AI girlfriend privacy: what the apps keep, share and leak

The worry is older than any app. In 1966, when Joseph Weizenbaum's ELIZA program was running at MIT, he suggested he might set it up so he could read every conversation people had had with it overnight. He described the reaction in Computer Power and Human Reason (W. H. Freeman, 1976, Introduction): "I was promptly bombarded with accusations that what I proposed amounted to spying on people's most intimate thoughts". In the book's chapter on natural language he adds that people "would often demand to be permitted to converse with the system in private".

That instinct was right, and it matters more now. An AI girlfriend app remembers you because it stores what you tell it. The same store is what a company can analyse, train on, hand over or lose.

What each app's privacy policy says

The table below is built from our own records of each app's privacy policy: whether the policy allows selling or sharing personal data, whether chats may be used to train models, and whether it explains how to delete your data. Each row links the policy and shows the date we checked it. Follow an app's name for its full review.

Of the 27 apps in the table, 3 have policies that allow selling or sharing personal data in a way the law treats as a sale, 6 say chats may be used for training, and 13 do not say whether they train on chats at all. Silence is not a promise. A policy that says nothing about training leaves the company free to start.

Most policies also set no fixed period for keeping your data: they keep it "as long as necessary". A few give numbers, and some are long. Each app's safety and review pages quote the retention wording in full.

The breaches and leaks so far

Two kinds of failure have already happened to companion platforms.

A stolen database. In September 2024 a hacker took the user database of Muah.AI, an uncensored companion site. Have I Been Pwned, the breach-notification service, records 1.9 million email addresses exposed alongside the prompts users wrote, many of them sexual. 404 Media, which broke the story, reported that many of the addresses appeared to be personal accounts carrying users' real names. The prompts were no longer private fantasies; they were tied to people.

A server left open. Cybernews researchers found an unprotected streaming server in late August 2025 belonging to two companion apps, Chattee Chat and GiMe Chat, made by Imagime Interactive of Hong Kong. It held more than 43 million messages and more than 600,000 images and videos from over 400,000 users. It did not contain names or email addresses, but it did expose IP addresses and device identifiers, which can be enough to link a user to other data. The leak was closed in September 2025, after the researchers' disclosure.

The pattern is the same each time: the data that makes these apps personal is the data that hurts when it leaks.

Why intimate data is different

Kate Devlin, a computer scientist who studies sex and technology, wrote about this before companion apps took off. Her example was the We-Vibe, an app-connected vibrator. The court complaint says its app collected the time of each use, the intensity and mode chosen, and the user's email address, which let the company link usage to a person. The maker settled a US class action in 2017. Devlin's verdict, in Turned On: Science, Sex and Robots (Bloomsbury Sigma, 2018, p. 252): "Sexual data has the potential to destroy lives." A page later she adds: "In a world of big data, anonymous data is no guarantee of anonymity."

Dating apps showed how this data moves. The Norwegian Consumer Council's 2020 report Out of Control found that OkCupid shared answers about sexuality, drug use and political views with an analytics company, and that Grindr passed location, age and gender to advertising firms. Norway's data protection authority fined Grindr 65 million kroner, and an appeals court upheld the fine in October 2025. Rob Brooks, an evolutionary biologist, used both cases in Artificial Intimacy (Columbia University Press, 2021, p. 229) and drew the lesson for companion software: "If you are going to make a virtual friend, then make sure that it is your friend, rather than a salesperson who has been loaned to you by a corporation." (p. 231)

A companion app can hold more than a dating profile ever did: your moods, your loneliness, your sexual preferences, and the things you have told no one else.

Who can see your chats

The company can. Chats are stored in a form the model can read, because that is how memory works. Most policies allow staff or contractors to review flagged conversations for safety. When Mozilla reviewed 11 romantic chatbots in 2024, it found that most of the companies said they could share information with the government or law enforcement without a court order, and about half would not let users delete their personal data.

What happens when a company is sold or closes is the other open question. Devlin asked it in 2018 about sex-tech firms that get "merged, or acquired, or simply go out of business" (p. 252). Companion apps now answer it regularly: our record of AI companion shutdowns shows how rarely users get an export, and a privacy policy usually lets your data pass to a buyer.

Regulators have started to act

Italy's data protection authority fined Luka Inc., the maker of Replika, 5 million euros in 2025. It found that Luka had no legal basis for its data processing, gave an inadequate privacy notice, and had no age verification despite saying minors were excluded. It opened a separate inquiry into how Replika's models were trained. In the US, the Federal Trade Commission sent orders in September 2025 to seven companies running chatbots, including Character.AI, OpenAI and Meta, asking among other things how they use or share personal information from conversations. That is a study, not an enforcement case.

How to use an AI girlfriend app more privately

1. Use an email address that does not carry your name, and never reuse a password from anywhere else.
2. Share nothing that identifies you: no face photos, full name, address, employer or other people's names. Treat every message as something that could one day be read by a stranger.
3. Pay through the App Store or Google Play where you can. The app then never sees your card, and the charge on your statement comes from Apple or Google.
4. Read the retention and training lines in the policy before you start. The table above is a shortcut; the app's safety page quotes the wording.
5. Delete chats you would not want leaked, then delete the account when you stop. Deleting the app from your phone deletes nothing on the server.
6. For real privacy, run a model yourself. An open model on your own computer, through a front end such as SillyTavern, keeps the conversation on your device.

Apps with an 18+ mode, such as SpicyChat, Candy AI and Muah AI, hold the most sensitive material of all, which makes the policy and the breach record worth checking first. Companion-first apps such as Nomi and Kindroid keep long memories by design, so what they keep and for how long matters as much as what they sell.