How ORBII Works: Every Safety System, Explained

Most safety apps are described by their feature list. That tells you very little, because two apps can both say “SOS alerts” and behave completely differently at eleven at night on a badly lit road.

So this is a walkthrough of the actual systems, how each one behaves, and the design decision behind it. No marketing adjectives, and no claims about parts that are not finished.

1. The trigger: getting rid of the button

Every safety app has the same hidden assumption. She can reach her phone, unlock it, find the app, and press something.

That assumption fails in exactly the moments the app exists for.

ORBII’s trigger is a spoken word. You say it out loud, once, and the phone acts. The recognition runs on the device, using language models shipped inside the app rather than downloaded on first use. That has three consequences that matter more than the feature itself:

• It works with the phone locked and the app closed. There is no “open the app first” step.
• It works with no internet. Nothing is being streamed anywhere to be understood.
• Your voice never leaves the phone. There is no server receiving your audio, which means there is no server that can leak it, be compelled to hand it over, or quietly start selling it.

It listens for English and Hindi. The English model is bundled, which is most of why the app is large. We consider that a fair trade: a safety trigger that needs a download before it works is not a safety trigger.

Hindi is the exception, and we would rather say it here than have you discover it. The Hindi pack is a one time download you switch on, so on a fresh install the Hindi trigger is not there until you fetch it once.

Confirmed on hardware: it fires with the screen off, the app closed, and in a noisy corridor.

2. The ten seconds before anything leaves the phone

A false alarm on a safety app is not harmless. It teaches the user to distrust the thing, and the second time they hesitate.

So a triggered SOS starts a ten second countdown you can cancel. Nothing is sent during that window. This is the single most important piece of restraint in the product, and it is why the trigger can afford to be sensitive.

3. What actually happens when it fires

Not a sequence. Several things at once, because the ordering of a rescue should not depend on which network call returns first.

• Your circle gets your live location, not a single pin
• Nearby ORBII users are alerted
• Evidence recording begins
• A continuous haptic pulse starts, and keeps running through a screen lock
• 112 stays one tap away

The haptic pulse matters more than it sounds. It is the confirmation she can feel without looking at the screen, which is often the only channel available.

It stops the instant her safety PIN is entered. Not a swipe, not a back button. A PIN, because the person most likely to want the alarm silenced is not always her.

4. Circles: small on purpose

A trusted circle holds four people.

That is not a technical limit, it is a decision. A safety net of thirty contacts is a group chat, and nobody in a group chat believes they are the one who has to act. Four people is small enough that each of them knows they are it.

The cap is enforced by a database trigger, not by a check in the app. That distinction is the whole difference between a rule and a suggestion: anything that talks to the database directly still cannot exceed it.

Membership is revocable instantly, and a removed member loses access immediately rather than at their next sign-in.

5. Knowing where she went, and forgetting it by morning

ORBII keeps a location trail so her circle can see where she has been during the day. That is genuinely useful and it is also the most dangerous data the app holds.

So it is deleted after 7 days. Not archived, not anonymised, deleted, by a scheduled job on the database itself.

There is a second guard behind it. Every read of a member’s trail also filters to today, so even if the scheduled deletion fails to run, yesterday can never be displayed. The safety of that data does not depend on one job succeeding.

Ghost mode turns the trail off entirely, on her terms, without leaving the circle.

6. Safe zones

Places she marks: home, hostel, campus, the office. ORBII knows when she arrives and when she leaves, and her circle can be told.

The circle activity feed shows paired visits: who, where, from when to when. Not a stream of pings that nobody reads, but a readable record of what actually happened.

Safe zones are time-aware. Arriving at the hostel at eight in the evening and arriving at three in the morning are different events and are treated differently.

7. The deadman timer

Arm it for a duration. “I am walking back in twenty minutes.”

Ninety seconds before it expires, ORBII reminds you. Extend, or confirm you are safe. Do neither and an SOS goes out with your location and whatever note you left.

The engineering detail that matters: a timer running inside an app dies when Android kills the app, and aggressive battery managers on Xiaomi, Realme, Oppo and Vivo phones kill apps constantly. So ORBII does not rely on its own timer. It hands the alarm to Android’s system alarm service, which survives the app being force stopped.

A deadman timer that quietly stops existing is worse than no deadman timer, because you walked home believing in it.

8. Hold to stay safe

The deadman timer answers “wake someone if I have not checked in by 9:40”. This answers a different question: “the next three minutes are the bad part.”

Press and hold for the walk to the car, the gate, the last stretch to the hostel. While your thumb is down, nothing happens. Letting go raises the alarm, with the same ten second window and safety PIN to stop it.

It is the inverse of every other trigger in the app, and that is deliberate. The failure it covers is being unable to act at all. If the phone is knocked out of her hand, the release is the trigger.

Two details that decide whether it works:

The screen is kept awake for the whole hold. A screen that sleeps under a held thumb ends the gesture, and a safety mode that cancels itself is worse than no safety mode.

It does not send the alert itself. Releasing hands over to the same countdown every other path in ORBII uses. A second alert pipeline is a second thing that can be broken on the night it matters.

It is free, and it is built so it cannot quietly stop being free: no paid entitlement was ever created for it, so there is nothing to switch on later.

9. The responder network

Beyond your circle, ORBII is building a network of verified responders: people who have applied, passed identity checks, and been approved.

The full path exists in code: application, verification, dispatch, staged escalation outward, arrival codes, and a settlement system so a responder is credited only for an arrival that actually happened. The arrival code handshake is what stops that from being farmed.

Two honest notes.

Coverage is being built city by city, starting with Delhi NCR. If you are outside it, the core protections still work everywhere.

Coverage can never gate an emergency. This one is worth stating precisely, because it is the kind of mistake that is easy to make and fatal. Voice SOS, circle alerts, evidence recording and 112 are unconditional, everywhere on earth. The coverage system gates the responder network and nothing else, and it is written so that no SOS path can consult it even by accident.

10. What is built and still being tested

We will not describe these as working, because they have not been proven on real phones in the field yet.

• An SMS lifeline, for signal but no data
• A Bluetooth mesh relay, where your SOS hops phone to phone until it reaches one with a connection
• An offline helper alert
• A disaster mode hub

These are built. They are in hardware testing. We will say clearly the day each one ships, and until then the honest answer to “does ORBII work with no signal” is that an offline SOS is saved and sent the moment you reconnect.

On a safety app, the cost of overclaiming is not a refund. It is somebody relying on something that was not there.

11. Privacy, as architecture rather than a promise

Every safety app’s privacy policy says roughly the same thing. What matters is whether the system is built so that violating it would be difficult.

• Voice recognition runs on the device. There is no audio pipeline to secure, because there is no audio pipeline.
• Location history deletes itself nightly, on a schedule, with a second filter behind it.
• Access is enforced at the database, row by row, so a bug in the app cannot hand out data the database will not release.
• Under-18 location tracking is blocked, in line with India’s DPDP rules.
• We do not sell data. Not to colleges, not to advertisers, not to anybody.

The obvious comparison is a company that was reported to have sold precise user location to data brokers did not do so because its policy allowed it. It did so because the data existed in a form that could be sold. Deleting location nightly and keeping voice on the device is not a stricter promise. It is a smaller pile of things to sell.

12. Where the real work is

If there is one thing to take from this, it is where the effort actually went. Not the feature list. The parts nobody photographs:

• A cap enforced by a database trigger rather than an app check, because a rule only the app enforces is not a rule
• A coverage system deliberately built so it cannot be consulted by an emergency path
• A location wipe with a second filter behind it, so one failed job cannot expose a day of movement
• An alarm handed to the operating system so it survives the app being killed
• A connectivity check that is itself timed out, because a check that hangs must never outlast the alert it was meant to inform

That last one is the whole philosophy in a sentence. The costs are not symmetric: assuming you are online and being wrong means the alarm goes nowhere.

Say a word, and everything else follows from it

Say a word and your phone raises an alarm, without you touching it, with your voice never leaving the device.

The rest of ORBII exists to make that one moment useful: people who will actually respond, a location that can be trusted and then forgotten, and a set of systems built so the emergency path cannot be blocked by anything else in the app.

Try Voice SOS, or set it up and test it in about a minute. Testing it yourself is the only way any of this is worth anything.