Onepoint Agent — client-encrypted location-sharing surface

TL;DR: The Onepoint Agent is a recipient-scoped, client-encrypted foreground location-sharing platform surface. Plaintext coordinates are never stored on the server or transmitted in API responses, ensuring absolute user privacy.

Status as of 2026-07-24: see body.

Relations

Overview

The Onepoint Agent (formerly One Location Agent, part of the harvested Damria location stack) provides a highly secure, recipient-scoped, client-encrypted location sharing capability. Following Hussh's privacy-first design principles, plaintext coordinates are never stored in backend databases, logged, or exposed in server responses.

In the latest release, the Onepoint Agent has been expanded with a full-featured "Drive To" flow (destination search, local caching, and live ETA sharing) and unified under a single trusted_connections social graph, completing major roadmap milestones. Additionally, the user interface accent color has been completely transitioned from warm-gold to a crisp Apple system blue (#007aff) to conform precisely with Apple's Summer 2026 design standards.

Key Principles & Architecture

Client-Side Encryption: Coordinates are captured in the foreground on the owner's device, encrypted with ephemeral ECDH P-256 keys and AES-GCM 256, and packaged into recipient-scoped envelopes before transmission.
Zero Server Plaintext: The backend stores and retrieves ciphertext envelopes only. It does not reverse-geocode, map, track, or inspect latitude/longitude values.
Recipient Decryption: Only the authorized recipient's device can decrypt the location envelope locally using their private key material.
No Background Tracking: The native Capacitor mobile plugin (HushhLocation) operates foreground-only on iOS and Android. No background permissions or tracking are implemented.
Device-to-Device Capability Tokens: Live-location sharing now rides the consent protocol. A live-location grant mints a signed HCT consent token scoped cap.location.live.view, bound to a device:<recipient_user_id> agent identity, expiring with the grant. The recipient device exercises this token as its capability, and the backend cryptographically validates it (signature, expiry, scope) before accepting any ciphertext envelope. Legacy tokenless grants fall back to DB checks, ensuring backward compatibility.

The "Drive To" flow allows users to share their current location journey along with a live-updating ETA to selected trusted connections.

Google Maps Proxy Service: All map lookup, place autocomplete, and route-ETA computation tasks are proxied through authenticated backend routes under consent-protocol using a secure, server-side GOOGLE_MAPS_API_KEY.
Native Dark Map Night Styles: One Location opens native maps via self-contained night styles, matching the mobile dark theme seamlessly.
Camera Padding Footprint Anchor: Map camera padding is anchored directly to the collapsed people-tray footprint. Toggling the people-tray no longer triggers camera pan/zoom jitter, and redundant padding updates are deduplicated.
Cost & Battery Throttling: Live ETA is recalculated at most once every 60 seconds or after moving 250 meters, protecting device batteries and API bounds.

Pick Me Up Flow (Mutual Live Location & Helper Watch)

The Pick Me Up flow enables mutual location-sharing between a requester and a trusted helper who is en route to pick them up:

Mutual-Share Handshake: When a user requests a "Pick Me Up," their location is shared with a helper. Once the helper responds with "I'm on my way," a reverse pickup share of the helper's en-route coordinates (pickup_enroute) is established back to the requester.
Live ETA & Interactive Watch: Requesters view a "helper is on the way" live card on their dashboard displaying the helper's live-updating ETA and travel path.
Session Rehydration Resilience: To ensure seamless tracking, en-route drive sessions persist and automatically rehydrate on page refreshes, protecting active navigation sessions from network/browser interruptions.
Command Place-Search Dialog: Utilizes a custom shadcn Command dialog for place lookup and destination selection, speeding up entry and keeping styling consistent.
Responsive Navigation Theme: Primary action highlights and selected bottom tabs use a clean Apple system blue (#007aff) to visually direct focus, with Molten Gold preserved as a switchable alternative accent.

Onboarding & Setup One-Time Lock

Recent UX updates refine first-time onboarding and screen layout:

One-Screen Fitting: Onboarding cards and feature highlights fit on a single screen without vertical clipping or awkward scroll triggers.
One-Time Setup Locking: Onboarding setup is strictly one-time — once completed, the setup screen becomes unreachable via browser or OS back navigation, landing the user directly on their active location hub.
Trust-First Hero & Promises: The main interface hero clearly communicates: "Let the people you trust see where you are - only when you choose, only for as long as you choose. We can never see it."
Robust Geolocation Failover: Web geolocation helpers accurately map permissions and fail over to network triangulation upon GPS timeouts.

Public Request Links & Location Snapshots

To facilitate sharing with third parties, Onepoint uses a secure public request-link workflow rather than a public map viewer:

Access-Request Mode: Owners generate a duration-bounded public request link via /one/location. Visitors submit contact metadata to request access.
Public Location Snapshot (View-Once Handshake): Owners attach a single, static coordinate snapshot. Once a visitor completes the secure handshake, the coordinate snapshot is displayed instantly.
12-Hour Retention Purge: All expired or revoked sharing grants, ciphertext envelopes, and public location snapshots are purged from the database after at most 12 hours.

Sources

Hussh Research Repository