Privacy policy

Updated September 24, 2026. Applies to Breadcrumbs: Inner Circle and its support website. Release-specific differences are described below.

Who operates Breadcrumbs

Breadcrumbs: Inner Circle is operated by Yangrongrui He. For support or privacy requests, email frankheeee@gmail.com.

Your choices

Location sharing is off until you explicitly enable it for a chosen person. Circle membership alone does not grant location access. You can select a duration, revoke an individual permission, or stop all sharing. The app requests iPhone location permission; it does not request your contacts, camera, or microphone.

The upcoming location-controls update also uses your location to show your own map without publishing it to other people. Background publication is an independent choice for each recipient. iOS location permission applies to Breadcrumbs as a whole, not separately to each recipient.

Information used by the app

The service stores your chosen display name, a generated account identifier, public encryption key, a hash of your authentication token, circle memberships, invitations, and sharing permissions. These are used to operate your account and enforce access. Your private encryption key and authentication token are stored in your iPhone Keychain, not in the service database.

When sharing, your iPhone processes latitude, longitude, GPS accuracy, speed, heading, and observation time. It encrypts these details separately for each chosen recipient before sending them to the service. Intended recipients decrypt them on their devices. The service can see delivery metadata, including sender and recipient identifiers and timestamps, but does not possess your private encryption key.

No location history

There is no location-history feature. The relay keeps only the latest encrypted update for each sender-recipient pair in memory. Updates expire from sharing within two minutes of observation and are automatically cleared from memory. The relay does not write location packets to its database or disk. Restarting the relay discards its location packets.

The app keeps received locations in memory rather than a location-history database. Other people can remember or capture information they have already seen. Revoking access cannot erase their screenshots or memories.

Retention and deletion

Account and circle metadata remain while needed to operate the account. Unused invitations expire after 24 hours. Deleting your account in Settings removes its server profile, memberships, permissions, and owned circles. It also removes that identity from your app's Keychain. Copies of information already received by other people are outside our control.

Your identity is device-bound. Losing access to your device or Keychain can prevent account recovery. Contact support if you cannot use the in-app deletion flow; ownership verification may be required.

Service providers

Google Cloud runs the relay and stores account metadata, and Firebase Hosting serves this website. Apple MapKit supplies the map imagery and may process requested map regions under Apple's privacy policy. Network and certificate providers process the connection information needed to deliver their services. The server receives your IP address and temporarily uses it for abuse prevention.

Starting with version 1.1.0, Expo delivers compatible app updates. Update requests include an installation identifier, platform, app runtime and update versions, release channel, IP address, and request time. After a startup failure, the update system can send a limited fatal-error diagnostic to help recover the app. These technical identifiers and diagnostics support app operation and update recovery, not advertising tracking. We do not intentionally send your display name, circle memberships, shared coordinates, invitation tokens, or private encryption keys to Expo. Expo processes operational information under its privacy policy.

The relay does not log request bodies, authentication tokens, or coordinates. We do not include advertising or analytics SDKs in the app, sell location data, or use it for targeted advertising. Infrastructure providers may process operational metadata under their own policies.

Security and limitations

Connections use HTTPS. Location encryption uses X25519, HKDF-SHA256, and AES-GCM with recipient and timestamp authentication. Version 1.0 asks you to compare safety codes through a trusted channel. The upcoming invitation-link update removes manual comparison and trusts circle members' keys on first use, saving them on your device and refusing changed keys. That update relies on the service for initial identity and does not provide independent identity verification.

This is not a forward-secret messaging protocol: compromise of a device's long-term private key can affect the protection of intercepted encrypted updates. No security system can guarantee protection against every threat.

Support and privacy requests

Email frankheeee@gmail.com for access, correction, deletion, or other privacy requests. If you email us, we receive your email address and the information you include and use it to respond. Please do not include precise locations, private keys, tokens, or invitation codes.

Changes

We will update this page when our practices change and provide an appropriate notice for material changes. The effective date appears above.