Marmots are profoundly social animals. They live in close family groups, keep watch for one another, and communicate through sharp whistles that carry across distance — a simple system built on trust, awareness, and care. Most location-sharing apps route your real-time movements through servers that store, analyse, and monetise your patterns. They require accounts, phone numbers, and emails — turning a simple "are you home safe?" into permanent surveillance infrastructure you didn't ask for. Whistle is built around a different principle. It’s a private, encrypted group network designed to keep people connected without intermediaries. No servers. No accounts. No data trails. Just direct, secure sharing between the people you choose. Built on open-source tools and public cryptography, it uses Nostr for identity and message delivery, MLS for end-to-end encryption, and Marmot as the glue that binds it all together. Share your location when it matters, with the people who need it. Stop when it doesn’t. Who it's for The family circle — quiet reassurance that someone got home safe, or is on their way, without the ping of a constant text. No history being archived. Shared in the moment, then gone. The festival crew — find each other across four stages without the endless "where are you?" chain. No need to swap numbers with everyone or install a 200MB official app. Group evaporates Monday morning. The late walk home — temporary visibility while you're in a taxi or crossing an unfamiliar city. The digital equivalent of "text me when you're home" — without handing your data to a platform. The school trip — lightweight coordination for teachers and small groups splitting off, without turning the day into a surveillance exercise. What it does Create or join an encrypted group, share a live map with your people, and chat — all end-to-end encrypted. No relay ever sees plaintext location data or group membership. Family groups — create or join with a shareable invite code Live map — see everyone's location, updated on a configurable interval Group chat — built-in encrypted messaging for the whole group Tap-to-join — share invites via QR code, NFC tap, or AirDrop Pause/resume — stop sharing your location anytime without leaving the group Movement aware — automatically backs off location updates when a device is stationary, resumes normal rate on movement Low-battery alerts — notifies the group when a member's battery is critically low Multiple groups — belong to more than one circle at a time Cross-platform — native iOS and Android apps that interop seamlessly No accounts — identity is a Nostr keypair stored on-device Open protocol — built on Nostr + MLS via the Marmot Protocol; no proprietary server, no lock-in Security Model Location and chat payloads are encrypted using MLS (RFC 9420): Epoch-based key rotation — group keys advance with every membership change Forward secrecy — old messages stay secret even if current keys are compromised Post-compromise security — future messages are secure after a key rotation Member roster — tracked cryptographically, not by relay policy Proper join/leave/rejoin handling — via MLS Add/Remove Proposals and Commits Group traffic is published as Marmot-compatible Nostr events: Kind Purpose 30443 MLS KeyPackage — used to add members to the group (addressable, MDK 0.8.0+) 444 Welcome — bootstraps a new member's group state (gift-wrapped) 445 Group Event — all in-group traffic: Commits, location updates, chat 10051 KeyPackage relay list