Kaaval
A consent-based personal safety framework — designed so a person in fear can ask for help quickly, privately, and with dignity.
Nothing on this page is live. No button. No alert. No data is collected. No "safety role" exists. No location is shared with anyone. This page is a published design specification so the diaspora can read, critique, and constrain the system before it is ever built.
A consent-based alert framework with trusted contacts, role-protected access, audit logs, coercive-control safeguards, and lawful escalation — built only after safeguarding clearance, DPIA, and independent review. Capability must never outrun consent.
Kaaval (காவல்) means guard, watch, protection — a duty of care, not a power of surveillance. The name is kept distinct from Velicham (the docs assistant) on purpose: an information system and a safety system must never be confused, in language or in code.
What Kaaval is#
Kaaval is a future TLTE safety framework designed to help members, volunteers, women, youth, families, and community workers request help when they feel unsafe. The system shares location or sensitive information only when the person has given consent, triggered an alert, started a timed check-in, or authorised trusted-contact escalation. It is built around protection, privacy, consent, audit logs, and lawful escalation.
The person chooses to activate safety sharing. No background tracking.
A fast way to notify trusted people that the person may need help.
Location is never tracked silently or continuously.
The person chooses, and may remove, who receives alerts.
Only role-cleared, audited TLTE positions may view sensitive alert data.
Every access to safety data is recorded and reviewable.
The public never sees personal alert details.
Supports communication and evidence — does not replace 999, ambulance, fire, or safeguarding authorities.
What Kaaval is NOT#
This is not a surveillance system, a tracking system, a police service, a vigilante response system, or a permission for admins to read members' locations. Protection without consent becomes control. TLTE must never cross that line.
- Not secret surveillance.
- Not a permanent tracking system.
- Not a tool to monitor members.
- Not a police replacement.
- Not a vigilante response system.
- Not a public location broadcast.
- Not a tool for shaming or exposing people.
- Not a tool for political targeting.
- Not activated by admins without rules.
- Not a reason to collect unnecessary location data.
The coercive-control & stalkerware risk#
"Family safety apps" are the single most weaponised category of consumer software in domestic abuse cases. An abuser will install one on a partner's phone, add themselves as a "trusted contact," and use the resulting location stream to stalk. Refuge, Women's Aid, the Coalition Against Stalkerware and the Council of Europe's GREVIO body have all documented this pattern.
- Trusted contacts must be added by the person, on their own device, never imposed by an admin, family member, or partner.
- Trusted contacts must be removable in one tap, with no notification to the removed contact.
- An optional duress code immediately and silently demotes the alert level and sends a fake "all clear" to a hostile observer.
- No partner / household / family-link mode that allows one person to monitor another. Full stop.
- If a person reports that a trusted contact is the source of harm, the system must support immediate purge and a referral to specialist support.
- Public anonymised reporting may never include data shapes (age, region, frequency) that re-identify a survivor.
How a person could ask for help#
The exact mechanism depends on whether TLTE ships as a PWA, native app, or via SMS. Each method below is constrained by device permissions, consent, and lawful review. None exist today.
A visible button in the TLTE app or member dashboard.
A private code triggers high-risk mode discreetly. A separate duress code can show a fake "safe" state to a hostile observer.
"If I do not check in by this time, notify my trusted contacts."
A pre-authorised contact can request a welfare check — heavily rate-limited and abuse-controlled.
A mobile shortcut or widget opens the safety trigger quickly.
A pre-agreed keyword to a TLTE safety number, subject to verification and abuse protection.
If the network is down, the person can prepare a local note that syncs on reconnect.
Calm labels, no aggression in the language#
The grammar of the system avoids attack/target/threat language. A person reaching for this is already frightened — the system should sound steady.
- Level 1Safety Check
The person wants someone to check on them.
- Level 2Concern
The person feels unsafe and wants trusted contacts notified.
- Level 3High Risk
The person shares location and key safety information with authorised safety roles and trusted contacts.
- Level 4Emergency Support
The person is guided to contact emergency services. TLTE may notify trusted contacts and preserve alert records, but official emergency services remain primary.
Who can see an alert#
Admin power is not safety permission. Safety data requires a safety role, a defined purpose, and an audit log.
- PublicNo access.
- Trusted ContactsReceive an alert summary and location only if the member has chosen them.
- Authorised TLTE Safety RolesAccess alert details necessary for safety response. Role-bound. Audited.
- Safeguarding RolesAccess youth/safeguarding-related alerts only under safeguarding rules.
- System Integrity / AuditSees access logs — not unnecessary personal details.
- AdminsNo automatic right to read private alert data unless their role is explicitly authorised and audited.
Consent before fear begins#
A person should not have to understand a privacy settings page during danger. Every consent in the system must be made before the alert is needed.
- Opt in
- Opt out at any time
- Choose trusted contacts
- Remove trusted contacts (silently, no notification)
- Choose which alert levels share location
- Choose whether last-known location can be stored
- Set check-in timers
- Cancel a false alarm
- Review their alert history
- Request deletion where legally possible
- See exactly who accessed their alert and when
- Use a duress code
If TLTE ever extends to under-18s#
TLTE today does not operate any under-18 service. If a future version extends to under-18s, the safeguarding requirements below would be mandatory — built and reviewed by qualified safeguarding professionals, never improvised by volunteers. Any child protection concern must be handled by appropriate safeguarding professionals and authorities.
- Under-18 members would need age-appropriate safety design and explicit age assurance.
- Under-16 designs may require parent/guardian-linked settings — controlled by safeguarding policy, not by family hierarchy.
- Youth alerts would route to safeguarding-cleared roles only.
- No adult mentor would receive youth safety data unless explicitly authorised under safeguarding rules.
- Emergency escalation must follow safeguarding policy and the law of the relevant jurisdiction.
Magalir Avai integration#
Kaaval connects to Magalir Avai for women and girls who may need protected reporting, harassment support, domestic-abuse safety planning, survivor protection, or trusted female-reviewer access. No woman should have to choose between silence and public shame.
- No public exposure
- Female reviewer option
- Safe contact preference
- Private case ID
- No retaliation
- Trauma-informed support
- Legal / professional referral where needed
A safety tool must never become a tool of control#
Every safety system creates a new attack surface. Kaaval's design must actively prevent these failure modes, not assume they won't happen.
- · Fake alerts
- · Harassment via repeated safety requests
- · Tracking without consent
- · Admins misusing location data
- · Trusted contacts abusing access
- · Public exposure of location
- · Political misuse
- · Stalking disguised as welfare checks
- · Doxxing
- · Retaliation after reporting
- · Consent-by-default
- · Trusted-contact approval flow
- · Rate limits
- · Verification
- · Role-based access
- · Audit logs
- · False-alarm handling
- · Periodic access review
- · One-tap removal of abusive contacts
- · Independent safety-team oversight & complaint route
Data lives as briefly as safety allows#
Public accountability must never become public exposure. Reporting may publish numbers; it must never publish people.
- · Emergency location is visible only for a limited time.
- · Alert summary retained for accountability.
- · Sensitive details deleted or sealed after a defined review period.
- · Member can request deletion where safe and lawful.
- · Safeguarding / legal cases may require longer retention under law.
- · Every access is logged.
- · Number of alerts
- · Average response time
- · Alert categories
- · Safety improvements
- · Never names
- · Never locations
- · Never private details
A worked example, end to end#
A walk-through of a single Level 3 alert, from the moment a member feels unsafe to the moment sensitive data is sealed.
- 01Member feels unsafe.
- 02Opens the TLTE app.
- 03Activates Kaaval — chooses an alert level, or enters a hidden PIN.
- 04Location is shared only with chosen trusted contacts and authorised safety roles.
- 05The safety team reviews and acknowledges within the agreed response window.
- 06Trusted contacts are notified with the minimum necessary information.
- 07The member is guided to contact emergency services if needed — services remain primary.
- 08The incident is logged, including every access.
- 09Follow-up is completed by safety / safeguarding roles as appropriate.
- 10Sensitive data is protected, expired, or sealed under retention policy.
Future technical roadmap#
Capability must never outrun privacy, consent, safeguarding, and legal review. Each phase requires a written DPIA and an independent safeguarding sign-off before the next phase begins.
- Phase 1In-app safety button, trusted contacts, manual location share, alert log.
- Phase 2Hidden PIN trigger, duress code, timed check-in, cancellation, trusted-contact escalation.
- Phase 3Native shortcuts / widgets and improved background safety, only where device permissions allow.
- Phase 4SMS / keyword fallback, offline safety note, Kaaval responder dashboard.
- Phase 5Anonymised public safety reports, safeguarding integration, emergency-pack export.
What people will ask#
- Q. Will TLTE track people all the time?
- A. No. Kaaval is consent-based. Location is shared only when activated, authorised, or configured by the member.
- Q. Can admins see my location?
- A. No ordinary admin has access. Safety data requires an authorised role, a defined purpose, and an audit log.
- Q. Does this replace emergency services?
- A. No. If someone is in immediate danger, they should contact local emergency services first.
- Q. Can this protect women and girls?
- A. It can support fast alerts, trusted contacts, and protected routing through Magalir Avai and safeguarding roles — but only if it is built carefully.
- Q. Can someone else trigger it for me?
- A. Only if the member has previously authorised trusted-contact escalation, and even then it is rate-limited and abuse-controlled.
- Q. What if I trigger it by mistake?
- A. Cancellation and false-alarm handling are part of the system.
- Q. Will my location be public?
- A. No. Location data is never public.
- Q. What if my abuser is a trusted contact?
- A. One-tap removal with no notification to the removed contact, plus a referral to specialist support. The duress code can also be used to send a fake "all clear" if it is unsafe to act openly.
Language rules#
safety trigger · personal safety · trusted contacts · high-risk alert · consent-based location sharing · safeguarding · role-based access · audit log · privacy protection · emergency support · protection without surveillance
spy mode · tracking mode · attack alert · target mode · threat weapon · secret surveillance · automatic public alert · vigilante response · forced tracking
"Kaaval is designed for one purpose: to let a person ask for help quickly, privately, and safely when they feel at risk."
Safety must never become surveillance. Protection must never become control. TLTE's duty is to build tools that protect people while respecting dignity, privacy, consent, and law.
காவல் — வெளிச்சம் தருகிறது, ஆனால் காவல் காப்பவரை வெளிப்படுத்துவதில்லை.
Kaaval gives light without exposing the person to danger.