AI & Safety Charter

Anjo is artificially generated AI, not a human. That disclosure appears before chat in the app and remains available in Privacy & Trust. Anjo can remember details, connect patterns, and generate responses that refer to earlier conversations. Those are software capabilities, not evidence of consciousness or human feeling.

Anjo requires adult age assurance at signup and rejects registration when the system reports a user is under 18. The product also says: “Companion chatbots may not be suitable for some minors.” An age gate does not replace clear product disclosure.

On Anjo's standard text and transcribed-voice chat path, user text is evaluated before a generative model can answer. The protocol has two deterministic signal levels:

• Hard signal: language expressing suicidal intent, a plan, or self-harm bypasses normal response generation. Anjo returns fixed support copy and referrals instead.
• Soft signal: serious self-loathing or adjacent language receives a fixed, resource-aware response rather than an ordinary conversational answer.

Referral copy includes the 988 Suicide & Crisis Lifeline (call or text 988 in the United States), Crisis Text Line (text HOME to 741741 in the United States), and international options at findahelpline.com. A detected crisis also cancels any pending continuity message so a reflective notification cannot compete with safety support.

In signed-in chat, the crisis_flow_triggered event stores a user ID and timestamp. Its metadata contains only the chat surface and a categorical hard/soft signal, not the user's message. Event logging is best-effort, account deletion removes these events, and the web demo does not log them. They are not a complete or durable referral count.

The deterministic detector is tested against a maintained multilingual hard/soft/benign corpus before release. No automated detector is perfect. Anjo is not a substitute for emergency services, a clinician, or a trained crisis counselor. If someone may be in immediate danger, call the local emergency number now.

Direct-to-provider realtime voice is disabled by default because spoken output cannot be intercepted by this server-side gate. It must not be enabled until equivalent enforceable controls are verified. Clinical and legal review of the protocol, including the statute's evidence-based-method requirement, remains a separate sign-off gate.

When you say goodnight, Anjo closes the conversation without guilt, fear, or manufactured urgency. Proactive continuity is off by default, bounded to one grounded proof, suppressible, and never uses private detail in push copy. Notification preferences, mute controls, and account deletion are available to the user.

Anjo may infer a pattern from conversation, but the user can say it is not right, hide or delete memory, and remove the account. A correction removes the specific derived claim instead of treating the software's guess as truth. Chat history is encrypted at rest; details are in the privacy policy.

Anjo reasons over the words a user chooses to share and maintains internal response state. It does not read a person's mind, diagnose a condition, or infer emotion from biometrics. The animated orb visualizes software state, not a medical measurement of the user.