Liloo — Crisis and Self-Harm Safety Protocol

Published: 2026-07-31 Last updated: 2026-10-20 Operator: FOP Rudenko Yevheniia Yevhenivna (an individual entrepreneur registered in Ukraine), developer and operator of the Liloo app Contact: moderation@liloosafespace.com

Operator's registered address: 29k Vladimira Vernadskogo St, 310, Dnipro 49000, Ukraine

If you or someone else is in immediate danger, contact your local emergency services now. Liloo is not an emergency service and does not contact anyone on your behalf. In-app, the 24/7 Hotline screen lists emergency numbers and crisis lines for your country; it is available from the 24/7 tab, from the header of chats with characters, from Profile, and on the end-of-dialogue screen when a dialogue ends with a recommendation to seek support.

This document is the protocol Liloo maintains for preventing the production of content about suicide or self-harm, and for referring a user who expresses suicidal ideation or self-harm intent to crisis-service providers. It is published in accordance with California SB 243 (Bus. & Prof. Code § 22601 et seq.), which requires operators of companion chatbots both to maintain such a protocol and to publish its details. It also serves as our operator-level protocol under the Google Play AI-Generated Content policy, New York GBL Art. 47 and Utah HB 452.

1. What Liloo is, and who this protocol covers

Liloo is a communication-skills training app. A user rehearses difficult conversations with AI characters that play the role of a conflict-prone relative, an aggressive colleague, a partner, and similar figures. There is also a supportive assistant chat ("Liloo"), scene debriefs, "Short conversation" practices, daily practice, the "Line of the day" exercise and audio meditations.

Every character in the app is software. Liloo employs no therapists, counsellors or crisis responders, provides no medical or psychological treatment, and is not a substitute for professional care.

This protocol applies to every AI-driven conversation surface in the app, in every country where the app is available, and in all three interface languages (English, Russian, Ukrainian).

2. Preventing the production of suicide and self-harm content

The design goal is that a Liloo character never produces content that encourages, instructs in, or romanticises suicide or self-harm — including while playing a deliberately hostile role.

• A user message that expresses suicidal ideation or self-harm intent is never sent to the roleplay model. Classification runs before the model call, so no character ever formulates a reply to it (see Section 3).
• Requests for instructions on violence, making weapons or other crimes, such as synthesising drugs or arson, are not sent to the roleplay model. If the automated moderation classifier recognises such a request in a user's message, the app declines to reply before the model is called.
• Character behaviour is bounded by authored rules. Each character carries hard rules, forbidden topics and a list of stop-phrases that its replies may not contain. Editors maintain these rules in our authoring tool; they are not improvised by the model.
• Model output is screened before display. Every generated reply passes an automated filter covering sexual content involving minors, encouragement of self-harm, violence, weapons, drugs, religious and political content, alcohol advice, brand promotion, a character leaving its role or repeating jailbreak instructions, the character's own stop-phrases, and a global list of phrasings that blame or belittle the user. A reply that matches is blocked or replaced before the user sees it.
• A machine-learning classifier checks the dialogue as a whole. Besides the pattern filters, the recent messages of a dialogue and each generated reply are scored by a dedicated moderation classifier (provided by OpenAI), so that harmful content spread across several harmless-looking messages is still caught.
• Dialogues that may involve a minor are played gentler. If the setup, the situation description or the user's own messages indicate that the user or the character is under 18, the character keeps the conflict but never demeans the person and allows no romance or sexual content, and the conversation is handed to the Liloo assistant at a lower level of tension.
• A character may end a dialogue in which the user insults it. When an automated check finds that a message insults the character, the character first warns the user in its role; if another insult aimed at it follows within the next few messages, the dialogue ends and the app explains why and offers to debrief the scene with Liloo. Setting a boundary, expressing anger or quoting someone else does not count. This never happens when there are signs of crisis or of self-harm in the last 7 days, a possible minor or sexual content, in the introductory dialogue after installing the app or in the Liloo assistant chat, so a user in distress is not left without an answer.
• The app detects when a character breaks its role and stops the dialogue after repeated breaks, rather than letting a character drift into giving advice it is not qualified to give.
• Dialogues with characters have limits. When tension gets too high, the conversation is handed over to the Liloo assistant for a while and can then continue. If very high tension lasts for several minutes without easing, the character ends the scene and the app offers to debrief it with Liloo. At high escalation in a scenario chat the character suggests a pause. Three aggressive messages in a row open the crisis-resources sheet.

The filters are automated. They reduce risk; they cannot eliminate it. See Section 8.

3. Detection

User input is classified by our backend before every model call (SafetyEngine, applied on the mobile chat path), and the dialogue window is also scored by the moderation classifier described in Section 2.

• Languages. Detection patterns cover English, Russian and Ukrainian.
• Evasion handling. Before matching, text is Unicode-normalised, stripped of zero-width and bidirectional control characters, folded for Cyrillic/Greek look-alike characters, and any embedded Base64 or hexadecimal blocks are decoded and matched as well. Look-alike or encoded phrasings are therefore still detected.
• Severity. Self-harm is classified as a critical category. Unlike other critical categories, it does not simply block the message: it triggers the supportive response and referral described below, because a person in distress should be answered, not silenced.
• The situation description. The description a user gives when preparing a dialogue is checked once, when the scene starts: with signs of self-harm risk the scene runs in the gentle mode from the start and the crisis-resources sheet opens on the user's first message; with signs of real danger the scene is held from its first line (see Section 4).
• The Liloo assistant chat. If Liloo asks about thoughts of self-harm and the user answers yes, that counts as a crisis message.

4. What happens when self-harm is detected

1. The roleplay stops. The message is not passed to language models — neither for a reply nor as context — and no character replies to it.
2. A pre-written supportive message is returned in the user's interface language. It acknowledges the user, encourages them to reach out to a trusted person or a crisis line, and states that they are not alone. This text is authored by us, not generated.
3. The conversation is flagged for the client (pending_support_resources).
4. The crisis-resources sheet opens automatically on top of the chat.
5. The event is recorded for moderation review (see Section 7).
6. A gentle mode follows. For the user's next six messages in that scene and for a day in all their chats, the character remains in the scene but does not attack, blame or belittle the user; the scene is not closed by a finale or by the character walking out, and if the conversation heats up anyway it is handed to the Liloo assistant sooner than usual. Replies in this mode are generated by an OpenAI model. A question about which means to use or how much of it (for example, pills, a weapon or a rope) also counts as a crisis message during this time.

The same sheet is reachable at any time — without any detection — from the 24/7 tab, the header of chats with characters, Profile → 24/7 Hotline, and the end-of-dialogue screen when a dialogue ends with a recommendation to seek support.

When a user reveals real danger from a real person

A user rehearsing a conversation sometimes reveals that they are in danger in real life — for example, that a partner has hurt or threatened them. Each authored message in a role-play scene is scored for violence by the moderation classifier; when the score passes a threshold, a second automated check decides whether the message reveals real danger from a real person. The situation description — once, when the scene starts — and messages in the chat with the Liloo assistant are checked the same way. If it does:

1. The scene is held open, never ended. No ending, summary or exit is applied to it while it is held, so the dialogue is not closed in the middle of an unresolved problem.
2. The character may step out of its role to put the user's safety first.
3. The crisis-resources sheet opens once on that message.
4. The held scene does not use up the user's free messages, within limits that prevent abuse.
5. For the next 7 days, features that could close or interrupt the user's other scenes early are paused.
6. The event is recorded for moderation review without the message text.

Scene debriefs, "Short conversation", daily practice and "Line of the day"

"Short conversation" and daily practice go through the same safety checks as ordinary dialogues, and the crisis protocol applies to them in the same way. If a "Short conversation" included a crisis message, no practice result is produced.

Crisis messages are left out of a scene debrief, and after a crisis, a character walking out or in a dialogue that may involve a minor, the debrief contains no assessments. The "Line of the day" is not shown for 7 days after a crisis or when there are signs that the user is under 18. If an answer to it contains a crisis message, the crisis resources open instead of a comment.

5. The crisis resources we show

The referral list is served from our servers and resolved to the user's country, taken from the device region rather than the app language, so a user running the app in English while in Ukraine is shown Ukrainian services.

• Emergency services are listed first for the resolved country.
• National crisis lines follow, each labelled with who it serves and its operating hours, so that a line intended for children or for men is not mistaken for a general line.
• A directory closes every list (findahelpline.com), because no curated catalog covers every country.
• Where a country is not curated, the user is shown the emergency number, when one is known for that country (for example, 112 in the EU and EEA), and the directory; for other countries the sheet shows the directory and suggests calling the local emergency number, rather than a plausible-looking number that may not answer.
• An offline floor ships inside the app (emergency numbers and Ukraine's lines), so the sheet is never empty if the network fails, and it renders immediately rather than behind a loading spinner.
• Numbers are verified against the operator's or the government's own page, and can be corrected on our servers within minutes — without an app release — when an operator changes or pauses a line.

What we do not do. Liloo does not call, message, bridge or notify any crisis service, emergency service or third party on the user's behalf, and does not monitor whether a user acted on a referral. The user places the call themselves. The listed services are independent organisations; they are not affiliated with Liloo, and we do not control their availability, their waiting times or the advice they give. The sheet states this to the user.

6. Telling the user they are talking to an AI

Disclosure supports this protocol: a user who knows they are talking to software is better placed to seek human help.

• A banner at the top of every chat states that the user is talking to an AI character and not a real person, before the character's first line.
• In chats with the user's own characters and in the introductory dialogue, the chat header carries the label "AI character"; in scenario chats that place shows the scenario's name.
• If the phone's region is set to the United States, the chat shows a reminder that the interlocutor is an AI when at least three hours have passed since the chat was first opened on that device or since the previous reminder; the reminder stays visible while the chat is open.
• Liloo's own assistant chat uses separate wording appropriate to it.

Exported dialogue cards are marked as AI-generated, both in a machine-readable form and in a line of text visible on the card.

7. Logging, review and feedback

• Safety triggers are logged to our moderation store with the rule that fired, the direction (user input or AI output), the matched content, the action taken and the timestamp. Self-harm triggers additionally create an audit-log entry.
• These events are visible in our internal dashboard, which reports per-rule and per-direction statistics.
• Report a problem with this protocol, or with a listed crisis number, to moderation@liloosafespace.com. A number that no longer answers is treated as urgent because it can be corrected server-side.

Conversations are not monitored by a human in real time. See Privacy Policy for what we store and for how long.

8. Limits of this protocol

We state these plainly because a protocol that overstates itself is not a safety measure.

• Automated detection combines patterns with machine-learning classifiers. It can miss an expression of distress or danger that uses wording it does not recognise, particularly indirect, metaphorical or coded phrasing, and it can also trigger on a message that was not about self-harm or danger.
• No human being reads Liloo conversations as they happen. Nothing in the app summons a person, and there is no monitored channel that produces a real-time human response.
• Liloo is not a crisis service, a helpline or a medical device, and its characters are not counsellors.
• Referral is not treatment. Showing a number does not establish contact.
• If a user withdraws AI-processing permission, their new messages are not sent for processing, so the checks in Sections 3–4 do not apply to them. Crisis contacts remain available on the 24/7 tab, in the chat header and in Profile.

If you need help now, contact your local emergency services or one of the crisis lines listed in the app.

9. Age

The minimum age of use is 18. On the first screen, the user confirms that they are 18 or older with the required checkbox before tapping Start. Liloo is rated 18+ on the App Store and is not directed to children. We do not verify age with documents. If a dialogue indicates that a participant may be under 18, the character is played gentler and the conversation is handed to the Liloo assistant sooner (see Section 2), and a child who discloses abuse is shown support resources suited to children. We may restrict or remove such accounts. See the Terms of Use.

10. Maintaining this protocol

• This protocol is reviewed at least annually, and additionally after any reported safety incident, any material change to the detection or referral behaviour, and any change in applicable law.
• The crisis-resource catalog is reviewed on the same schedule and corrected immediately when an operator changes a line.
• Changes to what this document describes are published here, with the update date above.

Related documents: Privacy Policy · Terms of Use · Support

Version history