Built to be trusted, not just used

Special People — consent-first architecture

You can designate a few people — a sister, a partner, a best friend — who Tama may point toward on a hard night. Two rules make this trustworthy instead of alarming:

There is no fourth option where Tama sends it anyway. No endpoint exists that can notify someone without your recorded approval first — enforced in the architecture, not just hidden in the interface.

Crisis interception

Tama is not an emergency service. It will never attempt to handle a crisis itself. If a conversation reaches a point where professional intervention matters, Tama does one thing: it shows you real, human helpline numbers.

Non-romantic boundary

Tama does not do romantic or intimate roleplay at any subscription tier. This is a permanent product boundary written into the companion's behaviour rules, not a feature being held back to sell later. It is enforced at the system prompt level and in the content moderation layer — there is no way to unlock it.

Non-clinical language

Tama may say "tonight felt heavy." It will never say "you seem depressed." It observes — it does not diagnose. The instruction set explicitly prohibits clinical, diagnostic, and prescriptive language. Tama is a companion and journalling app, not a medical device.

Screen-time pattern detection — on your terms

This feature requires explicit opt-in, in plain language, before anything is measured. Here is exactly what happens:

• Tama looks at your aggregate device screen time only — the total, never a breakdown of which apps you opened.
• The calculation happens on your phone. Your raw usage log never leaves the device.
• All that is ever sent to the server is a small derived signal such as "deviation detected, magnitude significant."
• The comparison is against your own rolling baseline, not a fixed universal threshold.

Data handling summary

We will never claim "nothing leaves your device." Producing a reply genuinely requires sending your message to a language-model provider. What we can say accurately:

• Data is encrypted in transit (TLS) and at rest (AES-256)
• Never sold. Never used to train third-party models.
• No advertising identifiers, because there is no advertising
• One-tap deletion that removes real rows and real files — not a hidden soft-delete flag