Starling
End to end encrypted location sharing. No accounts, no tracking.
جدید در نگارش ۰٫۲۱٫۰
New optional Check in button on the sharing notification: turn it on in Settings, Sharing. A locked phone asks for the unlock first, and it cannot cancel an SOS. Your circle now sees "checked in" when you check in. Your pin no longer bounces between a sharp GPS fix and a vague network one. The circle panel can be dragged from anywhere on it, and a pull down from the top of the full list collapses it.
Starling is private location sharing for your circle: family, a partner, a small group of friends. There is no account to make and no company sitting in the middle reading your position.
End to end encrypted
Your location is encrypted on your device with AES-256-GCM under a key only your circle's phones hold. That key never travels in an invite link: an invite carries a one-time code, and a new member gets the circle's keys only after you compare a safety number with them and accept. The relay stores ciphertext it cannot read. Names, avatars, and statuses ride inside that same ciphertext.
Nothing to sign up for
No phone number. No email. No push tokens. Starling runs no analytics, no crash reporting, and makes no third party requests. The only thing it fetches from outside its own server is OpenStreetMap map tiles, and only if you leave the street basemap on. Switch to the Off-grid basemap and the app draws the map locally, with zero network requests.
A zero-knowledge relay
The relay is a small server that moves ciphertext between your circle's devices. It sees channel ids, message sizes (padded to a fixed length so they carry no information), timing, and IP addresses, but never a position, a name, or who is in your circle. Every row expires after 24 hours and there are no backups by design. The default relay runs on Cloudflare Workers, so Cloudflare sees the same IP addresses and timing. Tor mode hides your IP from both.
Panic wipe
One action clears the app: local storage, cached data, everything. If you need to disappear from a circle fast, this is the button.
App lock
Optional passcode lock encrypts your circle secret at rest, with the passcode stretched by Argon2id (64 MiB, three passes) so every guess costs an attacker real memory. Where the device supports it, your fingerprint or face opens the vault through the Android Keystore, which never leaves the secure hardware on your phone.
Circles, plural
Keep one circle for family and another for the friends you split up from at a fair or a concert. Switch with a tap on the circle name. Every circle has its own key and its own identity, so even the relay cannot tell your groups apart.
SOS and check-ins
Hold to fire an SOS that your circle sees immediately. Check in with a status without leaving your location on all the time.
Live sharing that keeps running
The Android app keeps sharing your location while your screen is off, with a persistent notification the whole time so it is never silent about what it is doing. Swiping the app away ends the share until you reopen Starling, unless "Keep sharing when the app is closed" is on. Opt-in switches bring it back after a restart or an update. One tap stops it; your circle sees "stopped" instead of a dot that just goes stale.
Self-hostable
Don't want to trust our relay? Run your own. The app has a setting for a custom relay address, and the relay is open source and small enough to read in one sitting. Run it on Cloudflare Workers, or as a plain server on your own VPS or home machine behind Apache or nginx, with no Cloudflare account at all.
Works with Orbot
Per-app VPN mode needs no setup. Turn on Power User Mode in Orbot and Starling proxies directly through its SOCKS port instead.
Honest about its limits
The relay still sees IP addresses and timing, because something has to move your ciphertext around. Keys move forward every ten minutes and the old ones are destroyed, but a phone keeps as much readable history as you let it, up to a day, and that is what a stolen phone can give up. Removing someone re-keys the circle, and nothing re-keys on its own if a phone is compromised without you knowing. All of this is written out, with what is and is not backed by tests, in the project's threat model.
Android 9 and newer
Needs Android System WebView 137 or newer. Android 9 has had no security fixes since January 2022.
Source is on GitHub under
End to end encrypted
Your location is encrypted on your device with AES-256-GCM under a key only your circle's phones hold. That key never travels in an invite link: an invite carries a one-time code, and a new member gets the circle's keys only after you compare a safety number with them and accept. The relay stores ciphertext it cannot read. Names, avatars, and statuses ride inside that same ciphertext.
Nothing to sign up for
No phone number. No email. No push tokens. Starling runs no analytics, no crash reporting, and makes no third party requests. The only thing it fetches from outside its own server is OpenStreetMap map tiles, and only if you leave the street basemap on. Switch to the Off-grid basemap and the app draws the map locally, with zero network requests.
A zero-knowledge relay
The relay is a small server that moves ciphertext between your circle's devices. It sees channel ids, message sizes (padded to a fixed length so they carry no information), timing, and IP addresses, but never a position, a name, or who is in your circle. Every row expires after 24 hours and there are no backups by design. The default relay runs on Cloudflare Workers, so Cloudflare sees the same IP addresses and timing. Tor mode hides your IP from both.
Panic wipe
One action clears the app: local storage, cached data, everything. If you need to disappear from a circle fast, this is the button.
App lock
Optional passcode lock encrypts your circle secret at rest, with the passcode stretched by Argon2id (64 MiB, three passes) so every guess costs an attacker real memory. Where the device supports it, your fingerprint or face opens the vault through the Android Keystore, which never leaves the secure hardware on your phone.
Circles, plural
Keep one circle for family and another for the friends you split up from at a fair or a concert. Switch with a tap on the circle name. Every circle has its own key and its own identity, so even the relay cannot tell your groups apart.
SOS and check-ins
Hold to fire an SOS that your circle sees immediately. Check in with a status without leaving your location on all the time.
Live sharing that keeps running
The Android app keeps sharing your location while your screen is off, with a persistent notification the whole time so it is never silent about what it is doing. Swiping the app away ends the share until you reopen Starling, unless "Keep sharing when the app is closed" is on. Opt-in switches bring it back after a restart or an update. One tap stops it; your circle sees "stopped" instead of a dot that just goes stale.
Self-hostable
Don't want to trust our relay? Run your own. The app has a setting for a custom relay address, and the relay is open source and small enough to read in one sitting. Run it on Cloudflare Workers, or as a plain server on your own VPS or home machine behind Apache or nginx, with no Cloudflare account at all.
Works with Orbot
Per-app VPN mode needs no setup. Turn on Power User Mode in Orbot and Starling proxies directly through its SOCKS port instead.
Honest about its limits
The relay still sees IP addresses and timing, because something has to move your ciphertext around. Keys move forward every ten minutes and the old ones are destroyed, but a phone keeps as much readable history as you let it, up to a day, and that is what a stolen phone can give up. Removing someone re-keys the circle, and nothing re-keys on its own if a phone is compromised without you knowing. All of this is written out, with what is and is not backed by tests, in the project's threat model.
Android 9 and newer
Needs Android System WebView 137 or newer. Android 9 has had no security fixes since January 2022.
Source is on GitHub under
پادویژگی‌ها
این کاره، ویژگی‌هایی دارد که شاید نپسندید. بیش‌تر دانستن!
- نگارنده: Munzzyy
- پروانه: GNU General Public License v3.0 or later
- ردیاب مشکل
- کد مبدأ
- گزارش دگرگونی
- فرادادهٔ ساخت
- وضعیت بازتولیدپذیری
اعانه
نگارش‌ها
با وجود موجود بودن بارگیری‌های APK برای دادن حق گزینش، باید آگاه باشید که با نصب به این روش، آگاهی‌های به‌روز رسانی را دریافت نکرده و راهی ناامن برای بارگیری است. پیشنهاد می‌شود کارهٔ اف‌دروید را نصب و از آن استفاده کنید.
بارگیری اف‌دروید-
این نگارش، به اندروید ۹٫۰ یا جدیدتر نیاز دارد.
به دست توسعه‌دهندهٔ اصلی ساخته، امضا شده و برای تطبیق با این کد مبدأ تضمین شده است.
بارگیری APK ۸٫۲ می‌ب امضای PGP | گزارش ساخت
-
این نگارش، به اندروید ۹٫۰ یا جدیدتر نیاز دارد.
به دست توسعه‌دهندهٔ اصلی ساخته، امضا شده و برای تطبیق با این کد مبدأ تضمین شده است.
بارگیری APK ۸٫۲ می‌ب امضای PGP | گزارش ساخت
-
این نگارش، به اندروید ۹٫۰ یا جدیدتر نیاز دارد.
به دست توسعه‌دهندهٔ اصلی ساخته، امضا شده و برای تطبیق با این کد مبدأ تضمین شده است.
بارگیری APK ۸٫۰ می‌ب امضای PGP | گزارش ساخت
جدید در نگارش ۰٫۲۰٫۲
F-Droid builds work again: the Argon2 code behind the app lock is now compiled with the same compiler F-Droid uses, so F-Droid can rebuild it and match the release. The lock itself works exactly as before.
جدید در نگارش ۰٫۱۵٫۲
Invites now work on a relay you host yourself. The link carries the relay's address, so a new phone joins through it, and the first screen lets you pick a relay before you make a circle.