, its suppliers and its last security update.
With end-to-end encryption, the server holds scrambled data. A breach, a leaked password or a curious employee gets ciphertext, not a map of your family. That is a different kind of promise from "we promise not to look".
How Orma does it
Each circle has its own key. It is created on a phone and passed only from phone to phone, through invite links or approvals on your own phones.
- Your live location, your location history, saved places, arrivals and departures, SOS alerts, profile photos, people's names and circle names are encrypted on your iPhone before they leave it.
- Our servers store only the scrambled version.
- The key in an invite link sits in the part of the link after the
#, which is not sent to our servers. - Push notifications carry generic text such as "Someone in your circle needs help". Your iPhone fills in names after decrypting them.
When you get a new phone, the new phone does not get the key automatically. Your old phone asks "Is this your new phone?" and you compare codes on both screens before approving. Everyone in the circle is told when a new phone joins. The guide on moving your circles to a new iPhone walks through it.
What end-to-end encryption protects against
- A server breach. If someone gets into the database, they get scrambled locations.
- A rogue or compromised operator. Staff at the company cannot read your location because they do not hold the key.
- Anyone watching the network. Data is scrambled before it travels.
- Being sold or handed over. A company cannot sell or hand over what it cannot read. We also do not sell data or share it for advertising. See the privacy policy.
What it does not protect against
It is better to be honest about this.
The people in your circle
Members of your circle hold the key. They can see what you share, by design. That is the point of a circle. Only invite people you trust, and know that anyone in a circle could, in theory, copy or screenshot what they see.
A compromised phone
If someone has your unlocked phone, or malware is running on it, encryption in transit does not help. The data has to be readable on the phone for the app to work. Use a passcode.
A tampered app
End-to-end encryption relies on the app on your phone doing what it says. If the app itself were altered, the protection would not hold. This is one reason a company's claims should be specific, not vague.
Metadata
Metadata is the information around your data, such as who talked to whom and when, rather than the content itself. The EFF explains that metadata is everything except the content of your communications, like an envelope that shows sender and destination without revealing the letter inside.
For Orma, our servers still need some of it to run the service. They can see:
- your email address from Sign in with Apple (it may be an Apple private relay address)
- which circles you are in, and which phones your account has
- when things change, such as when a location update or alert was sent
- check-in times
- push tokens, and IP addresses in short-lived logs
They cannot see where you are, where your places are, what your circles are called or what the people in them are called. The privacy policy lists exactly what we can and cannot see.
Apple also delivers push notifications. Because Orma's push text is generic, Apple does not see the names or details in it.
How to judge any app that claims "end-to-end encrypted"
Ask these questions of any app, ours included.
- What exactly is encrypted? Locations only, or also places, names and alerts?
- What can the company still see? A good answer is a specific list, not "very little".
- How do new phones get the key? If a server can quietly add a phone to your account and receive the key, the encryption is weaker than it sounds.
- Who else can read it? The circle members are trusted by design. Is that said plainly?
- What happens to old data? Orma keeps location history for 30 days, then deletes it.
Where this fits in the wider picture
Location data is valuable, and a whole industry buys and sells it. We explain why that matters in where your location data goes. End-to-end encryption is one answer to that problem: the best way to avoid your location being sold is for the company to never be able to read it.
FAQ
Can the people who make Orma see my location?
No. Your location is encrypted on your iPhone with a key only your circle's phones hold. Our servers store scrambled data. They can see account and circle details, such as which circles you are in and when updates happen.
What is metadata, and does Orma see it?
Metadata is the information about your data rather than the data itself, like timing and account details. Our servers can see some of it, such as which circles you are in, when an update was sent and check-in times. We list all of it in the privacy policy.
Does end-to-end encryption stop the people in my circle seeing my location?
No. They hold the key and see what you share, by design. You choose who is in your circle, and you can stop sharing at any time or leave a circle.
Is end-to-end encryption the same as a secure connection (HTTPS)?
No. A secure connection protects data on its way to a server, and the server can then read it. End-to-end encryption means the server cannot read it at all.