1.3 ยท AGPL-3.0

Know where your family is. Nobody else does.

Every commercial family safety app keeps your positions on its own servers, under a privacy policy you do not control and they can change. Hearth has no servers. It runs on yours, and there is nobody on the other end to sell anything to.

Self-host it Get the app

Coming soon to the App Store and Play Store. The apps are built, tested and in review, so for now you build it yourself.

Live view following David at 46 km/h near Harrison Street
Hearth's family map with five members, their places and battery levels
David's page while he drives, with his recent trips

Inside the app

A map your family will actually open.

Every picture on this page is the app itself: a release build, running against a server with a made-up family on it.

Live view following David at 46 km/h near Harrison Street

Watch a drive as it happens.

Open Live on anybody who shares precisely with you, driving or standing still, and their phone sends a fix a second, with speed and street, for as long as you keep the page open. Within seconds of the last person watching leaving, it goes back to its usual pace.

  • Battery, walking or driving, and how old each fix is
  • Opening someone's page asks their phone for a fresh fix
  • Directions to anyone, in your own maps app
The places list: Grandma's, Gym, Home, School and Work, with who is at each
The activity feed with the day's arrivals, departures and trips

Know who got where.

Draw a circle around home, school or work. Arrivals and departures land in the family feed next to every trip, and on everyone's lock screen once push notifications are set up.

  • Trips worked out on the server, with distance and top speed
  • Leaving takes 40 metres more than arriving, so a boundary stays quiet
  • A one-tap check-in when you get somewhere
Location sharing settings: precise, approximate or paused for the Family circle

Every circle sees what you choose.

Precise, an area about 750 metres wide, or paused, set separately for each circle. Turn off Share my location and the phone stops reporting altogether.

  • Going back to precise doesn't reveal the time in between
  • Invites are codes, never your address book
  • An SOS cuts through every mute in the circle

What it does

Everything a family safety app should do.

None of it phones home. Every feature below runs against the server you control.

A live map

Everyone's position with battery level, whether they're walking or driving, and how long ago it arrived. Live over a websocket while the app is open.

Places

Draw a circle around home, school or work and everyone is told on arrival and departure. Leaving needs more distance than arriving, so a phone sitting on the boundary doesn't spam the family.

Trips and history

Journeys are detected and drawn as a trail with distance, duration and top speed. You choose how many days the server keeps, or none at all.

SOS and check-ins

Hold to raise an alert that reaches everyone at full volume with your position. Or send a quiet "I got here safely" when that is all it needs to be.

Alerts you configure

Speeding, low battery, and a crash the phone works out from its own accelerometer, gyroscope and barometer. It asks you first, and only silence raises the alarm. The family sets each one, and speeding and crash alerts stay off until it turns them on.

A word, not a group chat

See that someone was driving at 95 and send them "slow down" in one tap. It goes to that one person, shows on their map, and lands in the family feed.

Every screen

Have a look around.

Why bother

Your data stays home.

A family safety app is only as private as whoever runs it. There is no company running Hearth, no account with us, and no analytics, ad network or crash reporter anywhere in the app. When you stop running the server, the data is gone, because it was only ever yours.

  • Three sharing modes Precise, approximate, or paused. Approximate snaps you to a 750 metre grid, chosen per family rather than globally.
  • No data broker in the path Beyond your server, the app only reaches the map host, push, and the phone's own maps service for street names, which you can turn off. No analytics, no ad network.
  • It never asks for your contacts Invites are codes, not your address book. No microphone, no Bluetooth, no advertising identifier.
  • Delete means delete Export everything the server holds about you, or remove your account and its history outright.
  • The GPS sleeps when you do GPS updates run while you are moving and stop once you park, which is most of the battery story on a phone.
  • Read the code AGPL-3.0, so anyone who runs it as a service for other people has to keep their changes open too.

Self-host

One compose file and a hostname.

Postgres and MinIO come with it, migrations run on first boot, and the bucket creates itself. The server is a published image, so upgrading is a pull, not a rebuild. If you already run anything behind a reverse proxy, this will feel familiar.

  1. Make a folder, add docker-compose.yml and .env, and set JWT_SECRET, PUBLIC_URL, ADMIN_EMAIL, ADMIN_PASSWORD and the database and storage passwords.
  2. Bring it up. Your administrator account is created on that first boot, and it is the only way in, so nobody can claim a server you have not signed into.
  3. Put TLS in front, open the app, type your server address and sign in. Everyone else joins with an invite code you send them. 
services:
  api:
    image: dhqureshi/hearth-api:latest
    env_file: [.env]
    ports: ["127.0.0.1:4000:4000"]
    depends_on: [db, minio]
Self-hosting guide Docker image

Where anything goes besides your server

Map tiles are fetched from a public tile server by default, which sees roughly what part of the world you are looking at. Point that setting at your own tiles and even that stops. Street names come from the phone's own maps service, Apple's or Google's, which is sent each spot it names. They are on by default, and one switch in the app turns them off. And if you turn on push through a hosted relay, notification payloads go through it, which is why the default is no push at all rather than a convenient default that quietly costs you something. An Android build that includes Firebase for push also registers the phone with Google when it starts.

What 1.3 means

The features above are built and tested, and it runs a real family. It has not been through a security audit, and Android has had less device testing than iOS. The store builds are still in review, and they won't carry the maintainer's own push keys, so push only fully works in a build you make yourself. Read SECURITY.md before you point it at the internet.