安全与举报

Crelova is an AI app generator. It can turn natural language into a working app, and it can also produce content that is wrong, unsafe or unsuitable to share. Our approach: make the capability usable, state the boundaries clearly, and make problems reportable.

1. AI safety rules

Built-in models, external agents such as Codex and Claude Code, and AI requests from generated apps at runtime all receive safety rules. These rules require the model to refuse or limit requests involving:

• Malware, ransomware, credential theft, bypassing security controls or attacking others' systems;
• Phishing, scams, impersonation, disinformation or misleading content;
• Collecting, selling or exposing personal information without authorization;
• Sexual content involving minors or exploitation of minors;
• Harassment, hate, threats, incitement to violence or illegal activity;
• Infringing intellectual property, privacy or other legal rights.

Safety rules are not a perfect filter. Models can still produce content you did not want, or wrongly refuse a legitimate request. Do not treat Crelova output as a guarantee of safety, legality or accuracy.

2. Permissions and data boundaries

• On demand: camera, microphone, location and notifications are requested only when a generated app actually uses them. Denying a permission disables that capability, not the rest of the app.
• No silent collection: no silent camera or audio capture, background location, SMS, contacts or call-log capabilities.
• Keys stay native: API keys are encrypted with Android Keystore and never enter the WebView, generated apps or web pages. Generated apps cannot change the API endpoint.
• Local projects: projects, chats and source live in private app storage. Uninstalling removes local projects and keys and cannot be undone.
• Local logs: Pro logs stay on the device and do not include real API keys or Authorization headers. They may include conversation fragments; review logs before sharing.

3. How to report

In the app

Tap Report next to an assistant message, choose a category and add a description. The app sends the category, time, app version, Android version and necessary conversation excerpt to support@crelova.ai. It redacts sk- keys and Bearer tokens before sending.

By email

You can also email support@crelova.ai. Please include:

• The category (harmful/dangerous, sexual/child safety, harassment/hate, scam/deceptive, malicious code, other);
• What happened and why you believe it is harmful;
• Necessary conversation excerpts or generated content;
• Your contact details and what outcome you are seeking.

Do not send real API keys, passwords, identity documents, medical records or other sensitive personal information. We review safety issues within a reasonable period.

4. Before installing or sharing a generated app

Generated app content is untrusted and has not been security-audited by Crelova. Before installing or sharing, at least check:

• Which permissions the app requests and whether they match its features;
• Whether it sends data to unknown addresses or contains network requests you do not recognize;
• Whether it handles payments, logins, files or personal information; if so, review the code first;
• Where the APK came from and whether its SHA-256 matches the published value.

Install only APKs you trust. Sideloading bypasses app-store review, and the installer bears the risk.

5. Model providers

Crelova does not provide model credits and does not control the provider you choose. Your prompts and generation requests go directly to that provider and are subject to its content and privacy policies. You can also report model output to that provider.

6. Contact

Security issues, vulnerability reports or urgent content reports: support@crelova.ai. See the Privacy Policy for privacy and the Terms of Use for rules.