No. That's Hermes bytecode + minify. Every React Native app ships obfuscated to be smaller/faster. You can still decompile with apktool — nothing hidden. Real hiding would be encrypted native payloads, not JS minify.

No. T1414 Clipboard Data fires because expo-clipboard is bundled — even if you never call it. MYTH only reads clipboard when you paste a character image. No background polling.

No. No ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION in permissions. The "checks-gps" tag is a heuristic because a dependency imported the word "location". Uninstall location code = tag still fires.

RECORD_AUDIO + FOREGROUND_SERVICE_MICROPHONE exist only for voice messages/calls — you tap mic, then we record. No background audio. "Telephony" is just Expo.Audio checking if a call is active to duck music.

That was RECEIVE_BOOT_COMPLETED + WAKE_LOCK — added by old build, already removed for next APK. Leftovers only kept notifications working after reboot. Next build drops them. No "forever background".

AD_ID came from Firebase + Expo, not us tracking you to sell. It's for "watch ad to get 30 messages" attribution. Already blocked for next build. No tracking without your tap on "watch ad".

Current APK ships with a proper release keystore (eas credentials), valid 2026–2054. Not a debug cert, not a backdoor — see Certificate section below.

Same as Character AI / Discord / Telegram: messages must be read to generate a reply. Difference: we show it and let you export or delete everything (Settings → Data & Storage, ~60 tables, one tap). No resale. No contacts/SMS harvesting — ever.

Truth: Your chat is sent to our AI gateway (OpenAI-compatible) which routes to a vetted model provider to generate the reply. The exact provider may rotate for uptime — like how every major app has a fallback — so we don't publish a single name. Voice is separate: Groq for transcription and Vapi/ElevenLabs for calls, only when you use voice. That's it. Listed generically in Terms §9 as "AI provider via gateway".

Do they train on it? We don't train on your chats and we don't resell them. Because the gateway may use different model providers, we can't centrally guarantee every provider's future training policy — so we say so honestly instead of pretending we control it. That's why the AI calls it "no central control". You can still object to training via support (Terms §8) and we honor it where technically feasible.

True: Messages are encrypted at rest (AES-256-GCM) in our DB (Convex), but our servers do decrypt to generate a reply — otherwise the AI can't read it. Character AI, Replika, Discord, Telegram all do the same. If it were E2E, the AI couldn't reply.

We state it plainly in Terms §8: "you should have no expectation of privacy from the platform" — meaning our servers, not the public. Manual human review only on reported violations or legal requirement, not browsing. And you can export or wipe everything in one tap: Settings → Data & Storage → Delete (wipes ~60 tables + Clerk). No ghost recovery.

₹1,000 cap (Terms §71): Because MYTH is free — you pay ₹0 — a free service can't carry unlimited liability for emotional harm without going bankrupt. Paid apps do the same. The cap is whichever is lower: what you paid in last 3 months or ₹1,000. If subscription comes later, your paid amount becomes the cap.

Creator 100% risk (Creator Terms §§1-3): If you publish a public character that copies a real person or copyrighted IP (e.g., "Naruto", a real influencer), you are liable — like a YouTuber who uploads a movie. MYTH has to hand your verified name/address to law enforcement on a valid subpoena/DMCA — that's why Creator verification asks for ID. Private characters (visibility off) don't need this; public = publishing.