Lode

Privacy

Lode can’t see where your family is.

Updated November 2026

What Lode can’t see
Where your family isLocked on your phone with your circle’s own key before it’s sent. Lode only passes it on.
Your messages, photos and voice notesLocked the same way; photos and voice notes travel as their own locked files.
Your placesHome, school, work, the alerts you set and trip routes: locked too.
Battery and statusLocked the same way.
Who you areNo account, email or password.
Anything to sellNo ads, no data brokers. Your location is never sold.

New Lode Family builds lock an alert’s words too, like “Ana got home”. On older builds, that short text goes through Lode and Apple to reach your Lock Screen. It isn’t kept.

How it’s locked
One key per circleA random 256-bit key made on the phone that starts the circle. Everything is sealed with it (XSalsa20-Poly1305, from the TweetNaCl library).
The key stays on your phonesKept on each member’s phone. Lode never receives it.
Invites carry it safelyAn invite link’s code is after the “#”, which browsers never send on. The code unlocks a sealed note holding the key, and the note is deleted when the invite expires (48 hours).
What Lode can still see
That a circle existsIts random ID and how many phones are in it.
When phones send updatesThe times, and roughly how big they are, not what’s in them.
Alert timingYour quiet hours and “urgent only” choices, so Lode knows when to wake your phone. While you drive, that your chat alerts should wait, and who in the circle wrote meanwhile, until you stop (if your phone never says it stopped, it goes 6 hours later, with the circle’s next message).
Lock Screen alertsOnly the kind of alert (like an arrival, an SOS, or that someone is at a hospital but not which one). On new Lode Family builds an alert’s words are locked on the sender’s phone and opened on yours. A phone on an older build still gets the first name and place in the open, through Lode and Apple’s push service; they aren’t kept.
Links in chatThe message stays locked, but a link’s address is sent to Lode so it can read the page’s title and picture for the preview (the site never sees your phone). The preview is kept a day for that link, not who sent it.
Your IP addressAs with any website; not kept with your circle.
On your iPhone
Stays on your phonePlaces, searches, drives, settings.
Only what’s neededRequests aren’t tied to you.
Sharing is encryptedLode can’t read your location.
What’s sent
MapArea on screen. The map’s lettering and icons come from OpenFreeMap (no location in those), and if Lode can’t answer, the map itself does too
Lode (OpenStreetMap data, extra place pins from Overture Maps), OpenFreeMap
SearchYour search, rough location
Apple, TomTom, Esri, Photon, U.S. Census
DirectionsStart and destination
Valhalla, Transitous (offline areas: on your iPhone)
TrafficArea and route
TomTom
Place details and hoursThe place you opened
OpenStreetMap, TomTom, Lode (store data from All The Places and Overture Maps)
Place ratingsYour thumbs up or down, the place
Lode (totals only)
Hours fixesThe hours you send or “was it open?”, the place (kept 60 days, with a short code made from your connection so one person can’t confirm their own fix)
Lode; once two drivers agree, an anonymous public note on OpenStreetMap
Road details on your routeYour route, to find low bridges (trucks, RVs), school zones, speed cameras, closed roads, exits, and chargers or places along the way
OpenStreetMap (Overpass)
WeatherRough location
Apple Weather, National Weather Service
Evacuation (hurricanes, floods)Rough location, when you open shelters, evacuation routes or a town inland
National Weather Service, OpenStreetMap (Overpass), Photon
EV chargersRough location
U.S. Dept. of Energy
Flights (Lode Family)The flight number in a circle member’s status: where it goes comes through Lode; where the plane is now, your iPhone asks adsb.lol with the flight number only
Lode, adsb.lol
Family CircleLocations, status, places and place notes, birthdays (month and day), chat, photos and voice notes, end-to-end encrypted: Lode stores them but can’t open them (see how it’s locked)
Lode
Link previews (circle chat)The address of a link in a chat message, so Lode can read the page’s title and picture; the site never sees your iPhone. The preview is kept a day for that link, not who sent it
Lode, the linked website
Help near them (Lode Family)When you ask for the nearest hospital, pharmacy, gas station or police to someone in your circle: where they are, rounded to about 100 m, from your iPhone
Apple, OpenStreetMap (Overpass)
Stop names (Lode Family)Where someone in your circle stopped, from your iPhone, so their Stops can show the street or place there. Lode isn’t involved
Apple
At the hospital (Lode Family)When you’ve stayed about 5 minutes in one place while in a circle: where you are, rounded to about 100 m, from your iPhone, to see if it’s a hospital. Lode isn’t involved; if it is one, your circle gets a locked alert with its name
Apple
Speed alerts (Lode Family)When you drive fast enough for your circle’s speed alert: where you are, from your iPhone, so the alert can name the road and town. Lode isn’t involved; your circle gets a locked alert with them
Apple
Emergency number (SOS)Where you are, from your iPhone, about every 10 km, so SOS calls the emergency number of the country you’re in. Lode isn’t involved
Apple
Family mapArea on screen. The satellite pictures come through Lode, so your iPhone never contacts their source; newer builds draw Apple’s map
Lode (MapTiler, Esri), Apple Maps
Family alertsFirst name and alert
Lode, Expo, Apple
Road reportsThe kind of report and where (rounded to about 10 m), no account. Kept with a short code made from your connection that changes every day, so one person can’t push out everyone else’s reports
Lode
Shared placesWhen a place you shared is opened or shown as a link preview: the place and its name (it’s in the link). Lode draws a map picture of it for the preview and keeps that picture, not who shared or opened it
Lode (Cloudflare)
Place logosThe business’s name, website or Wikidata ID. Lode looks them up and passes the logo on; your iPhone never contacts them
Lode (Wikimedia, the business’s website)
Email to LodeMessages you send to an @lodemaps.app address, kept until answered or deleted
Lode (Cloudflare Email)
Road speeds (while navigating)How fast you move on spots of your route (rounded to about 100 m) and where you turn around, with a random number that changes every trip and a short code made from your connection that changes every day. No account, no trip history
Lode (shown to other drivers as slowdowns and closed roads)
Voice commands (Hey Lode)Your words are written out by Apple’s speech recognition (on your iPhone when it can). Only if you allow it (Lode asks once; Settings › Ask Claude when unsure), a sentence Lode’s own rules didn’t understand goes on, with whether you’re navigating: never where you are or the recording. The answer is kept a day for the same words
Apple, Lode, Anthropic (Claude) or Cloudflare Workers AI
Usage countsHow often something happens at Lode (Lode opened, hours or pins looked up, an alert of some kind sent, a failure) and the country your connection comes from. No account, circle, device, address or location
Lode (Cloudflare, totals only)
Crash reportsError and iPhone model
Sentry
Drive logs (TestFlight builds only)Your route, GPS and what the voice said, only if you turn on Settings › Drive logs › Record drives (it starts off). App Store builds never send them
Lode
How long it’s kept
Push-to-talk10 min
Road speeds15 min (turnarounds 3 hours)
Road reports3 hours
Convoy12 hours after the last update
Live locationUntil you arrive or stop, 8 hours at most (24 hours for the link in a text to 911)
Family invite48 hours
Family Circle and photo30 days unused
Family chatThe last 200 messages, 30 days at most; photos and voice notes 60 days; the chat background until someone changes it or the circle ends, 400 days at most
Permissions
LocationMaps and directions. “Always” only for Family Circle with Lode closed, arrival alerts, and location you choose to share.
MicrophoneOnly while you talk to Lode: push-to-talk, a voice note, or “Hey Lode”. In Lode Family also for 30 seconds after you send an SOS, sent sealed to your circle’s chat so they can hear what’s happening.
Speech recognitionTurns a command or a voice note into words, on your iPhone.
PhotosOnly the photos you pick: your profile photo, photos you send your circle and a chat background. Lode adds a photo to your library only when you save one from chat.
CameraOnly when you take a photo for your circle: your profile picture, or a photo for its chat.
CalendarLode Family only, when you tap Add to Calendar on a plan: iOS’s own new-event sheet, filled in, for you to check and save. Lode never reads your calendar.
MotionCrash detection, to notice a possible car crash and check on you, and while navigating, to turn the car on the map the moment you turn. The readings stay on your iPhone.
Face IDOnly if you lock your circle, move your circles to a new iPhone, or end Lost mode.
Local networkLode Family only: finds phones in your circle nearby over Bluetooth and Wi-Fi, so you still see each other and can send an SOS with no cell service. Only while Lode Family is open; only your circle can read what goes over.
NotificationsFamily and weather alerts, “Are you OK?” checks after a possible crash or on a walk, and “Leave by” times for trips you make often. On Android, they reach your phone through Google’s Firebase.
Children
With a parentChildren under 13 use Lode Family with a parent, who sets it up and invites them to the family’s circle.
Nothing to sellNo ads, no tracking across apps, no profiles of children. Nothing is sold.
Only the circle sees itA child’s location, messages and photos are locked like everyone’s: only their circle can see them.
Parents decideRemove a child from the circle and their location and alerts are deleted from Lode. To ask what we hold or to delete anything, email us.
When someone leaves
Removed means shut outLode bans a removed phone at once and locks the circle, so it can’t fetch anything new, even though it once had the key.
Their data goesTheir location and alerts are deleted from Lode.
What Lode never does
No ads, no tracking codeNo ad networks or analytics that follow you.
Nothing soldNot to advertisers, data brokers or anyone.
Crash reportsIf Lode crashes, a report of the code that failed is sent so we can fix it. We keep locations, names and messages out of it.
Your rights
See what we holdAsk and we’ll tell you what Lode has about you, and send you a copy.
Delete itLeave a circle and your location, alert choices and notification address are deleted at once. Whoever started a circle can end it for everyone. Ask and we delete anything else.
Correct or stop itChange your name or photo in the app, turn features off in Settings, or ask us to stop using something.
Take back a yesLocation, notifications, the microphone and Ask Claude are only used once you allow them. Turn them off anytime in Settings.
ComplainIn the EU or the UK you can complain to your data protection authority. We’d rather hear from you first.

Lode’s apps are made by Lode LLC, a North Carolina company, which is responsible for your data. We use it to run the features you use, crash reports to keep the apps working, and the optional features only once you turn them on. Nothing about you is decided automatically. The services under What’s sent may handle requests in the United States or elsewhere. Email us and we answer within 30 days.

support@lodemaps.app