Ghost is the default
Until you name someone, no position is sent — and because the location provider is stopped, none is even taken. Invisible means the phone is not looking.
Map
A map that starts empty, and stays that way until you say otherwise.
Most location features begin by asking forgiveness. This one begins with nobody able to see you — not a setting buried three screens deep, but the state the feature is born in.
End-to-end encryptedPositions and live shares
Visible to named people, or to no one
There is no 'everyone' and no 'friends of friends'. You add people one at a time.
Going dark rotates the key
Turning visibility off mints a fresh key next time you turn it on. The period you spent invisible is not merely unshared; nobody holds a key that could ever open it.
Removing someone re-keys
Adding a person needs no new key. Removing one does — so a former viewer is left holding a key that opens nothing further.
Sharing in a chat is a separate decision
Live location in a conversation is timer-bounded and independent of the map. Stopping one does not stop the other, and they do not share an audience — being on someone’s map has never meant they can watch you move through a chat.
Every fix is encrypted on your phone and relayed as one opaque blob. Positions are never stored: our database holds the fact that a share exists and when it ends, and not a single coordinate.