Frozen snapshot. See Latest for current version.

N-Watch exists to help local communities coordinate fast, noisy, high-priority emergency alerts with minimal operational overhead.

Owned and maintained by RME Solutions Technology Australia.

Doc status: Frozen snapshot v0.3.2. See Versions.

The trust model

The single most important design decision in N-Watch is this: every end user belongs to a small, curated group managed by someone they know personally.

This is not a social network. There is no global feed, no discovery page, no algorithmic matching. A member's entire experience is scoped to their group and their manager. The manager decides who joins (via invite codes), who stays (active members), and who is removed (pause or ban). Members know exactly who is in their group and who is responsible for it.

This structure is permanent and intentional. No matter how widely N-Watch is adopted — whether it serves one suburb or every neighbourhood in the country — the end-user experience never scales beyond their trusted group. Your safety as an end user is paramount, and the app is designed accordingly.

The emergency alerting function is critical, but the curated, human-scale group is what makes it trustworthy.

Product goals

• Extremely simple onboarding and use under stress
• Reliable alert fan-out (push notifications)
• Minimal data storage (PII-minimising by default)
• Secure, server-verified admin actions
• Low maintenance architecture (managed services + Cloudflare edge)

Users & roles

• Member (standard user):

  • Authenticates via @react-native-firebase/auth native SDK (Google Sign-In or Sign in with Apple) on mobile
  • Joins groups by invite code
  • Registers device push token (automatic on sign-in)
  • Triggers incident alerts for their group (single confirm button)
  • Stores address locally on-device (never sent in plain text)
  • Can manually rotate their encryption keys from the settings menu
  • Can tap GPS coordinates in an alert to open the location in their maps app
  • Can delete their account and all associated data from the app
  • Receives professionally formatted error messages directing them to their group manager for support

• Manager:

  • Authenticates via Microsoft Entra ID (Cloudflare Zero Trust) on admin dashboard
  • Creates groups (with geohash-5 zone selection via interactive map)
  • Creates invite codes
  • Broadcasts messages
  • Pauses/bans members
  • Transfers members between groups
  • Views member device/version info
  • Resolves incidents with notes
  • Receives support error refs from members for fast issue resolution

• Super admin:

  • All manager capabilities across all groups
  • Views all users, groups, licenses, payments
  • Sets user roles (standard/manager/super_admin)
  • Grants and revokes licenses

Principles

Data minimisation

• Do not store home addresses.
• Avoid storing exact coordinates where possible.
• Prefer coarse location buckets (e.g. a zone id / geohash bucket) over exact latitude/longitude.
• Address is stored on-device only, and transmitted only as an encrypted payload when an alert is triggered.

Security-first permissions

• Every privileged action is verified server-side.
• Client UI is not trusted for authorization decisions.

Operational simplicity

• Push fan-out and authorization logic lives in the Cloudflare Worker API.
• Mobile uses Expo SDK 55 with @react-native-firebase/auth native SDK — initializes via platform config files, no JS-level initialization.
• Mobile PQC operations use pure-JavaScript implementations (mlkem for ML-KEM-768, @noble/ciphers for AES-256-GCM) — compatible with Hermes engine on React Native.
• Firebase provides Firestore + FCM primitives for mobile.
• Cloudflare Zero Trust + Microsoft Entra ID manage admin access (no custom login/password system).
• Mobile app is deliberately minimal: sign in → join group → alert button.

Non-goals (by design)

• Continuous location tracking
• Storing exact addresses
• Social features, feeds, or “engagement” loops
• Medical advice, emergency triage, or replacing emergency services
• Scaling the end-user experience beyond their group (this is intentional, not a limitation)

Glossary

• Group: a neighbourhood safety group with a coarse zoneId.
• Invite code: short code used to join a group.
• Incident: an emergency event triggered by a member.