Security

How we keep your location private.

A plain-English overview of homebird’s encryption, written for families and for security folks.

The keys

  • Every phone has its own key pair

    Created on your phone the first time you sign in, and kept in the phone’s secure storage (iOS Keychain or Android Keystore). The private key never leaves your phone and isn’t backed up to our servers.

  • Every nest has its own key

    A random 256-bit key. It’s delivered to each member’s phone sealed to that phone’s public key, so only that phone can open it.

  • Keys change when people leave

    Removing someone, someone leaving, or revoking a lost phone gives the nest a new key, so they can’t read anything shared afterward.

What’s encrypted

  • Locations, places and alerts

    Encrypted on your phone before upload and decrypted only on your nest’s phones. Place arrivals are worked out on the phone.

  • Messages, photos, calendar and vault

    The same nest key protects chat, profile and nest photos, calendar events, vault items and emergency cards.

  • Notifications

    A notification only tells a phone that something new arrived. The phone downloads and decrypts the details itself.

The building blocks

All cryptography comes from libsodium, a widely used, well-reviewed library. We never write our own encryption. Data is encrypted with XChaCha20-Poly1305 using a fresh random nonce every time, and nest keys are delivered with X25519 sealed boxes. Each encrypted item is bound to its nest, key version and type, so it can’t be moved or replayed somewhere else.

What our servers can see

Your email and display name, who is in which nest, when things happen (for example, when someone last updated their location), and how big the encrypted data is. Not where anyone is, not place names, not what messages, photos, calendar events, vault items or emergency cards say. Apple, Google and our push provider see that a notification was sent, never what it’s about. The full list is on What we can and can’t see.

What we don’t protect against

Someone who has your unlocked phone, or a current member of your nest who shares what they see. A member you remove may have kept things shared before they left. Timing patterns (who shares with whom, and when) are visible to our servers.

Access control

Our database enforces row-level security on every table, so one nest can’t read another’s data even by mistake. Automated tests check these rules on every change.

Status

Homebird is new. Our design hasn’t had an independent security review yet; we plan to get one, and we’ll post the results here.

Report a security problem

Please tell us privately at security@homebirdapp.com before sharing it publicly. Include what you found and how to reproduce it. We’ll reply within 3 business days, keep you updated, and credit you if you’d like. Please don’t access other people’s data, disrupt the service, or use social engineering. Good-faith research under these rules is welcome, and we won’t pursue legal action over it.