The commercial availability of low-cost millimeterwave (mmWave) communication and radar devices is starting to improve the adoption of such technologies in consumer markets, paving the way for large-scale and dense deployments in fifthgeneration (5G)-and-beyond as well as 6G networks. At the same time, pervasive mmWave access will enable device localization and device-free sensing with unprecedented accuracy, especially with respect to sub-6 GHz commercial-grade devices.This paper surveys the state of the art in device-based localization and device-free sensing using mmWave communication and radar devices, with a focus on indoor deployments. We overview key concepts about mmWave signal propagation and system design, detailing approaches, algorithms and applications for mmWave localization and sensing. Several dimensions are considered, including the main objectives, techniques, and performance of each work, whether they reached an implementation stage, and which hardware platforms or software tools were used.We analyze theoretical (including signal processing and machine learning), technological, and implementation (hardware and prototyping) aspects, exposing under-performing or missing techniques and items towards enabling a highly effective sensing of human parameters, such as position, movement, activity and vital signs. Among many interesting findings, we observe that device-based localization systems would greatly benefit from commercial-grade hardware that exposes channel state information, as well as from a better integration between standardcompliant mmWave initial access and localization algorithms, especially with multiple access points (APs). Moreover, more advanced algorithms requiring zero-initial knowledge of the environment would greatly help improve the adoption of mmWave simultaneous localization and mapping (SLAM). Machine learning (ML)-based algorithms are gaining momentum, but still require the collection of extensive training datasets, and do not yet generalize to any indoor environment, limiting their applicability. Manuscript received xxxx xx, xxxx . . .