AI companion privacy: what the app knows, keeps, and can be made to hand over
Intimate conversations are the most sensitive data most people will ever type. Here's what AI companion apps actually retain, what they train on, and how to reduce it.
An AI companion conversation is, for most people, the most sensitive text they will ever type into a computer. More revealing than their search history, more candid than their messages to friends, and — unlike either of those — deliberately drawn out of them by a system designed to encourage disclosure. It is worth knowing exactly where it goes.
This page is about the category, not about any one app. Every claim an app makes about privacy needs checking against its own policy, and the useful skill is knowing what to check.
The five questions that actually matter
Skip the marketing page. These five answers, all of which live in a privacy policy or a support FAQ, tell you nearly everything:
1. Is your conversation used to train the model?
This is the big one. Some apps state plainly that conversations are never used for training. Others reserve the right to use them "to improve our services", which is broad enough to include training and human review. Others offer it as a setting — and default it to on.
Why it matters: if your conversations train a model, fragments of what you wrote can in principle surface in somebody else's output, and humans may read samples for quality review. Look for the words "train", "improve our models", and "human review" specifically.
2. How long is it retained, and can you actually delete it?
"You can delete your data" and "your data is deleted" are different claims. Ask: does deleting your account delete the conversation history, or merely deactivate the login? Is there a retention period after deletion, and how long? Do backups get purged too, and when?
A good policy gives a number of days. A weak one says deletion happens "in accordance with our retention schedule", which is a sentence that means nothing.
3. What identifies you?
An email address is an identity. A phone number is a stronger one. A card payment ties your legal name and billing address to the account permanently, regardless of what username you chose. Most people's mental model is "I used a pseudonym so I'm anonymous", and the payment record quietly makes that false.
4. Who else gets the data?
Look for the third-party list: analytics providers, advertising SDKs, crash reporting, and — crucially — which company actually runs the language model. Many apps are a front end over somebody else's model API, which means your conversation is processed on a third party's infrastructure under a separate privacy policy. That's not inherently bad, but it doubles the number of companies holding your text.
5. What happens under legal compulsion, or a breach?
Every company with your data will hand it over under a valid legal order; a policy saying otherwise is not credible. The real question is how much they hold to hand over. And for breaches, the category's history is the relevant evidence: adult and companion apps have been breached before, and the consequences are worse than for ordinary services precisely because the content is intimate. Assume a breach is possible and plan your exposure accordingly.
What "private" looks like in practice, ranked
| Approach | Who can read it | Realistic privacy |
|---|---|---|
| Open-source model on your own computer | You | Highest — nothing leaves the machine |
| Paid app, training opt-out, email-only signup, prepaid card | The app, its model provider | Good |
| Paid app, default settings, card payment | The app, model provider, payment processor, analytics | Moderate |
| Free app funded by advertising | All of the above plus ad networks | Low |
| Free app with no published policy | Unknown | Treat as public |
The ranking is uncomfortable but consistent: the more you pay, the better your privacy tends to be, because a free product has to make money from something other than you paying, and the something is usually advertising or data. The exception at the very top is self-hosting, which is both the most private option and free.
Seven things you can do today
- Find the training setting and turn it off. It's usually in privacy or data settings, and it's usually on by default.
- Sign up with a dedicated email address that isn't your main one and isn't your real name. This single step breaks the link between the account and the rest of your digital life.
- Don't use a phone number if the app allows email instead.
- Pay with a prepaid or virtual card if your bank offers one. You cannot be anonymous to the payment processor, but you can keep the app from holding your name.
- Keep real identifiers out of the conversation. The app's memory system is designed to retain what you tell it — your employer, your street, your friends' names — and it will. Treat the chat as permanent and quotable.
- Don't send photographs of yourself. They are biometric data, they cannot be un-shared, and no feature in any of these apps needs them.
- Check what shows on your card statement before the first charge if that matters to you. Most apps publish the billing descriptor in their FAQ.
The one rule that covers all of it: write as though the transcript could one day be read by somebody you know. Not because any particular app is untrustworthy, but because that assumption costs you almost nothing and is the only protection that survives a breach, an acquisition, a policy change or a subpoena.
Why the memory feature makes this harder
The thing that makes a companion feel continuous is a stored, searchable record of what you've told it — see how AI companion memory works. Privacy and that feature are in direct tension: a companion that remembers nothing is far more private and far less compelling. There's no clever way around the trade-off. What you can do is choose deliberately rather than by default, and decide which specifics you're willing to put into the permanent record to get the experience you want.
If you want maximum privacy
Run the model locally. An open-weight language model on your own computer with a local interface sends nothing to anyone, has no policy to change, cannot be breached remotely, and costs nothing per month. It needs a reasonably capable graphics card, an afternoon of setup, and you forgo polished apps and easy image generation. For anyone whose privacy concern is real rather than abstract, it is the only answer that doesn't depend on trusting a company.