Settings & Controls

Use a standard gear icon beside “Settings” in the app header and family dashboard. The destination title is “Settings & Controls”; never rely on the icon alone. Guardian View™ opens the same controls through “Manage settings” for an explicitly selected person.

Keep “Settings for [name]” visible on every screen. Mom, Dad, and other supported adults have separate profiles, consent, contacts, and permissions. Switching profiles must not copy settings.

Each service row shows its icon, name, short description, On/Off switch, operational status, and “Who helps: [choice].” Tapping the row opens details; tapping its switch changes only enablement. Detail order: service switch → Who helps → contacts and backups → service controls → permission summary.

For a new profile, Call Shield™ and Call Family™ are Off. “Set up” gathers the required permissions, contacts, and configuration; the user reviews the proposed route and taps “Turn on [service].” Nothing is enabled merely by accepting an invitation. Existing valid choices are preserved during migration; new grants and new sharing stay Off.

Captions and Call for Help are persistent interface controls, not service switches. Their exceptions are defined under “Defaults and safety exceptions”. There is no “Turn everything off” control in this version.

All service switches start Off. Defaults below apply inside setup and become effective only after confirmation. AI = “AI helps me”; Family = “Family helps me”; Both = “AI + family.” A suggested route never silently selects recipients or grants access.

Live-call joining requires Call Family™ and the parent’s visible per-call approval. Setup asks before enabling a dependency. Turning a service Off does not end an active call. Companion™ never takes over the call; your parent always decides whether to keep talking, hang up, or call family.

Use one three-option radio group, not three independent switches. Unavailable modes remain visible with their reason. Family/Both requires at least one accepted, permitted contact. AI/Both requires current AI consent and supported capability. Choosing family help does not disable separately consented scam warnings.

When an event starts

A manual request starts when the parent asks for help. A Call Shield™ concern starts an automatic help request only when “Automatically ask for help” is On. A help request does not admit anyone to a live call without the parent’s per-call approval.

Use up to three ordered contacts. Skip declined, revoked, unavailable, or failed-delivery contacts immediately. Delivery without “I can help” is unanswered. Offer each contact once per request; a manual retry creates a linked attempt. AI never takes over an unanswered call.

The first valid “I can help” temporarily claims the help request; expired or later offers cannot claim it. Acceptance pauses contact offers but does not mean “Resolved” or “Joined.” If joining fails, the responder declines, or no connection occurs within the proposed 60-second interval, offer the next approved contact. After exhaustion show “No one has answered,” “Try again,” and “Call for Help”; leave the request unresolved. The parent controls the call throughout.

AI failure. Show “AI is unavailable” and keep manual family help available. No mode change without consent. Neither an AI failure nor an unanswered family request transfers control of the call.

Off stops new triggers; it does not hang up a call or cancel an active help request. Show “Service off · Help request still active” and “Review request.” Explicit cancellation stops unsent follow-ups. Consent/access revocation blocks affected actions immediately. Never infer safety from silence, timeout, delivery, or reassurance.

The supported adult is the profile owner. An adult child, spouse, sibling, caregiver, or payer receives no decision rights by relationship or payment. An accepted invitation creates a contact, not an administrator. Version 0.1 delegates decisions to adults only. Any legally authorized representative requires a separate verified authority workflow; a family toggle or unanswered alert never establishes incapacity.

For each named person, show “What can [name] do?” Permissions are scoped to one profile, service, action, situation, and optional expiry. All grants start Off. Each enabled decision grant uses “Ask me first” by default; the owner may select “May decide” only for the bounded actions below.

Situations and approval

Choose “For routine tasks,” “When I ask for help,” and/or “When I do not respond.” No response means the owner, never an unanswered family alert. The proposed owner-prompt interval is 30 seconds during a suspicious call while help remains available. This condition never broadens a grant or allows AI to take over. Preview it: “Sarah may reorder Eleanor’s approved backup contacts during a help request.”

An “Ask me first” change stays “Waiting for [name]” and has no effect until approved. Routine proposals expire after 24 hours. Event proposals expire when the event ends or its next contact interval expires; they must not delay help or emergency access. Owner decisions take priority; stale or conflicting edits require review.

Only the owner or verified representative may grant/revoke access, broaden sharing, add recipients, change account ownership, or approve sensitive changes; require reauthentication for these changes. Family cannot enlarge its authority. Revocation blocks queued actions and access immediately. Notify the owner of applied family changes and log actor, scope, before/after, time, and approval. Protected Off changes show “Turn off [service]?” with the impact, “Turn off,” and “Keep on.”

Designer copy and states

Use visible On/Off text, large type, at least 48 × 48 logical-pixel touch targets, keyboard and screen-reader names, and focus-visible states. Do not rely on color. Plain “AI” means the artificial-intelligence assistant; introduce that meaning in setup. Use “Mom or Dad” in family marketing, and the person’s name in the app.

Authorize every read, write, dispatch, and join on the server using current consent, grants, expiry, availability, and situation. Revocation overrides an event’s route snapshot. Use compare-and-swap revisions and atomic dependency updates; on conflict reload for review. Log changes while redacting sensitive field values.

Persist deadlines across restarts. Deduplicate dispatch by event + recipient + attempt and repeated detector signals by open event. Track Open, Contacting/AI helping, Accepted/Connected, and explicit Closed/Cancelled. “No answer” stays unresolved. Send only currently permitted data.

Remaining validation

Before production, validate devices/live-call joining, caption activation for any certified lane, detector-trigger quality, and proposed timing. These are release dependencies, not current-support claims.