About NWatch

NWatch helps trusted local groups coordinate urgent alerts with a deliberately small interface and clear responsibility boundaries.

The contracting entity and operator details are stated in the current Terms and Privacy Policy.

Doc status: Latest (rolling). See Versions.

The trust model

The single most important design decision in NWatch is this: group access is scoped to invited, manager-controlled groups with no public searchable directory or automatic admission.

This is not a social network. There is no global feed, discovery page or algorithmic matching. A member's mobile experience is scoped to one primary group at a time. The manager decides who joins through invite codes, who stays active and who is paused or removed. An invitation is an access-control decision; it does not prove that every member knows every other member personally.

This structure is intentional. Growth in the number of groups does not create a global member feed or searchable group directory. People may ask NWatch for a manual introduction to a participating community group, but the manager still decides whether to issue an invite. The mobile home screen operates one primary group at a time; a manager can oversee multiple groups in the portal.

The emergency alerting function is critical, but the curated, human-scale group is what makes it trustworthy.

Product goals

• Extremely simple onboarding and use under stress
• Observable alert fan-out through push services, with honest delivery status
• Minimal data storage (PII-minimising by default)
• Secure, server-verified admin actions
• Low maintenance architecture (managed services + Cloudflare edge)

Users & roles

• Member (standard user):

  • Authenticates through Firebase using Google, passwordless email, or Microsoft when enabled; Sign in with Apple is also available on iOS
  • Joins groups by invite code
  • Registers device push token (automatic on sign-in)
  • Attempts an incident alert by sliding right and holding for two seconds; releasing before completion cancels
  • Stores address locally on-device (never sent in plain text)
  • Can manually rotate their encryption keys from the settings menu
  • Can tap GPS coordinates in an alert to open the location in their maps app
  • Can delete their active account and device-held NWatch data from the app, subject to the limited retention described in the Privacy Policy
  • Receives professionally formatted error messages directing them to their group manager for support

• Manager:

  • Authenticates in the manager portal with Google, passwordless email, or Microsoft when enabled
  • Creates groups (with geohash-5 zone selection via interactive map)
  • Creates invite codes
  • Pauses/bans members
  • Reviews member device readiness and version information
  • Reveals one incident's encrypted details through an audited workflow, then resolves the incident
  • Manages seats, licences and billing for their groups
  • Receives support error refs from members for fast issue resolution

• Super admin:

  • Authenticates through Microsoft Entra ID and Cloudflare Access on the separate administrative console
  • Performs platform-wide administration; plaintext incident reveal remains separately gated by direct active group membership
  • Views platform users, groups, licences and payments
  • Sets user roles (standard/manager/super_admin)
  • Grants and revokes licenses

Principles

Data minimisation

• Do not persist saved home addresses as plaintext profile fields.
• Avoid storing exact coordinates where possible.
• Prefer coarse location buckets (e.g. a zone id / geohash bucket) over exact latitude/longitude.
• A saved address is stored on-device; for a stored alert, its address snapshot is retained server-side only inside the recipient-specific envelopes that were successfully sealed.

Security-first permissions

• Every privileged action is verified server-side.
• Client UI is not trusted for authorization decisions.

Operational simplicity

• Push fan-out and authorization logic lives in the Cloudflare Worker API.
• Mobile uses Expo SDK 55 with @react-native-firebase/auth native SDK — initializes via platform config files, no JS-level initialization.
• Mobile PQC operations are native-first where supported (including CryptoKit-backed iOS operations) with a Hermes-compatible pure-JavaScript fallback using mlkem and @noble/ciphers.
• Firebase provides Firestore + FCM primitives for mobile.
• Firebase identity protects the manager portal; Cloudflare Access + Microsoft Entra ID protect the separate super-admin console.
• Mobile is deliberately focused: sign in → join a primary group → verify readiness → send or receive alerts.

Non-goals (by design)

• Continuous location tracking
• Storing saved addresses as plaintext server profile fields
• Social features, feeds, or “engagement” loops
• Medical advice, emergency triage, or replacing emergency services
• Scaling the end-user experience beyond their group (this is intentional, not a limitation)

Glossary

• Group: a neighbourhood safety group with a coarse zoneId.
• Invite code: short code used to join a group.
• Incident: an emergency event triggered by a member.