george

I took a quick look at the source code. It's providing end-to-end encryption with libsodium, using crypto_box [1], crypto_secretbox[2], and crypto_pwhash for password-based key derivation [3]. The public key model appears to be TOFU [4]. It's doing a distinct crypto_box per notification [5]. It doesn't use an authenticated key exchange or offer key rotation or forward secrecy, but that's probably fine for this use case. Not too long ago, I wrote a guide to end-to-end encryption [6], and I would classify the "end-to-end encryption" here as meeting the minimum definition (data is encrypted between devices, rather than in a client-server architecture where the server has access to plaintext), even if it's not suitable for more sensitive threat models. One thing I didn't see was message padding of location data prior to encryption, to prevent

That's not my app. Zood Location has zero analytics or telemtry [1]. The app id in the link you provided is some banking app with an id of 'hr.erstebank.george'. Zood Location's app id is 'xyz.zood.george'. The only thing they have in common is the word 'george' in their app identifier string. Zood Location also has a privacy policy. [2] [1] https://github.com/zood/george [2] https://www.zood.xyz/privacy/mobile-apps