Privacy policy
The short version. Hearth is self-hosted. Apart from the map, street-name and notification services listed below, the app sends your account, your location and your family's data to one place only: the Hearth server you choose to sign in to. That server is run by you, your family, or someone you trust. It is not run by the people who make Hearth, and we cannot see anything on it. There are no ads, no analytics, no crash reporting and no tracking SDKs in the app. Other family locators keep your location on their own servers. Hearth keeps it on yours, and nothing comes to us.
Who this policy is from
Hearth is open-source software published by the Hearth project (github.com/Qureshi-DH/hearth). We publish the app and the server software. We do not run a Hearth service, and we do not receive, store or process the data the app handles.
Who is responsible for your data
Whoever operates the server you connect to. If you set up Hearth for your family, that is you. If someone else did, that is them, and they decide how long history is kept, who can sign up and where backups go. Questions about data held on a server, and requests to see, correct or delete it, go to its operator. The app's own controls, described below, cover most of them.
What the app sends to your server
| Data | Why |
|---|---|
| Email address, display name and password | To create and sign in to your account. The server stores the password as a hash. |
| Profile photo, if you add one | So your circle recognises you. The app re-encodes the photo before uploading, which removes the location and camera details it may contain. |
| Location: position, accuracy, speed, heading, altitude, and whether you are still, walking, running, cycling or driving | To show your circle where you are, notice when you arrive at or leave a place, record trips, and raise SOS and crash alerts. |
| Battery level and whether the phone is charging | So your circle can tell a flat battery from a phone that is simply quiet. |
| Device name and maker, platform, app and system version, a notification token, the IP address and user agent the device last connected with, and whether its location permission, battery optimisation, power saving or background settings would stop it sharing | To list your signed-in devices, deliver notifications to them, help the operator spot a sign-in that isn't yours, and show your circle why a phone has gone quiet. |
| What you create: circles, places, check-ins, SOS alerts and quick messages | Because those are the features you are using. |
By default a server keeps your location history for 30 days, and never more than 90. A circle's admins can change the first number for their circle, and the server's operator can change the second. If you are in several circles, the longest setting decides how long your history is kept, and each circle only sees back as far as its own setting. Your current position is kept until the next one replaces it. The check-ins, arrivals and departures recorded in a circle's activity feed are not covered by these limits and stay until the circle is deleted.
Location in the background
While sharing is on, Hearth collects your location even when the app is closed or not in use. That is what lets your family see you without you opening the app, and what makes arrival alerts, trips, SOS and crash detection work. When you have stopped somewhere, the app switches to a low-power mode and reports rarely. You can pause sharing or share only an approximate area (about 750 metres), separately for each circle, unless a circle's admin has turned pausing off. Either one changes what that circle sees, but the phone still sends your location to your server, which keeps it as history. To stop the phone sending it at all, turn off Share my location, which you can do at any time.
Services the app talks to besides your server
- Notifications. What happens depends on how your server is set up. With Expo push, the phone registers with Expo's push service, and notifications travel from your server through Expo and then Apple Push Notification service or Firebase Cloud Messaging. With ntfy, notifications go through an ntfy server your operator runs and are shown by the ntfy app. On iPhone the ntfy app's wake-up signal still goes through Apple, and may go through ntfy's public server depending on how that ntfy server is set up. With neither, no notification is sent through any service. On Android, an app built with Firebase, which Expo push needs, registers the phone with Firebase Cloud Messaging when it starts, whichever of these your server uses. That registration carries identifiers for the app and the phone and no location. A notification carries names, a short line of text such as "Maya arrived at School", and ids. It never contains coordinates.
- Maps. Map images are downloaded from the map provider your server is configured with, OpenFreeMap by default. Like any map, the provider can see which area you are looking at and your IP address.
- Street names. To show "near Valencia St", the app asks the phone's own geocoding service, Apple's on iPhone and Google's on Android, which receives the coordinates being looked up. You can turn street names off in You.
- Directions. If you ask for directions to someone, the app opens your phone's maps app at their position.
- App stores. Apple and Google collect data about downloads and purchases under their own policies.
That is the complete list. Nothing else leaves your phone.
What stays on your phone
Your settings, a short queue of locations waiting to upload if you are offline, street names the phone has already looked up, and a diagnostic log of what the tracker did. The log never leaves the phone unless you choose to share it from You, Tracker diagnostics. Your sign-in tokens are kept in the phone's secure storage.
Permissions
Location, including background location. Motion and fitness (iPhone) or physical activity (Android), so the app knows when you are still and can save battery. Notifications. The camera, only when you scan an invite QR code. Your photos, only through the system picker, which hands the app the one image you choose. On Android, an exemption from battery optimisation so the phone does not stop sharing in the background. On iPhone, local network access, which iOS asks about only when your server is on your home network. Hearth never asks for your contacts, microphone, Bluetooth or advertising identifier.
Crash detection reads the accelerometer, gyroscope and barometer during a drive, when one of your circles has turned it on. Those readings are worked through on the phone and are not uploaded. Only the alert is, if a crash is detected and you don't cancel it.
Your choices
- Pause, approximate or stop sharing in You, Location sharing.
- Download your profile, circles, location history, trips, check-ins and the places you created in You, Privacy & data, Export my data.
- Erase your location history in You, Privacy & data, Erase my location history.
- Delete your account in You, Privacy & data, Delete my account. See deleting your account for exactly what that removes.
Children
Hearth is made for families, and families often use it to keep track of children. We do not collect data from anyone, children included. Accounts for children, like everyone else's, live on the family's own server, which by default only lets someone sign up with an invite from a circle's admin. Anyone in a circle has the same controls as everyone else, including pausing and leaving, unless a circle admin has turned pausing off, which every member can see.
Security
The store versions of the app connect to servers on the internet only over HTTPS. On iPhone, plain HTTP is allowed only for a server on your own local network, and on Android not at all. How the server itself is secured and backed up is up to its operator.
Changes
If this policy changes, the new version will be published here with a new effective date, and the history of every change is public in the project's repository.
Contact
For questions about this policy or the app, open an issue at github.com/Qureshi-DH/hearth/issues. For questions about the data on a particular server, contact the person who runs it.