Skip to main content

Privacy Policy

SCP-1471 MalO · Last updated: 23.10.2026

This Privacy Policy explains what information the SCP-1471 MalO mobile application (the "App") collects, how it is used and shared, how long it is kept, and how you can control and delete it. It applies to the App on both Android and iOS; where the two versions work differently, this is stated explicitly.

1. Who We Are​

The App is developed and operated by IMBA-DEV LLP (Almaty, Kazakhstan), referred to as "we" or "us". We are responsible for the personal data processed through the App.

For any privacy question or request, contact us at too.imbadev@gmail.com.

2. Information We Collect​

The App does not ask you to register. On first launch it creates an anonymous account identified by an internal number. Depending on how you use the App, we collect:

  • Account data: the internal account ID, the app and interface language you use and, if you choose to link them in Settings, your email address and password. The password is stored only as a one-way hash.
  • Profile details you choose to provide: name, avatar, "about me" text, gender, age, city, country and interests.
  • Content of your conversations: the messages you write; the photos, videos and voice messages you send; the location you share; the text of what you say during voice calls; and the reports and feedback you send us.
  • What the character remembers: facts that the AI picks out from your messages (for example, your name, age or hobbies) so that the character can keep the conversation consistent.
  • Device and usage data: device model, operating system and app version, a push notification token, and records of how you use the App (for example, screens opened, features used, errors). Our servers also receive the IP address of your device when the App connects to them.
  • Purchase data, where purchases are available: the type and status of your subscription, its dates and the purchase token issued by Google Play or the App Store. We never receive your card or other payment details.
  • Age range from Google Play (Android only, where available): if Google Play provides an age signal for your account, the App receives the age range (for example, 16–17 or 18+) and uses it only to adapt content to your age.
  • Advertising data (Android only): see "Advertising" below.

3. Device Permissions​

The App asks for a permission only when you use the feature that needs it. Every permission is optional: if you refuse, only the related feature stops working, and you can change your choice at any time in your device settings.

  • Microphone — to record voice messages and the sound of videos, and to talk to the character during voice calls.
  • Speech recognition (voice calls) — what you say is converted into text by the speech recognition service of your device (Apple on iOS; on Android usually Google or the maker of your phone), which processes it under its own privacy policy, and the character's voice is synthesised on your device. Only text is sent to our servers; the audio of a call is not recorded or sent to us.
  • Camera and photos — to take or choose the photos and videos you send in a chat, and to save images to your gallery when you ask. The App accesses only the files you pick.
  • Location — on iOS, only when you choose to send your location in a chat: your current position is sent once, as a message. On Android, the character may additionally ask whether it can sense where you are; if you allow it, the current coordinates of your device are attached to every message you send, so that the character can take your surroundings into account. You can stop this at any time by withdrawing the location permission in Android settings. The App never accesses your location in the background.
  • Face ID, Touch ID or fingerprint — to unlock your chats when you turn on chat protection. The biometric check is performed by the operating system of your device; neither the App nor we ever receive your biometric data.
  • Notifications — to tell you about new messages from the character. You can turn them off in your device settings.

4. How We Use Information​

We use the information described above to:

  • Provide the chat: deliver your messages, generate the character's replies and voice calls, describe the photos, videos and voice messages you send, and remember the context of your conversation.
  • Keep you safe: check messages for signs of a risk of suicide or self-harm, adapt the character's behaviour to your age and review reported messages (see "Safety, Moderation and Age").
  • Send you notifications from the character, if you allowed them.
  • Provide Premium and other purchases, and restore them on a new device.
  • Show ads on Android (see "Advertising").
  • Improve the App: we analyse usage statistics and review samples of conversations to improve the characters, stories and replies, and to find and fix errors.
  • Answer your requests and comply with legal obligations.

5. Third-Party AI Services​

The character is powered by AI models of third-party providers. To create replies, and for the related automatic processing described in this Policy (remembering facts, safety checks, translation), our servers send these providers the information needed for it: your recent messages and the character's previous replies, the photos, videos and voice messages you send (or their text descriptions), the location you share, the profile details you provided, what the character remembers about you, and the text of what you say during voice calls. The data is sent to:

  • OpenRouter (openrouter.ai), which forwards each request to the provider of the AI model that generates the result, such as Google, OpenAI, Mistral, Alibaba (Qwen) or DeepSeek;
  • DeepSeek (deepseek.com), which we also use directly, without OpenRouter, for some auxiliary tasks and as a backup;
  • AssemblyAI (assemblyai.com), which converts voice messages and the sound of videos into text.

On iOS, before your first message, attachment or voice call, the App shows which data is sent to which AI services and asks for your explicit permission. Until you agree, nothing you write or send is passed to these services and the character cannot reply to you, but you can still use the rest of the App. On Android, sending this data is a necessary part of the chat described in this Policy.

These providers receive the data only to process each request and return the result to us, and they handle it under their own terms and privacy policies. You can stop sharing at any time: stop sending messages, delete individual messages, or delete your account (see "Your Choices and Rights"). Data that a provider has already processed remains subject to that provider's retention policy.

7. Advertising​

Android. The free version of the App shows ads. They are provided by Google AdMob (https://policies.google.com/privacy), Yandex Mobile Ads (https://yandex.com/legal/confidential/) and Unity LevelPlay (https://unity.com/legal/privacy-policy), together with the ad networks they work with. To show and measure ads and to prevent fraud, these partners may collect the advertising ID of your device, its IP address, device and app information, information about other apps installed on your device and your interactions with ads. In the European Economic Area, the United Kingdom and other regions where it is required, the App asks for your consent to personalised ads through Google's consent form before ads are loaded. You can reset your advertising ID or opt out of personalised ads in your Android settings. Premium subscribers do not see ads.

iOS. The App currently shows no ads on iOS, does not access the advertising identifier (IDFA) and does not track you across apps and websites owned by other companies.

We never use the content of your conversations to select ads.

8. Safety, Moderation and Age​

  • Every message is analysed automatically by the AI services listed in "Third-Party AI Services": its topic, intent and signs of a risk of suicide or self-harm. If such a risk is detected and confirmed, the character steps out of its role, answers directly and gives contacts of help services in your country. The result of this check is stored together with the message.
  • The character adapts its behaviour to your age. It relies on the age range from Google Play (where available), the age in your profile, the content rating you choose in Settings and the age you mention in a chat.
  • If you report a message of the character, the message and the conversation before it are reviewed by our team. Team members can also access conversations when this is needed to answer your request, investigate a technical problem or abuse, or improve the App; such access is limited to the people who need it for this work.

9. Other Service Providers​

We also use the following providers, who process data on our behalf or provide the platform the App runs on:

  • Hosting and cloud storage providers, on whose servers our database and the files you send are stored.
  • Expo (expo.dev), whose push service delivers notifications through Firebase Cloud Messaging (Google) on Android and the Apple Push Notification service on iOS. A notification may contain a fragment of the character's message.
  • Yandex Cloud (Yandex Translate), used as a backup to translate the character's replies into your language.
  • Google Play and the Apple App Store, which handle downloads, purchases and subscriptions (and, on Android, age signals) under their own privacy policies.

10. Sharing and Disclosure​

We do not sell your personal data. We share it only with the providers described in "Third-Party AI Services", "Advertising" and "Other Service Providers", and only to the extent needed for the purposes in this Policy. Every third party with whom we share user data must provide the same or equal protection of that data as stated in this Policy.

We may also disclose information if the law requires it, to protect the safety of a person, to investigate fraud or abuse, or as part of a merger or transfer of the App, in which case this Policy continues to apply to your data.

11. How Long We Keep Data​

We keep data only as long as it is needed:

  • Account, profile, conversations and the files you send: for as long as your account exists. A message you delete is removed; when you delete your account, all of this is deleted immediately.
  • Detailed usage records (analytics events): deleted automatically after 90 days.
  • Purchase records: as long as accounting and tax laws require; after your account is deleted they are no longer linked to you.
  • Aggregated statistics and records that are no longer linked to an existing account (for example, AI usage costs and ad impressions) may be kept longer.
  • Backups of our database: overwritten within 90 days.
  • Data processed by the providers described above: according to their own policies.

12. Your Choices and Rights​

You can control your data in the following ways:

  • Delete your account and all data associated with it directly in the App: Settings → Account → Delete account. Deletion is immediate and permanent and works for anonymous accounts too. It does not cancel a subscription: cancel it in your Google Play or Apple ID settings.
  • Delete individual messages in a chat with a long press.
  • Edit or remove your profile details in the App at any time.
  • If you cannot open the App, ask us to delete your account, or only your data, on this page: https://malo-app.scp-1471.app/apps/malo/delete-account
  • Withdraw permissions (microphone, camera, photos, location, notifications) in your device settings.
  • On Android, change ad personalisation as described in "Advertising".

13. Additional Rights​

Depending on where you live (for example, in the European Economic Area, the United Kingdom or California), you may have additional rights: to get a copy of your data, to correct it, to object to or restrict its processing, to data portability and to lodge a complaint with a data protection authority. To exercise them, write to too.imbadev@gmail.com; we answer within 30 days. We will not treat you differently for exercising these rights.

14. Children's Privacy​

The App is not intended for children under 13, and we do not knowingly collect personal data from children under 13. If we learn that a child under 13 has created an account, we delete it. If you believe that your child has provided us with personal data, contact us at too.imbadev@gmail.com.

For users under 18, the App limits the character's behaviour according to their age (see "Safety, Moderation and Age").

15. Security​

Connections between the App and our servers are encrypted (HTTPS/TLS). Passwords are stored only as hashes, and access to user data is limited to the team members who need it. You can additionally lock your chats in the App with a PIN code or biometrics. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the authorities of a data breach where the law requires it.

16. International Data Transfers​

We and our providers process data in different countries. Your data may therefore be processed outside the country where you live, including in the United States and China, where data protection laws may differ from those of your country.

17. Changes to This Policy​

We may update this Policy when the App or the services we use change. The date of the latest update is shown at the top. If a change affects how your data is shared with AI services or significantly expands what we collect, we will tell you in the App and, where required (for example, for AI services on iOS), ask for your consent again.

18. Contact Us​

IMBA-DEV LLP, Almaty, Kazakhstan. Email: too.imbadev@gmail.com

SCP-1471 MalO is an unofficial fan work and is not affiliated with or endorsed by the SCP Wiki. It is based on SCP-1471 "MalO ver1.0.0" by LurkD (https://scp-wiki.wikidot.com/scp-1471) and other works from the SCP Wiki (https://scp-wiki.wikidot.com), licensed under CC BY-SA 3.0 (https://creativecommons.org/licenses/by-sa/3.0/). SCP-derived content in the app is shared under the same license.