Location sharing that starts switched off.

Sharing is a property of a relationship, not of your phone

A single on/off switch cannot describe a real day. You can be Dark to a hunting Crew, Live to a work Crew, and sharing a Journey with your partner — all at the same instant, on one phone. STALKR treats each of those as its own scope, and every surface that decides whether a position may leave the device asks the same question about the same scope.

• A scope is a pair: which kind of audience, and which specific Crew or Journey.
• Live in one Crew does not make you Live in another, and it does not start a Journey.
• A Journey watcher sees the Journey because they hold its watch link, not because they share a Crew with you.
• Going Dark in every Crew leaves an active Journey running; ending a Journey leaves your Crews exactly as you set them.
• Nothing becomes visible because it is nearby, or because someone knows your name.

Nothing is published until you answer

A Crew starts Dark. Not off-by-default-until-you-notice: the absence of a decision is itself the record that you never opted in, so an unanswered Crew broadcasts nothing at all.

The first time a Crew could publish your position, STALKR asks, names that Crew, and waits. Answering either way writes an explicit choice, which is why the question is asked once rather than nagged.

• Joining a Crew does not start sharing your location.
• The prompt names the Crew, so consent is given to a specific audience rather than to the app in general.
• Choosing to share while location permission is denied is refused rather than recorded — STALKR will not read LIVE while sending nothing.
• Journeys are the deliberate exception: starting one is the affirmative act, because you picked the destination and handed someone the link. Ending the Journey is how it stops.

Live, Dark, and what Dark does not do

Dark stops new current-location updates to the selected Crew. It is a stop rather than a deletion, and STALKR says so instead of implying more than it does.

The last position you were authorised to share stays with that Crew, labelled offline or stale by age. Removing it would hide that you were somewhere rather than protect where you are now, and a safety tool that quietly rewrites where people have been is not safer for anyone.

• Dark is per Crew. Going Dark in one Crew changes nothing for your other Crews.
• Dark does not end a Journey — that is a separate control in a separate scope.
• Going Live requests a fresh fix rather than reusing the last one, so viewers are not handed an old point presented as current.
• A Crew owner can set Tracking Enforced. STALKR then refuses the Dark toggle and says why, instead of letting a switch read DARK while the tracker keeps publishing. Enforcement is visible or it is not allowed.

Approximate sharing, and the price it charges

You can reduce precision instead of going Dark. STALKR rounds the published position to roughly a kilometre, and the sharing flag travels with it, so viewers are told they are looking at an area rather than handed a vague point that appears exact.

That choice has a real cost, and the app states it where you make it. While you share an approximate area, Crew Zone alerts are off completely: the server refuses to infer which Zone a blurred position is standing in, so no Crew member is told about an enter or a leave. STALKR will not quietly use the precise coordinate you asked it to blur.

• Approximate is a precision reduction, not anonymity. Authorised viewers still receive an area with your name on it.
• It does not change who can see you. Only Dark, or ending a Journey, changes the audience.
• Precision is a device-wide setting, and the card offering it says so — a per-Crew promise there would be one the app could not keep.

Zones that watch places, not people

A Zone is a Crew-scoped area with Enter and Leave alerts. Three things people routinely conflate are kept as separate settings on purpose: whether the shape is drawn on your map, whether the Zone is monitored at all, and which transitions alert.

• Creating a Zone does not start evaluating it. Monitoring does, and it is its own switch.
• Hiding the Zones layer only stops drawing the shape. A Zone you cannot see can still be monitored, which is why those are never the same control.
• Enter and Leave are the transitions the product supports. There is no dwell or overstay alert in the app.
• A Zone belongs to the Crew that owns it and to the members it names; it cannot reach into another Crew or into a Journey.
• Approximate sharing switches Crew Zone alerts off entirely, as above.

Location health, stated honestly

The most dishonest thing a tracking app can do is draw an old point as though it were current. STALKR derives presence from the last successful timestamp and from separate evidence that the pipeline is alive, and when that evidence disappears it degrades to the state the remaining evidence supports — never to a vaguer one that sounds better.

• Live, Live · Moving and Live · Stationary mean a recent fix plus evidence the device is still reporting.
• Last known, Stale and Offline are statements about the age of the data, not about the person.
• Location disabled, Permission lost and Dark name the specific thing that stopped, where the app can tell.
• Unknown stays Unknown. A member whose state cannot be established is not quietly rendered as offline.
• Nothing raises an alarm when someone goes quiet. Presence degrades on the member card, and reading that timestamp is the check — there is no low-signal alert to wait for.

When permission is lost or the phone stops reporting

What a location product does when it stops working is the part worth understanding, and it is where STALKR is deliberately unhelpful to anyone who wants a comfortable dashboard.

• STALKR refuses to claim Live when location permission is denied, and offers to open system Settings instead.
• Repeated failed writes raise a delivery warning to you. A device can hold a perfectly good GPS fix while nothing reaches the Crew, and the two failures need different responses.
• A failed write is not queued for later delivery. A gap in the map is a gap rather than a backlog waiting to flush, and nothing is replayed for the period it failed.
• Your Crew sees a stale timestamp rather than a warning of their own, so that timestamp is the thing to read.
• A member can be stale because they went Dark, lost connectivity, ran out of battery, had permission revoked, or was suspended by the operating system. The label does not guess which.

Why we decline the surveillance use case

STALKR is built for a crew that cannot stay together and still has to stay accounted for: a guide with clients on the water, a survey pair working opposite ends of a block, a tree or utility contractor whose last stop of the day is an hour from the truck. That job needs people to know roughly where you were and to notice when you stop answering. It does not need a manager watching a live board all day.

So the product does not have the parts that job would require, and their absence is a decision rather than a roadmap gap we are being coy about. There is no supervisor or web dashboard, no workforce administration, no enterprise provisioning or SSO, no compliance export or reporting, no professional monitoring centre, and no regulatory certification. If your procurement needs those, STALKR is not your product today, and we would rather say it here than in a sales call.

What is left is the honest version of the same safety outcome. People choose to share, choose how precisely, can stop, and can see exactly what their crew can see. A Crew that requires sharing has to require it visibly. That is what separates a safety tool from a monitoring one, and it is a property of how the app is built rather than a sentence in a privacy policy.

The six controls that do the work

Related NAVTRL Systems