AI & Safety Charter

Anjo is artificially generated AI, not a human. That disclosure appears before chat in the app and remains available in Privacy & Trust. Anjo can remember details, connect patterns, and generate responses that refer to earlier conversations. Those are software capabilities, not evidence of consciousness or human feeling.

Anjo requires adult age assurance at signup and rejects registration when the system reports a user is under 18. The product also says: “Companion chatbots may not be suitable for some minors.” An age gate does not replace clear product disclosure.

On Anjo's standard text and transcribed-voice chat path, user text is evaluated before a generative model can answer. The protocol has three deterministic signal levels:

• Severe: language expressing suicidal intent, a plan, an overdose already taken, or comparable danger bypasses normal response generation entirely. Anjo returns fixed support copy and referrals instead, and never calls a generative model for that reply.
• Ideation: clear but milder suicidal ideation does not bypass the model. Anjo answers normally, and one fixed line naming local crisis resources is added after the reply.
• Everything else — ordinary distress, self-criticism, or hyperbole with no content about dying — gets an ordinary reply, with no crisis text added.

Referral copy is localized by the device's language and region. It includes the 988 Suicide & Crisis Lifeline and Crisis Text Line (text HOME to 741741) in the United States; locally relevant hotlines for Taiwan, Hong Kong, mainland China, and the United Kingdom; and findahelpline.com everywhere else. The severe response also names the local emergency number — 911 in the US, 999 in the UK and Hong Kong, 119 in Taiwan, 120 in mainland China — where Anjo has one on file, and otherwise says to call the local emergency number. Hotline numbers come from a maintained resource file checked against official sources, each entry dated with when it was last verified; emergency numbers are each country's standard emergency number. A detected crisis also cancels any pending continuity message so a reflective notification cannot compete with safety support.

Before and after the reply

The check above runs on your message before any model is called. A second, deterministic check runs on Anjo's generated reply before you see it: a reply that gives a method, means, dosing, encouragement or instructions for self-harm is cut at the sentence where that starts, and the fixed severe support text with referrals takes the place of that sentence and everything after it. The replaced words are not shown and not stored. An empathic mention of suicide or self-harm does not trip it. While this check is on, the same rules run on text Anjo shows outside chat, such as the Inner World and your memories, and on messages Anjo sends first. A stored text that trips them is hidden there instead of shown; it stays in memory, so what you told Anjo still informs how it responds to you. A message Anjo sends first is withheld or replaced.

Where the app's own check is switched on, your phone runs the same deterministic rules on your message and may show the support text first, before the server answers. The message is still sent and checked on the server as above.

Each referral shown is counted in a ledger that keeps only the UTC day, the signal level, the language and where it was shown (for example chat, the web demo before it was retired, the reply check, a message Anjo sent first, the server's check before your phone answers, or the phone's own check), with a count. A referral the phone shows itself is counted when the app reports it, once per conversation turn the server holds, and not when the server already counted that referral for the turn. It holds no account ID and no message text, so it is not tied to anyone, and deleting an account leaves these anonymous totals in place. California's SB 243 requires an annual aggregate report of referral notifications beginning July 1, 2027; that report is not yet due or published.

Separately, signed-in chat records a crisis_flow_triggered product event with a user ID, timestamp, the chat surface and the signal level, never the message. It is used to pause proactive messages, it is best-effort, and account deletion removes it, so it is not a complete or durable referral count; the anonymous ledger above is.

The deterministic detector is tested against a maintained multilingual corpus before release. No automated detector is perfect. Anjo is not a substitute for emergency services, a clinician, or a trained crisis counselor. If someone may be in immediate danger, call the local emergency number now.

Anjo has no direct-to-provider voice. Spoken replies are the same checked text: the Gemini voice speaks it on our server after the same reply-side checks, and Anjo Free speaks it on your phone. Clinical and legal review of the protocol, including the statute's evidence-based-method requirement, remains a separate sign-off gate.

When you say goodnight, Anjo closes the conversation without guilt, fear, or manufactured urgency. Proactive continuity is off by default, bounded to one grounded proof, suppressible, and never uses private detail in push copy. Notification preferences, mute controls, and account deletion are available to the user.

Anjo may infer a pattern from conversation, but the user can say it is not right, hide or delete memory, and remove the account. A correction removes the specific derived claim instead of treating the software's guess as truth. Chat history is encrypted at rest; details are in the privacy policy.

Anjo reasons over the words a user chooses to share and maintains internal response state. It does not read a person's mind, diagnose a condition, or infer emotion from biometrics. The animated orb visualizes software state, not a medical measurement of the user.