What's New in ORBII: Disaster Mode, Roll Call, and Knowing Someone Is Actually Coming

The most useful sentence anyone has said to us about this product is that ORBII should not try to have the most features. It should have the best emergency pipeline.

There are nine things that have to happen between someone being in trouble and someone reaching her:

1. Detect it.
2. Confirm it is real, without asking too much of her.
3. Locate her.
4. Get the alert out.
5. Get it out even when there is no network.
6. Keep the evidence.
7. Reach people who can actually go.
8. Tell them what to do.
9. Confirm that someone is actually responding.

Most safety apps, ours included until now, are strong on one to six and vague after that.

Stage nine is the one that matters, because “SOS sent” is not “help is coming.”

This update is mostly stage nine, plus the part of the pipeline that breaks when a whole region goes dark.

Someone has to own the call to 112

Here is what ORBII used to do. Ninety seconds after an SOS, with nobody accepted, it asked her to call 112.

She is the person least able to make a phone call. She may be hiding. She may be restrained. She may be holding a phone she does not dare look at. The pipeline reached its most important moment and handed the work back to the one person who could not do it.

That is now the wrong way round. The alert goes to the people who can act, and calling is claimed.

One person taps “I am calling 112.” The phone dials, and everyone else watching the same SOS sees who has it.

This fixes something that has nothing to do with software and everything to do with people. Four people who each see “somebody should call 112” is four people assuming somebody else did. It is the best documented failure in emergency response, and apps make it worse, because they show all four the same screen at the same instant.

Letting go is as easy as claiming. If you said you would call and then cannot, you tap again and the claim releases. A promise nobody can take back is worse than no promise, because it stops everyone else acting.

Anyone who can see the SOS can claim it. We deliberately did not limit this to verified helpers. The person most likely to call 112 is her mother, and a permission check that stopped her would be the worst possible use of one.

Her location, in type she can read out

The only route to the police that exists today is a voice call, and the first thing an operator asks is where you are. Under threat, at night, somewhere unfamiliar, that is exactly the question people cannot answer.

ORBII already knew the answer and was not showing it in a form she could speak.

The active SOS screen now carries a card headed READ THIS TO 112, at more than double the size of ordinary text, with the place name and the coordinates underneath it. Coordinates are there because coordinates are always right. A place name can be wrong, and a wrong name sends people to the wrong building while she waits.

Disaster mode

Everything above assumes a normal bad day: one person in trouble, a working network, a city that is otherwise fine.

Then there is the other kind of day. A flood, an earthquake, a district-wide outage. Everyone is fine or not fine at once and nobody can tell which, because the towers are down and every call fails.

Disaster mode is for that day, and it is free for everyone.

Your check-in rides the mesh. ORBII’s Bluetooth relay already carries SOS packets from phone to phone. It now carries a much smaller thing too: “I am okay, here, at this time.” Those hop through other ORBII phones the same way, and the first phone that has any connection at all pushes them up. The relays cannot read what they are carrying. It is sealed to our server before it leaves your phone, and only the server holds the key.

A roll call. One person opens it and their whole circle is asked at once. The screen lists every member, and the people who have not answered come first, because the unanswered names are the reason you opened it. This replaces the thing families actually do in a disaster, which is ring twelve people in sequence on a network that is already collapsing.

Survival battery mode. When you turn it on, ORBII shuts down everything that is not load-bearing. No background location, no sync, no community feed, no notifications you do not need. Two things keep running: the mesh and Voice SOS. In a disaster your battery is a countdown to being unreachable, and every feature that is not saving your life is spending it.

The mesh keeps what it could not deliver

This one is older than this update, and it is the piece people find most surprising, so it belongs here.

When an SOS travels the Bluetooth mesh, each phone that catches it tries to push it to our servers. Most of those phones have no internet, which is fine, because usually one of them does.

But if none of them do, the SOS used to die there. It physically reached a stranger’s phone and then stopped, and very often that stranger walked into wifi four minutes later carrying the answer and never knew it.

So a relay now keeps what it could not deliver, and sends it the moment it gets a connection. We call it the hot potato vault, because the packet is a hot potato: nobody who holds it can read it, everybody who holds it is trying to hand it on, and the last person holding it when the music stops is the one who finally gets it home.

The phone holding your SOS learns nothing about you. It is sealed ciphertext the whole way.

Voice SOS: an off switch, and a countdown that reads the room

Two fixes, both from things people told us.

There was a case where Voice SOS could not be switched off. The guard restarted itself without marking its own state, so the app could show it as off while the microphone was still armed. That is a serious bug on a listening feature and it is fixed. Voice SOS is now always armed for a length of time you choose, up to eight hours, and it stops from every screen that can start it.

The countdown is no longer a flat five seconds.

When ORBII hears a trigger word, it gives you a few seconds to say you are fine before the alert goes out. Five seconds was the answer for everybody, always, and it is the wrong answer twice.

A phone lying flat on a table, hearing “help” out of a television, is the single most common false trigger there is. Five seconds is short for someone in the next room to notice and reach it. That trigger now gets a longer window.

A phone that is being fought over while somebody shouts is about as unambiguous as this app ever gets. That one gets a shorter window.

Every research report on this subject says to fuse the accelerometer into the trigger, so that a fall can fire an SOS by itself. We are not doing that, and we want to be plain about why. A motion sensor with the power to start an emergency is how false alarms get worse: a dropped bag sends strangers to your address. The same sensor pointed the other way removes false alarms instead. It cannot start anything. It can only decide how long the human gets to answer.

The measurement runs alongside the countdown rather than before it, so it costs no delay, and it only runs while an SOS is already counting down, so it has no standing battery cost at all.

There is one honest cost. If you have cancelled most of your recent voice triggers, ORBII gives you more time, and that can delay a real emergency by up to four seconds. We think that trade is right. The worse failure is a phone that cries wolf until you switch Voice SOS off, and a switched-off safety app protects you zero percent of the time.

Onboarding, rebuilt

Setting ORBII up used to be a list of permissions. It is now one guided flow, from choosing your language to a working account, with short videos that autoplay and show you what each thing actually does before asking for it.

Nothing in it fires a real alarm any more. The voice step used to say “try saying it now” straight after arming the real trigger, which did exactly what you would expect. It runs a self test instead.

What we are now measuring, and what we will publish

This is the part we care most about.

Every safety app in India can send an alert. Almost none of them will tell you what happened next, because almost none of them measure it.

ORBII has been recording the facts needed to answer that for months and had no way to read them back. That is fixed. We can now see, for real emergencies:

• How many SOS reached a helper’s phone, how many were accepted, how many had someone take ownership of the call, and how many ended with a person confirmed on scene by geofence rather than by tapping a button.
• How long each of those stages took, as a median and as a ninetieth percentile. The median tells you how it usually goes. The ninetieth tells you how it goes when it goes badly, and that is the only half worth fixing.
• The real false alarm rate of Voice SOS, per trigger word. Cancelled divided by cancelled plus confirmed. If “help” misfires far more than “bachao”, the fix is not retraining a model, it is that one of those words appears in ordinary conversation.

We also built the query that can prove the new countdown wrong. If triggers ORBII marked as high confidence get cancelled just as often as the ones it marked low, then the classifier is reading noise and its thresholds are bad. A safety claim has to be falsifiable, so it ships alongside the thing that falsifies it.

We do not have those numbers yet. When we do, we will publish them, including the ones that make us look bad.

Know which of these are proven on real phones

We would rather say this than have you find out.

The Bluetooth mesh and the SMS lifeline have been tested on real phones and work. Voice SOS works, in English and Hindi, entirely on your device.

Roll call, survival battery mode, and the escalation claims shipped in this build and have been tested in code, not yet across a room full of real phones on a real bad night. Impact detection is written and switched off, and it stays off until somebody has actually dropped a phone, put one down hard, and jogged with one in a pocket.

On a safety app, an untested feature described as working is not marketing. It is a lie that someone might depend on.

Download

ORBII is free on the Play Store. Voice SOS, alerts to your trusted circle, the offline mesh, disaster mode and one tap to 112 do not cost anything and are not going to.