Privacy Policy · Mallowly

This policy explains how Mallowly (the "App") handles your data. In short: your roommate, what your mochi remembers, your chats, diary, moods, habits, and photos are stored on your phone, and once you're signed in they're also backed up to our server (run by a cloud provider we hire, with servers in Japan), so you can bring your roommate back after switching phones or reinstalling. Chat replies come from cloud AI (you agree to this when you sign in; there's no on-device-only option): the content needed to write a reply passes through our server to an AI service, and each message you send is also checked for safety; conversations flagged as a safety risk, or that you report, are kept separately for up to 90 days. Users 13 and older sign in with an Apple or Google account, and we collect usage data that contains no chat content under that account (Section 1). We use your data to provide the service, keep it safe, and improve Mallowly (Section 3, which you can turn off).

1. What we handle, and where it's stored

Chat messages (Just chat / Heart to heart): stored on your phone, and backed up once you're signed in (see "Backup" below).
What your mochi remembers about you (memories): stored on your phone, and backed up once you're signed in (see "Backup" below). Memory is on by default; to find out what your mochi remembers, just ask. In Settings › Privacy & data › Advanced you can have your mochi forget everything, or turn off "Remember me." For your safety, if you say something sad or worrying, we only note the time that it happened, never what you said (so your mochi holds off on the "missed you" talk for a while).
Photos you take or pick to show your mochi: stored on your phone, and backed up once you're signed in (see "Backup" below).
Your mochi's journal entries and monthly collections, and your habit and mood records: stored on your phone, and backed up once you're signed in (see "Backup" below).
Account (sign in with Apple or Google): Once a user 13 or older has confirmed their birthday (users 13 to 17 also need a parent or guardian's consent), they need to sign in with an Apple or Google account to keep using the App. When you sign in, our server receives your account ID and email address from Apple or Google (if you sign in with Apple and choose to hide your email, it's the relay address Apple gives us); with Google, it also receives the name and profile picture URL on your Google account. We use these to create your account, count your cloud allowance, and prevent abuse. We never get your Apple or Google password, and the sign-in credentials are stored only on this phone. Users under 13 never sign in, and the App sends nothing to our server for them.
Backup: Once you're signed in, the App backs up your roommate's details (name, look, days together, room), what your mochi remembers, your chat history, diary entries and the lines you added, moods, habits, photos and their text descriptions, and a few settings that belong with your roommate (language, which notices you've seen) to our server (with servers in Japan) in the background. We use it so you can bring the same roommate back after switching phones or reinstalling. One roommate lives on one phone at a time: once you bring it back on a new phone, the old phone stops backing up. Only the account you sign in with can read your backup; like any online service, our server is run by us and is technically accessible to us. We don't use your backup to train AI and we don't sell it. When you delete a photo, clear your chats, or have your mochi forget, the matching backup on our server is deleted too, and "Delete account and data" deletes your whole backup. Whispers are never saved or backed up. Users under 13 never sign in and are never backed up.
Conversations kept separately (for safety and troubleshooting): In three cases, our server separately keeps that message, up to 4 messages before it, your mochi's reply (if any), the safety check result, the App version, and the time, together with your account: (1) when the App uses cloud AI and the safety check finds a serious safety risk, or the checking model refuses to judge; (2) when you're signed in and the check on your phone finds the message may involve self-harm (that message still isn't sent to any AI; it only goes to our server to be kept); (3) when you long-press one of your mochi's replies and tap "Report this reply." These records are kept for up to 90 days and then deleted automatically. They're used only for safety and improving the service. For now, only the developer looks at them (if anyone else ever needs to, we'll update this policy first), and we won't contact you privately about what we see. They're kept for users 13 to 17 too (for safety); users under 13 never sign in, so nothing is sent. "Delete account and data" deletes them as well.
Chat allowance: When the App uses cloud AI, each account can send 150 messages a week (counted again every Monday at 00:00, Taiwan time), with daily limits on photos, requests, and cost to prevent abuse. These counts are kept on our server and contain no content. When you might need help, your messages are never limited. Mallowly is still in beta, and there's no paid plan yet.
Usage data: Once you're signed in, the App sends back usage data under your account that contains no content: the App version, interface language, age range (not your birthday), which kinds of roommate you looked at and chose and how far you got in setup, plus when you open the App and roughly how long you use it, which features you use and how long you stay on each screen, how many messages and photos you send each day (counts only), whether you open notifications, and which settings you change. These are only codes and counts: none of the words you type in the App, your photos, or your chats. They're stored on our server and used to understand how people use the App and to improve it. The App also records how many times it showed help resources (the help card and gentle hints), as counts only and never what you said, for safety and improving the service; this includes users 13 to 17. Usage data doesn't depend on the "Use my chats to help improve Mallowly" switch in Section 3 (that switch covers chat content).
Connection logs: The cloud provider we hire records technical information about every connection, including your IP address, approximate location, device and App version information (User-Agent), and your account ID. These are the provider's operations and security logs, and they are deleted automatically on the provider's schedule.

AI replies: Chat replies are generated by cloud AI (you agree to this when you sign in), and the content needed to write a reply (what you said, recent messages, what your mochi remembers, and photos you show your mochi) is first sent to our server (in Japan), and then to an AI service provider we hire, which writes the reply (passed along through a relay service where needed). A photo you show your mochi is first described in text by an AI model, and your mochi replies based on that description; if the main service is unavailable or its description can't be used, another AI service provider handles it instead. These AI service providers' servers are currently mainly in the United States (backup providers may be in other countries). We require these providers not to retain this content and not to use it to train their own models. Passing it along doesn't keep a separate copy; the places your chats and photos are kept on our server are the backup and the conversations kept separately, both described above. Beyond that, we only record numbers such as counts, token counts, and costs, which we use to track allowances and costs. The App has no "on-device AI only" option; if you don't want your chats sent to an AI service, you can stop using the App and delete your account and the data on our server with "Delete account and data" under Settings › Privacy & data. If the cloud has a temporary problem, a reply may come from the AI model built into your phone (running on the phone) instead; if the age rules don't allow cloud AI, replies always come from the on-device model, and those chats aren't sent to an AI service.

Safety and intent checks: When the App uses cloud AI, each message you send, together with the few messages before it (yours and your mochi's), goes through our server to an AI service provider's model, to check whether it shows a safety risk and to understand what you want to do (for example, opening a feature). The result is used only to decide how your mochi responds to you, for example showing support resources when you might need help. We require these providers not to retain this content and not to use it to train their own models. Our server logs record only the category codes of the result (for example, whether there was a safety risk and what you wanted to do), not what you said; these logs, like the connection logs above, are deleted automatically on the cloud provider's schedule. When the result is a serious risk, or the model refuses to judge, that message is kept for up to 90 days as described under "Conversations kept separately" above.

Voice input: Hold-to-talk uses on-device speech recognition. Your recording and the recognition stay on your phone and are never uploaded. If your device doesn't support it, the feature is turned off. It never falls back to cloud recognition.

Camera and photos: The App only handles the single photo you take right then, or actively pick from your library. It never accesses or scans your whole library. When you save something back to your library, it only asks for "Add Photos Only" (write-only) access.

Crisis detection: Your phone first checks whether a message may involve self-harm. The result is saved with that message in your chat history (backed up with your chat history once you're signed in), so you can look back on it later. When the App uses cloud AI, the server's safety check also looks at each message (see above). When you're signed in, a message your phone finds may involve self-harm is kept for up to 90 days as described under "Conversations kept separately"; that message isn't sent to any AI.

2. What we use this data for

Providing the service: so your mochi can reply to you, remember you, write your diary, keep you company on your habits, and run the App's other features.
Keeping it safe: for example, checking whether a message may involve self-harm, showing help resources, and preventing abuse of the service.
Improving Mallowly: see Section 3. You can turn this one off.

3. Improving Mallowly

We may use de-identified data to analyze and improve Mallowly and its AI, including using chat content to improve the AI's replies (for example, finding where your mochi's replies fall short, adjusting how it talks, and evaluating or training reply quality). De-identified means we first remove your name, account, contact details, and other information that directly identifies you. The chat content itself may still include things you said, so we only use it when needed, limit who can access it, and require everyone who handles it (including vendors working for us) to keep it confidential.

You get to choose: Settings › Privacy & data has a switch, "Use my chats to help improve Mallowly." It's on by default for users 18 and older, and off by default for users under 18. You can change it anytime. If you turn it off, chats you send from then on won't be used for improvement. Anything already turned into de-identified statistics, or already used to improve the service before you turned it off, can't be taken back, because it can no longer be linked to you. Whispers are never used for improvement.

How it works today: Chats only leave your phone to get a reply when the App uses cloud AI, and every one that's sent is marked with your choice at that moment. The backup on our server (Section 1) is used only so you can bring your roommate back, never to improve Mallowly. Conversations flagged as a safety risk, or that you report with "Report this reply" (Section 1, "Conversations kept separately"), are kept for up to 90 days and used for safety and improving the service; this part doesn't depend on the switch, and neither does the usage data in Section 1 (codes and counts only, no content). If we want to keep other chats to improve Mallowly, we'll update this policy and tell you first. When the App doesn't use cloud AI, your chats aren't sent to get a reply, but once you're signed in your chat history is still backed up (Section 1).

4. What we do NOT have right now

No separate username or password: users 13 and older sign in with an Apple or Google account (Section 1), and we never get your password.
No ads.
No third-party analytics, advertising, or tracking SDKs.
We don't use persistent device identifiers to track you across apps.
We don't sell your personal information.

5. Disclosures commonly required under Taiwan's Personal Data Protection Act

Purpose of collection: Providing the service, keeping it safe, and improving Mallowly (see Sections 2 and 3).
Categories of personal data: The chat text you type, the name and birthday you enter, the photos you take or pick and their text descriptions, and the mochi's memories, diary, habit, and mood records the App generates from them; account data (the account ID and email address from Apple or Google, plus the name and profile picture URL if you sign in with Google), usage data (App version, language, age range, your choices during setup, when you open the App and for how long, which features you use and how long you stay, how many messages and photos you send each day, notifications and settings, and how many times help resources were shown; codes and counts only), the backup and conversations kept separately on our server (see Section 1), chat allowance counts, and the cloud provider's connection logs (such as your IP address).
Period, region, recipients, and method of use: Data on your phone is kept until you clear or delete it or delete the App (de-identified statistics excepted). Account data, usage data, quota records, and the backup on our server are kept until you delete your account in the App or ask us to delete them; conversations kept separately are kept for up to 90 days; and connection logs are deleted automatically on the cloud provider's schedule. The regions are your phone, our server (in Japan), and, when the App uses cloud AI, wherever the AI service providers' servers are (currently mainly the United States; backup providers may be in other countries). The recipients are us, the cloud provider we hire, AI service providers (only when the App uses cloud AI, including the relay service that passes content along), authorities when the law requires it (see Section 11), and, if the company is acquired or merged, the parties to that transaction and our successor (see Section 10). The method is local storage and processing on your phone, plus network transmission to our server.
Your rights and how to exercise them: Under Settings › Privacy & data, you can clear your chat history, have your mochi forget, delete photos (one at a time in the album, or all at once), download or delete all your data, and turn off "Use my chats to help improve Mallowly." Deleting the App also deletes all the data on your phone (this can't be undone). "Delete account and data" deletes the data on your phone, plus your account data, usage data, quota records, backup, and conversations kept separately on our server, and signs you out; the cloud provider's connection logs are deleted automatically on its schedule. You can also, as the law allows, ask to look up, review, get a copy of, add to or correct, stop the collection, processing or use of, or delete your personal data, as described in Section 12. We'll answer requests to look up, review, or get a copy within 15 days, and requests to add to, correct, stop using, or delete within 30 days; if we need more time, we may extend each once (by up to 15 or 30 days) and will tell you why first.
Effect of not providing data or declining permissions: If you don't allow camera, microphone, or photo access, the related features (such as showing your mochi a photo, or hold-to-talk) won't work. Everything else is unaffected.

6. System-level device backups (iOS backup / iCloud)

If you've turned on a full iPhone backup in your system settings (such as iCloud Backup or a computer backup), the data the App stores on your device is included in that backup, including your chat history and what your mochi remembers. That way, if you switch phones and restore from a backup, your mochi still remembers you. This is iOS's own backup system: the backup lives in your own Apple Account and doesn't go through our server. Whether device backup is on is decided by your Apple Account and device settings. This is separate from the backup on our server described in Section 1.

7. Children's privacy

The App is not for anyone under 13. Users who are 13 to 17 need a parent or guardian's consent first. We ask for your birthday when you start, to confirm your age; if it shows you are under 13, we don't keep the name or birthday you entered, we don't ask you to sign in or send anything to our server, and we only leave a marker on this phone, with no personal information in it, noting that the age rule stopped setup here. For users under 18, "Use my chats to help improve Mallowly" is off by default. Chats may include personal feelings or details of daily life that users share, so we still recommend parents keep an eye on how their children use the App.

8. Future subscriptions

Mallowly is still in beta, and there's no paid plan yet (for the chat allowance, see Section 1). If you later choose a paid subscription, the transaction itself is processed and charged by the Apple App Store. We only receive your subscription status through Apple's mechanisms and never collect your card number or other payment details.

9. Changes to this policy

This policy may be updated from time to time, especially if the way the AI works or the way data is handled changes. We'll update this document's version and date and let you know in the App. If we want to use your data for a materially different purpose, we'll tell you in advance and get your separate consent where the law requires it. The App keeps a record of which version you agreed to.

10. If Mallowly is acquired or merged (Business Transfers)

If the company that operates Mallowly is involved in a merger, acquisition, divestiture, reorganization, financing, a sale of all or part of its business, assets, or shares, or a bankruptcy, receivership, or liquidation (a "Transaction"), we will handle your information as follows:

Before a Transaction is agreed. We may share information needed to evaluate the Transaction with potential buyers, investors, and their legal, accounting, and other advisers, under confidentiality obligations. Wherever possible we will share only aggregated or de-identified information. We will not let them see your chats, photos, diary, or the things Mallowly remembers about you in a form that identifies you.
Your information may be transferred. When a Transaction closes, your account and personal information (including your chats, photos and their text descriptions, diary, habits, moods, and the things Mallowly remembers from your chats) may be transferred to the successor company or one of our affiliates so it can keep providing the service to you. We will only transfer your information to a successor that agrees to be bound by this Privacy Policy.
The successor keeps our promises. For information already collected, the successor must follow the version of this Privacy Policy that applied when you provided it, and may use the information only for the purposes described there. If it wants to use your information for a materially different purpose, or share it in a materially different way, it must tell you in advance and obtain your consent where the law requires.
Advance notice and your choices. Before your information is transferred to another company or becomes subject to a different privacy policy, we will tell you in the App and by email (if we have your email address) who is taking over, how to contact them, and what will change. If you are 13 to 17, we will also remind you in the App to tell a parent or guardian. For at least 30 days from that notice, you can download your data or delete your account and data in the App. Data you delete before the transfer will not be transferred; data you delete after the transfer will be deleted by the successor under this Privacy Policy. This does not apply to information the law requires us to keep.
If only our shareholders change. If your information stays with the same company, this Privacy Policy continues to apply, and any change to it follows Section 9.
If no successor agrees. If a counterparty (for example, a buyer in a bankruptcy) does not agree to be bound by this Privacy Policy, we will not transfer your personal information to it.

11. Security, keeping data after deletion, and legal requests

We use reasonable technical and organizational measures to protect your data, such as encrypting it in transit, making the backup on our server readable only by the account you sign in with, and limiting who can access data. But no online service can guarantee perfect security; if your personal information is leaked, we'll notify you as the law requires.
When you delete data or your account in the App, we delete the matching data from our server. System backups that the cloud provider keeps to prevent data loss may hold it for a limited time before they're cleared automatically. This doesn't apply to data the law requires us to keep.
When the law requires it (for example, a lawful request from a court or prosecutor), we may have to provide relevant data to the authorities.

12. Contact us

If you have any questions about this policy or how your data is handled, or want to exercise the rights in Section 5, email us at mallowly.app@gmail.com.

Version history

0.4 (2026-10-19): Chat replies come from cloud AI, which you agree to when you sign in; there's no "on-device AI only" option, and if you don't want it you can delete your account (Section 1). Once you're signed in, your roommate, chats, photos, and more are backed up to our server (Sections 1, 5, and 6); each message is checked for safety, and conversations flagged as a safety risk, that your phone finds may involve self-harm, or that you report are kept separately for up to 90 days for safety and improving the service (Sections 1, 3, and 5); the chat allowance is now 150 messages a week, with no paid plan yet (Sections 1 and 8); stopped naming the technology vendors behind the App and described them by type and country instead: servers in Japan, AI service providers currently mainly in the United States (Sections 1 and 5); conversations kept separately are, for now, looked at only by the developer, who won't contact you privately (Section 1); we don't sell personal information (Section 4); response times for rights requests (Section 5); security, keeping data after deletion, and legal requests (Section 11); usage data now lists what's actually recorded: when and how long you use the App, which features and how long on each screen, daily message and photo counts, notifications and settings, and how many times help resources were shown (Sections 1, 3, and 5); contact email mallowly.app@gmail.com (Section 12).
0.3 (2026-10-17): Added the account you sign in with (Apple or Google), usage data, and connection logs (Sections 1, 4, 5, and 7); explained that with cloud AI, content passes through our server to the AI providers, and that our server doesn't currently keep chat content or photos (Sections 1 and 3).
0.2 (2026-10-16): Added "Improving Mallowly" and its switch in Settings (Section 3) and "If Mallowly is acquired or merged (Business Transfers)" (Section 10); rewrote how data is sent, and to whom, when the App uses cloud AI.
0.1 (2026-09-27)

Mallowly Privacy Policy