We described a secure location sharing protocol that is fully decentralized and tolerates up to n=6 active faults. Moreover, our protocol is load-balanced and can tolerate trac-analysis attacks. The amount of information sent and the amount of computations performed by each client scales polylogarithmically with the number of parties. The scalability is achieved by performing local communications and computations in groups of logarithmic size and by relaxing the latency requirements. Several open problems remain. For example, can we design a spatial cloaking technique to trade-o anonymity for eciency while preserving the trac-analysis resistance? Or, can we decrease the number of rounds of our protocol using a smaller-depth sorting circuit? For example, since our protocol sorts uniform random numbers, it seems possible to use a logarithmic depth non-comparison-based sorting circuit like bucket sort to achieve O(n)-anonymity.