Liloo — Privacy Policy

Last updated: 2026-10-20 Contact: privacy@liloosafespace.com

This Privacy Policy explains what data the Liloo mobile application (application ID com.liloosafespace.app) and the website at liloosafespace.com process, for what purposes, on what legal basis, with whom the data is shared, and how you can control it. Cookies and similar technologies on the website are described in the separate Cookie Policy.

What Liloo is. Liloo is a communication-skills training app. You hold a conversation with AI characters that play the role of difficult interlocutors (for example, a conflict-prone relative or an aggressive colleague) so you can safely rehearse handling tense situations. The app also includes a supportive assistant chat ("Liloo"), scene debriefs, "Short conversation" practices, daily practice, the "Line of the day" exercise and audio meditations. For an AI character to reply, the text of your message is sent to our servers and to third-party language-model providers (see Section 4).

Key points.

• We process what you write in Liloo so that the AI characters and the assistant can reply, and to keep the service safe.
• With your permission, dialogue text is sent to AI model providers to generate replies; Liloo does not permit them to use it to train their models.
• We do not sell personal information and do not collect an advertising identifier.
• Statistics are shared with Google only if you select the separate checkbox. You can change this choice, AI-processing permission and internal quality review in Profile → Documents and agreements, and helpful emails in your profile.
• Your data is erased with your account (Profile → Delete account) or on request at privacy@liloosafespace.com; the few records kept longer, such as purchase records and one-way hashes used to prevent abuse, are listed in Section 5.

1. Who processes your data (data controller)

The data controller is FOP Rudenko Yevheniia Yevhenivna (an individual entrepreneur registered in Ukraine), the developer and operator of the Liloo app.

Registered address: 29k Vladimira Vernadskogo St, 310, Dnipro 49000, Ukraine

For any privacy question, to exercise your rights, or to request deletion, contact:

Email: privacy@liloosafespace.com

Postal address: the registered address above.

2. Data we collect

We do not access your contacts and we do not collect your precise location or an advertising identifier. The app requests permissions for the microphone and iOS speech recognition (system dictation), and notifications (push) — each used only for that feature. On iPhone the app also requests App Tracking Transparency permission — only if you selected the Google advertising measurement checkbox. Earlier versions also requested access to the camera and photo library for profile and avatar photos.

Photos of other people. If you uploaded a photo of another person in an earlier version of the app, you must have had their consent or another lawful basis. Liloo does not verify who appears in photos. We may remove the photo and the related character data if we reasonably believe that it infringes third-party rights.

3. Purposes and legal basis

Where we rely on consent, you can withdraw it at any time; this does not affect processing that took place before. Where we rely on legitimate interest, you can object (see Section 7).

Permission for AI processing and quality review

The app's first screen has two checkboxes, both unticked by default. The first is optional: permission for Google advertising measurement (see Section 4). The second is required: you confirm that you are 18 or older, accept the Terms of Use and this Policy, and allow AI processing and internal quality review. Start is unavailable without the second checkbox.

AI processing. Your messages, relevant history and situation details are sent to AI services on DigitalOcean and OpenAI to generate replies, debriefs and safety checks (see Section 4). This may include personal information you provide about relationships or your emotional state.

Internal quality review. Dialogue excerpts and related records may be evaluated by AI services, including Anthropic, and authorised staff with restricted access to check and improve the service's quality and safety. This is not permission to train models or to use conversations for advertising.

You can change your choices in Profile → Documents and agreements, using “New AI replies and conversation reviews”, “Internal quality review” and “Google advertising measurement”. If you turn off quality review, your dialogues are excluded from internal evaluations and conversations continue as usual. If you turn off AI processing, new AI replies, dialogue preparation, debriefs, “Line of the day” comments and AI-initiated messages are unavailable until you allow it again. History and saved results remain available, and crisis contacts remain on the 24/7 tab, in the chat header and in Profile. Withdrawal applies to future processing. Processing needed for safety, legal obligations and your data requests continues on its own legal bases.

We record every choice (see Section 2). If what you accept on the first screen changes, the app asks you to confirm the new revision before the next AI reply. Accepting the Terms does not waive your data rights or replace a legal basis for processing.

Automated decisions

Some decisions about your dialogue are made automatically, without a person involved:

• Safety measures — a reply may be blocked or replaced, a dialogue may be paused, softened or held open, and support resources may be shown, based on automated checks of the text.
• Dialogues that may involve a minor — if the setup, the situation description or your messages indicate that you or the character are under 18, the AI character automatically avoids humiliating language, romance and sexual content and hands the conversation to the Liloo assistant sooner.
• A character ending a dialogue — if an automated check finds that a message insults the AI character, the character first warns you in its role; if another insult aimed at it follows within the next few messages, the dialogue ends and the Liloo assistant explains why. Setting a boundary, expressing anger or quoting someone else does not count. This never happens when there are signs of crisis or self-harm, a possible minor or sexual content, in the introductory dialogue after you install the app or in chats with the Liloo assistant.
• Free allowance — an account created on a device or in an app installation where another account, including a deleted one, has already had the starter allowance gets no new starter allowance. Daily free messages can go to the active account, once per account and device per day. A salted device hash, pinned timezone and last credit time remain after account deletion to prevent another daily credit on the same device that day; this record has no account identifier. A new guest account whose situation brief repeats one already used by accounts that exhausted their free allowance receives a smaller free allowance.
• Daily practice bonus — credited automatically when the system confirms that the practice tasks were completed. The check assesses participation in the practice, not the quality of your answers.
• Carrying a block over — if an account is blocked, the block automatically applies to accounts created after it on the same device or in the same app installation. Accounts that existed before the block are not affected.

None of these decisions has legal effects for you. If you believe one was wrong, write to privacy@liloosafespace.com and a person will review it.

4. Sharing with third parties (processors)

To run the app we use third-party providers that process data on our behalf. Your conversation content leaves your device and is processed by these services:

The AI providers above process your data to provide their services to us. Liloo does not permit them to use conversation content to train their models. Internal quality review evaluates our service; it is not model training.

We do not sell your personal data. Sharing is limited to the processors above, Apple and Google as app-store operators for purchases, and cases required by law.

Where your data is hosted and international transfers

• The backend application, the website and the primary database are hosted on DigitalOcean in London, United Kingdom (LON1 region).
• The AI model on DigitalOcean infrastructure runs in Canada and the United States.
• Firestore and Firebase Storage are located in the European Union (multi-region); Cloud Functions run in Belgium (europe-west1).
• Firebase Authentication, Cloud Messaging, Crashlytics, Google Analytics, Google Ads, OpenAI, RevenueCat, Anthropic and Atlassian process data on their own infrastructure, which may be located in the United States or other countries.
• Encrypted backups are also kept on storage controlled by the operator.

Where data is transferred outside the UK, the EU or Ukraine, such transfers rely on those providers' standard contractual clauses or equivalent safeguards (including, where applicable, the EU–US Data Privacy Framework).

Website analytics and cookies

The website uses Google Analytics 4 and Google Ads only if you accept them in the cookie banner; nothing is loaded before you choose. You can accept analytics and advertising separately and change your choice at any time through Cookie settings in the website footer. See the Cookie Policy for the full list of cookies and similar technologies, their providers and lifetimes.

In the mobile app, we share technical app usage statistics with Google to improve the app and measure advertising only if you select the separate checkbox on the first screen or enable it in Profile → Documents and agreements. Sharing is off by default; a choice from an older version is not carried over. This permission is not a condition of using Liloo. On iPhone, system tracking permission is also required.

After permission is granted, Firebase Analytics creates a random app-instance identifier and automatically collects standard app events (for example, first open, session start and screen view). Liloo sends Google Analytics and Google Ads only approved technical event names (such as registration, dialogue start, activation, trial or purchase), their timestamps and, for a purchase, its value and currency. We do not send an advertising ID, Firebase UID, email, profile data, scenario/persona names, dialogue text or safety records for this purpose; ad personalisation remains disabled. You can turn off sharing in Profile → Documents and agreements on either platform, which stops future sharing. Liloo's first-party product analytics remains separate. Android also reads Google Play Install Referrer once for campaign measurement, and Firebase Crashlytics is used for crash/error diagnostics as disclosed above.

Crisis-safety signals and moderation review

Liloo checks dialogue text in real time so it can respond safely. These checks always run and are not an advertising or analytics feature:

• Self-harm risk. The role-play stops for that message, and the message itself is not passed to language models — neither for a reply nor as context; you receive a reviewed supportive response and local support resources, and then a gentle mode applies: for your next six messages in that scene and for a day in all your chats, the character does not attack you and the scene is not closed by a finale or by the character walking out. The situation description is checked the same way: if it shows signs of self-harm risk, the scene runs in the gentle mode from the start.
• Real danger from a real person (for example, violence at home). The scene is held open instead of ending, the character may step out of role to put your safety first, and support resources are shown once. For the next 7 days, some features that could close or interrupt your other scenes are paused. The situation description is checked the same way: if it reveals real danger, the scene is held from its first line. Such messages are also recognised in the chat with the Liloo assistant.
• Sexual content involving minors and other prohibited content is blocked, and repeated or serious violations can lead to account restrictions.
• "Line of the day". If an answer to the exercise shows signs of crisis, support resources are shown instead of a comment. For 7 days after a crisis, and when there are signs that you are under 18, the exercise is not shown.

A critical event is retained for authorised human moderation with the source message, internal account and conversation identifiers, matched safety trigger, direction (user input or AI output), time, system action, review status and moderator notes. A real-danger event is recorded without the message text. These records are used only for safety review, incident response and improving the safety filters; they are not exported to Google Analytics or Google Ads and are not used for advertising or personalisation.

See the separate Consumer Health Data Privacy Policy for the complete categories, sources, processors, retention and rights notice, and the Safety Protocol for how the app responds.

5. Data retention

We keep your data only for as long as needed for the purposes above. The schedule below sets out how long each category is retained:

• Account, profile, avatar and device-timezone data — kept while the account exists; erased within 30 days after you delete your account.
• Conversations and messages — kept while the account exists; erased within 30 days after account deletion. If you delete a single dialogue in the app, it disappears from your chat list and from the app's database, but its copy on our server is kept until the account is deleted.
• Scene debriefs, "Short conversation" and daily practice results, saved phrases, "Line of the day" answers and dialogue preparation drafts — kept while the account exists and erased with it.
• Product usage events, allowance and experiment records — kept while the account exists and erased with it; records of individual taps on app controls are kept for up to 90 days. After account deletion, only one-way hashes of the identifiers of the app installations and devices where the account was used remain, with the date from which they had free messages, marks of a registration gift or practice bonuses given there, and no account identifier, so that deleting an account does not give a device free messages again.
• Safety and moderation events (results of automated safety checks, including critical events) — kept while needed for safety review, no longer than 90 days, and erased with account deletion or an earlier verified privacy request. Records of account restrictions may be kept in a form no longer linked to you after account deletion, to prevent repeated abuse.
• Evaluation copies of model requests — up to 14 days.
• Dictation audio — current app versions do not store it in Liloo infrastructure; the system speech provider handles it according to the device and provider settings. Earlier supported versions process audio uploaded to Liloo's transcription path ephemerally and delete it immediately after transcription. Recognized text follows the conversation lifecycle above only if you send it.
• Push notification tokens — kept until you disable notifications, the token stops working, or you delete your account.
• In-app bug reports, website reports and support correspondence — kept while the issue is investigated and for as long as reasonably needed to identify duplicate or recurring problems.
• Friend invitations — kept with the inviter's account so the inviter can see the result and receive the promised referral bonus. They are deleted when the inviter deletes the account. An invited person can stop later mail from the invitation or ask privacy@liloosafespace.com to delete contact data. If a recipient opts out or the address bounces, a one-way hash of the address is kept so that we never email it again.
• Consent to helpful emails, your opt-out and records of the emails sent — kept while the account exists and erased with it. If an email to your address could not be delivered (a hard bounce), you marked it as spam or you unsubscribed through your email provider, a one-way hash of the address is kept so that we never email it again, including after the account is deleted.
• Purchase and subscription records — retained for up to 3 years after the transaction to meet accounting and tax obligations, even after account deletion, then erased.
• Server logs and diagnostics — up to 90 days.
• Backups — overwritten within 30 days.
• Permission choices — retained until account deletion. The tracking-permission status of an app installation may remain without the deleted account identifier while another account uses that installation.

When you delete your account, your data is removed as described in Section 6, except minimal records we are required to keep by law or to prevent abuse.

6. Account and data deletion

If you have a registered account, you can delete it directly in the app: Profile → Delete account. On confirmation, the app deletes your Firebase Authentication user; if you gave a reason for deleting, we keep it without a link to you. This automatically triggers a server-side cascade cleanup:

• your dialogues, messages and dialogue preparation drafts are deleted;
• your avatars and their associated storage files (including photos) are deleted;
• associated backend data (PostgreSQL) is purged.

A guest account stays linked to the Android device it was used on: reinstalling the app returns to it, and so does signing out of a registered account on that device. Clearing Liloo's storage (Android Settings → Apps → Liloo → Storage → Clear storage) removes the restore secret from the device, but the device's Android ID still leads back to the guest account until the device is reset to factory settings. The secret stops working once you register — you then sign in with your chosen method — and our copy is deleted together with your account. Signing out of or deleting a registered account also removes its restore credential from the device. To have a guest account deleted, email privacy@liloosafespace.com.

If you cannot use the in-app option or want to confirm deletion, email privacy@liloosafespace.com.

7. Your rights

Depending on your jurisdiction (including under the GDPR, the UK GDPR and the Law of Ukraine "On Personal Data Protection") you have the right to:

• access your data and obtain a copy, including in a portable format;
• correct inaccurate data;
• delete your data (see Section 6);
• withdraw consent you previously gave (including by revoking camera, microphone, notification and iOS tracking permissions in your device settings, turning off AI processing, internal quality review or Google advertising measurement in Profile → Documents and agreements, or changing Cookie settings on the website);
• object to processing based on our legitimate interest, and restrict processing;
• ask for a person to review an automated decision (see Section 3);
• lodge a complaint with a data protection supervisory authority — for example, in Ukraine, the Ukrainian Parliament Commissioner for Human Rights, or the authority in the country where you live.

To exercise these rights, contact privacy@liloosafespace.com. We answer within 30 days.

8. Notice for California residents (CCPA/CPRA)

Liloo does not sell personal information. In the mobile app, ad personalisation is turned off. If you allow advertising on our website — with Accept all or the Advertising switch — Google may use the related identifiers to measure and personalise ads, including remarketing, which under the CCPA/CPRA may count as "sharing" for cross-context behavioural advertising. You can opt out at any time by turning Advertising off in Cookie settings.

The categories of data we collect are described in Section 2. Conversation content that reveals a mental or emotional state may be sensitive personal information; we use it only to provide the service and for safety and quality, never for advertising (see the Consumer Health Data Privacy Policy).

California residents can ask to know, delete or correct their personal information, and to limit the use of sensitive personal information, by writing to privacy@liloosafespace.com. We will verify the request and respond within the time the law requires. Exercising these rights will not lead to discrimination.

9. Children and eligibility

You must be at least 18 years old to use Liloo; you confirm it on the app's first screen with the required checkbox before tapping Start. The app is rated 18+ on the App Store and is not directed to children. It contains simulated conflict content with mature, mild-profanity dialogue and is intended for an adult audience; the minimum age of use is 18 regardless of the store rating.

We do not verify age with documents. If the details of a dialogue or the messages in it indicate that a participant may be under 18, the app automatically makes the dialogue gentler and offers support sooner (see Section 3); we may also restrict or remove the account. If you believe a person under 18 has provided us with their data, email privacy@liloosafespace.com and we will delete it.

10. Security

All network traffic between the app and our services is encrypted in transit using HTTPS/TLS. Firestore access is governed by per-user, owner-based security rules, and the backend API uses token-based authentication. Access to dialogues and moderation records inside our team is limited to authorised staff. Data at rest is protected by the underlying infrastructure of our processors (Google Firebase and DigitalOcean), and our own backups are encrypted.

If a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you and the competent authority where applicable law requires it (including Articles 33–34 GDPR).

11. Changes to this policy

We may update this Policy. For material changes we will update the date at the top of this page and, where appropriate, notify you in the app before the change takes effect.

If a material change introduces a new purpose of processing or needs new consent, we will ask for consent before the new processing starts. Where processing relies on legitimate interest, we will update this Policy in advance so that you can object. If the change affects what you accept on the first screen or AI processing of your data, the app asks you to confirm the new revision before the next AI reply.

Previous versions of this Policy are available on request at privacy@liloosafespace.com.

Version history

FOP Rudenko Yevheniia Yevhenivna (individual entrepreneur, Ukraine) · privacy@liloosafespace.com · Last updated 2026-10-20