How encryption works
In plain language
Each group has a secret encryption key that only the members' phones hold. Your phone uses it to lock your location and battery level before sending them. The server stores the locked data and passes it to the other members' phones, which unlock it. The server never has the key.
The key is replaced whenever someone joins or leaves the group, or a phone is set up on an account. New members can only read what's shared after they join. People who leave can't read anything shared after they've gone.
Technical details
Keys on each phone
Each phone creates an X25519 key pair for each account the first time it signs in. The private key is stored in the phone's secure storage (Android Keystore through Expo SecureStore, readable only while the phone is unlocked) and never leaves it. The public key is registered with the server.
Group keys
A group's key has numbered generations called epochs. A new epoch starts when the group is created, when someone joins or leaves, and when a phone is set up on a member's account. A removed phone is left out of the next epoch.
The phone that starts an epoch generates the key and encrypts a copy for every active phone in the group, using HPKE in authenticated mode (RFC 9180: DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, ChaCha20-Poly1305). Each copy is bound to the epoch, the recipient phone and the sending phone. A phone only accepts a copy made by the phone the server records as the epoch's creator.
Locations and battery
Each location fix is encrypted on the phone with XChaCha20-Poly1305 under the current epoch key. The group, epoch, kind of data and sending phone are bound to the ciphertext as authenticated data, so the server can't move it to another group or relabel it without detection.
History key
Every account has a random, versioned History key (X25519), created when its first phone signs in. When an epoch starts, its key is also encrypted to each member's current History key, so any phone holding that History key can read the account's history. The server stores the public half, and the private half only sealed to your recovery phrase if you set one up.
A phone signed in to an account that already has a set-up phone can't see anyone's location until it gets the History key, in one of two ways: a device link or the recovery phrase.
Device links
The new phone shows a QR code holding its public key and a 32-byte secret that never reaches the server. A phone that's already set up scans it, checks that the server has the same public key registered for the new phone, and seals every History key version to it with HPKE in authenticated PSK mode, using that secret. The server stores the sealed copy and marks the new phone as set up. The new phone opens it and checks each private key against the published History public keys.
Because the approving phone only encrypts to the key in the QR code, and the secret proves it saw that code, the server can't redirect the handover to a phone of its own.
Recovery phrase
The recovery phrase is 12 BIP39 words (128 bits). A Recovery key (X25519) is derived from it with HKDF-SHA256. Only its public key is sent.
When you set up a phrase, each History key's private half is sealed to the Recovery key with HPKE in authenticated mode, bound to the account and version, and stored on the server. Entering the phrase on a new phone opens these, so the phone can read earlier epochs.
Keeping the History key separate from the phrase means the phrase can be changed without re-encrypting anything.
Nicknames and colours
Nicknames you give other members and your group colours are encrypted on your phone to your History key. Only your phones can read them.
What isn't end-to-end encrypted
Names, email addresses, group names, group membership and roles, device names and icons, and profile and group pictures are stored so the server can read them. See What the server can see.