Are AI girlfriend apps safe? Privacy, leaks and fixes

An AI girlfriend app hears things most people never say out loud: loneliness, fantasies, health worries, the name of a boss you hate. That text sits on a company's servers. Some of it gets read by moderators, fed back into models, or shared with ad partners, and some of it has already leaked.

None of this means you can't use these apps. It means you should treat every message as something that could one day be read by a stranger with your email address attached, and set up your account so that it can't be traced back to you if that happens.

So are AI girlfriend apps safe? Below: what the most thorough independent review of these apps found, what regulators and breaches have shown since, what the apps themselves say they do with your chats, and the setup that limits the damage.

Are AI girlfriend apps safe to use?

Safe enough if you assume your chats could leak and keep your real identity out of them; not safe if you treat them as a diary. The apps keep full chat histories, several use them to train models, and at least two companion services have exposed users' messages and photos. The rest of this guide shows the record and the setup that limits the damage.

What Mozilla found when it reviewed 11 romantic chatbots

In February 2024 the Mozilla Foundation's *Privacy Not Included team published a review of 11 romantic and companion AI chatbots, timed for Valentine's Day. Mozilla has since wound down the *Privacy Not Included guide and its old pages now redirect, so the report survives as an archived copy and in press coverage. Every one of the 11 apps got the "*Privacy Not Included" warning label, Mozilla's mark for a category that ranked among the worst it had reviewed.

According to Infosecurity Magazine's summary of the findings, the apps together had more than 100 million downloads on Google Play, and:

• 90% either sold user data, shared it for targeted advertising, or did not say enough in their privacy policies to rule that out.
• 54% did not let users delete their personal data.
• 73% published nothing about how they handle security vulnerabilities.
• 64% gave no clear information about encryption.
• 45% allowed weak passwords.

Mozilla researcher Misha Rykov put it bluntly: "AI girlfriends are not your friends." The guide's director, Jen Caltrider, said one of the scariest things about the category was "the potential for manipulation of their users."

Trackers, passwords and training

The Next Web's report on the study adds the details that stuck. One app, Romantic AI, sent out at least 24,354 ad trackers within one minute of use. Ten of the 11 failed Mozilla's minimum security standards, which include requiring a strong password; some accepted passwords like "11111111." Mozilla said Replika recorded the text, photos and videos users posted and "definitely" shared, and "possibly" sold, behavioral data to advertisers. Only one app of the 11, Genesia AI, offered a workable way to keep your chats out of AI training.

That review is now almost three years old and policies change, so treat it as a picture of the industry's habits rather than a verdict on any one app today. We look at what two current policies say further down.

Regulators have started to act

Italy blocked Replika in 2023 and fined its maker in 2025

On February 3, 2023, Italy's data protection authority, the Garante, ordered Luka Inc., the US company behind Replika, to stop processing Italian users' data. The Garante said the app had no real age check (sign-up asked only for a name, email address and gender), posed risks to minors and emotionally vulnerable people, and processed data unlawfully under the GDPR.

Two years later the Garante finished the job. In a decision dated April 10, 2025 and announced on May 19, 2025, it fined Luka 5 million euros. It found that, as of the 2023 block, the company had not identified a legal basis for processing users' data, had an inadequate privacy policy, and had no age verification even though it said minors were excluded. The age check Luka now uses was still found deficient in several respects. The Garante also opened a separate inquiry into how the generative AI model behind Replika is trained, including what categories of data go into it and whether they are anonymized. The European Data Protection Board's summary lists the GDPR articles involved, including the rules on transparency and on building privacy into a product by design.

An FTC complaint and an FTC study in the US

In late January 2025, the Tech Justice Law Project, the Young People's Alliance and Encode filed a complaint with the Federal Trade Commission asking it to investigate Replika. The complaint is mostly about marketing and design, not data: it alleges unsupported health claims, fake testimonials and features meant to foster emotional dependence. TIME reported that it also describes upgrade prompts appearing during emotionally or sexually charged moments in a chat. It is a petition, not a finding, and Replika did not respond to TIME's requests for comment.

On September 11, 2025, the FTC sent orders to seven companies that run companion chatbots, including Character.AI, Meta, OpenAI, Snap and xAI. Among other things, it asked how they handle personal information and whether they use or share personal information obtained through users' conversations with the chatbots. That is a study, not an enforcement action, but it shows where regulators think the risk is. Our guide to AI companion laws covers the age-check and state-law side of this.

Have AI girlfriend apps been hacked?

Yes. Muah.ai lost prompts tied to 1.9 million email addresses in 2024, and two other companion apps left 43 million messages on an open server in 2025.

Muah.ai, 2024

Muah.ai sold "uncensored" AI companions. In October 2024 404 Media reported that a hacker had taken a large database of users' interactions with the site, describing it as "a handful of open-source projects duct-taped together." The prompts, which describe users' sexual fantasies in detail, were tied to email addresses, and 404 Media said many of those looked like personal accounts with real names. It also found many prompts trying to create child sexual abuse roleplay, which is illegal.

Have I Been Pwned, the breach-notification service, lists the breach as September 2024, with 1.9 million email addresses exposed alongside AI prompts and sexual fetishes. It flagged the breach as sensitive, so only the owner of an address can check whether it is in there.

Chattee Chat and GiMe Chat, 2025

In October 2025, Malwarebytes reported on research by Cybernews into two companion apps from a Hong Kong developer, Imagime Interactive. A server with no authentication at all had exposed 43 million messages and more than 600,000 images and videos from over 400,000 users, along with purchase records, IP addresses and device identifiers. Names and emails were not in it, but device IDs and IP addresses can be matched against older breaches to identify people. Nobody had to hack anything; the data was simply left open.

The pattern in both cases is the same. The companies were small, the engineering was thin, and the most sensitive data a person can produce was stored next to something that identifies them.

Do AI girlfriend apps use your chats to train AI?

Some say so outright: Candy AI may use your data to train its models, and Replika uses "small portions" of anonymized messages for its own systems. Most companion apps keep your full conversation history, both so the character can "remember" you and because the logs are valuable. What happens next depends on the company, and you only find out by reading the privacy policy. Here is what two of the apps we review say today.

Replika

Replika's privacy policy (last updated October 28, 2026) says that "small portions" of messages and content may be anonymized and used internally to train its safety systems and improve the chatbot, and that this data is not used to train third-party large language models. It shares device identifiers, activity and purchase data with advertising partners including Meta, Google and AppsFlyer, and for US users it says this counts as a "sale" of personal data, which you can opt out of through its "Your Privacy Choices" page or a Global Privacy Control signal. It says it never shares your conversations with those ad partners. Text history is kept for 24 months and photos, video and voice for 12 months while the account is open; profile data is deleted within 60 days of closing the account, but financial records are kept for 10 years. Our Replika review covers the app itself.

Candy AI

Candy AI's privacy notice (revised October 19, 2026; operator EverAI Limited in Malta) says it may use your data to "train and develop our AI models and moderation technologies," and that preparing training datasets may include human review of de-identified interactions with AI companions. Its moderation and language-model providers "may receive the content of your messages." Account data is kept for three years after your last activity and financial data for ten years. See our Candy AI review for the rest.

Two things are worth taking from this. First, "anonymized" and "de-identified" are doing a lot of work: a chat in which you mention your town, your job and your ex by name is hard to anonymize. Second, payment records outlive everything else. Even after you delete an account, the fact that your card paid that company stays on file for a decade.

How to use an AI girlfriend app without exposing yourself

Separate the account from your identity

• Use an email address you use for nothing else. The Muah.ai leak was damaging because prompts were tied to real email addresses. A fresh address with no name in it breaks that link.
• Use a unique, long password from a password manager. Mozilla found that many of these apps accept weak ones. Don't sign in with Google or Apple if you can avoid it, since that ties the account to your main identity.
• Give the character a fake you. Don't use your real name, employer, school, street, or the names of real people in your life. The app does not need them to work.
• Never send your face or identifying photos. Photos and voice notes are kept, and in the Chattee leak hundreds of thousands of images sat on an open server.
• Leave health details out. Replika's own policy asks users not to share health information or details about their sex life in chats. Take that advice for every app.

Think about how you pay

Your card statement and the company's financial records both name the service. Paying through Apple or Google in-app purchases keeps your card details away from the app developer, though the store still has the record. A prepaid card is another option, but the Consumer Financial Protection Bureau notes that an unregistered prepaid card may come with fewer protections if it is lost or stolen, and may not work online at all. Subscriptions and token packs are covered in our guide to what AI girlfriend apps cost.

Turn off what you can

Look in the app's settings and its privacy policy for an advertising or "sale or sharing" opt-out, and for any training opt-out. Turn on Global Privacy Control in your browser if you use the web version; Replika, for one, says it honors it. On your phone, deny the app access to contacts, location and the photo library, and turn off ad tracking at the system level.

Delete properly when you leave

Cancelling a subscription does not delete anything. Delete your chat history and then the account from inside the app, and if you want written confirmation, send a deletion request to the privacy contact listed in the policy.

If you live in California, the California Consumer Privacy Act gives you the right to know what a company holds about you, to have it deleted, to opt out of its sale or sharing, and to limit the use of sensitive information, which explicitly includes your sex life and sexual orientation. Businesses have 45 calendar days to respond to a deletion request, extendable once by another 45. In the EU and UK, Article 17 of the GDPR gives you a right to erasure "without undue delay" in most cases. Expect exceptions: both laws let companies keep records they are legally required to hold, which is why payment data tends to survive.

If you are leaving because of billing, our guide on cancelling an AI girlfriend subscription walks through doing it in the right order so you are not charged again.

If you think your data leaked

Check your email address on Have I Been Pwned; for sensitive breaches like Muah.ai it will only tell you after you verify that you own the address. Change the password on that account and anywhere else you reused it. Be ready for extortion emails. The FTC warns about scammers who claim to have recordings of your adult browsing, sometimes quoting a real password from an old breach to seem credible, and threaten to send it to friends and family unless you pay. Its advice: don't pay anything, delete the message, change the password they mention, and report it at ReportFraud.ftc.gov.

The short version

AI girlfriend apps are built on your most private words, and the evidence so far is that many of them protect those words badly: weak security, heavy tracking, long retention and, in a few cases, open servers. Pick an app whose policy you have actually read, give it as little of your real identity as possible, pay in a way you are comfortable seeing on a statement, and delete the account properly when you are done. Assume anything you type could be read by someone else, and write accordingly.