A chatbot that remembers your preferences also creates a record worth protecting. AI companion app privacy comes down to who can access that record, how it’s reused, and when it disappears.
For adults using these apps, relationship details and personal disclosures can be more revealing than ordinary productivity prompts. I assess those risks through documented policies and processing architecture, not reassurance from a friendly interface.
Start with where the conversation goes.
Key Takeaways
- Encryption protects data under particular conditions; it doesn’t establish that the provider cannot access your chats.
- Conversation history, companion memory, operational logs, and training data are different records.
- Local processing offers more control, but exports, backups, telemetry, and device security still need attention.
Where AI Companion Chat Histories Are Stored
The chat window shows only part of the data a service may maintain.
Conversation History and Active Context
A saved transcript is the conversation history. Active context is the information supplied to the model when it generates a response.
Those aren’t necessarily identical. An app might retain a lengthy transcript while supplying only recent messages and selected summaries to its model. A companion forgetting something doesn’t prove the underlying message was deleted.
Cloud-based AI services may maintain server-side data for continuity across devices. An app may also cache information locally. Neither the presence nor absence of an offline chat screen establishes where the authoritative record lives.
Memory, Summaries, and Operational Logs
Companion memory can include extracted preferences, profile details, or summaries rather than complete conversations. Depending on the implementation, changing a memory entry may affect future replies without deleting its source transcript.
Other records can include error logs, safety classifications, support requests, and usage metadata. Retention rules may differ across those categories.
I look for separate explanations of each record, including who can access it. AI Flow Review’s guide to chatbot security and data safeguards examines access controls and logging risks beyond the visible conversation.
What Encryption Protects During AI Inference
“Encrypted” is an incomplete privacy claim until the provider explains where decryption happens.
Encryption in Transit and at Rest
Encryption in transit protects information as it moves between systems. Encryption at rest protects stored information from access without the appropriate keys.
Both matter. Neither automatically prevents a service from reading data it’s authorized to decrypt.
A claim such as AES-256 encryption describes a cryptographic mechanism, not the entire data-handling process. It doesn’t reveal whether prompts enter application logs, go to another model provider, or remain in backups.
I want those operational answers before treating encryption as meaningful evidence of conversational privacy. Encryption claims alone also don’t establish a zero-knowledge architecture.
End-to-End Encryption and Cloud Processing
Traditional end-to-end messaging encrypts content so only the intended participants can decrypt it. With cloud-based AI, the model needs usable prompt data to generate a response.
If an ordinary server decrypts your message for processing, that environment sits inside the trust boundary. An encrypted connection doesn’t make the provider blind to your content.
Confidential computing can narrow that boundary through protected execution, such as Trusted Execution Environments. Guarantees vary, so verify the endpoints, encryption keys, software, and surrounding infrastructure.
The decisive question is whether the provider can access usable conversation content during processing, not merely whether messages travel through an encrypted connection.
AI Companion App Privacy: Replika vs. Character.AI
These services show why I wouldn’t apply one blanket description to the entire category. Their policies disclose different data uses.
Replika’s Disclosed Processing
Replika’s privacy policy describes collecting messages, content, profile information, interests, and preferences. It also says data may be sent to third-party language-model providers to generate replies.
The policy characterizes this third-party processing as generally transient, with exceptions for service integrity, security, and legal compliance.
Replika says feedback and small portions of messages are immediately anonymized for internal safety and performance work. It distinguishes this work from training third-party language models or other AI systems.
I wouldn’t interpret this as a guarantee that conversations never leave Replika’s infrastructure. Nor would I describe the disclosed safety work as general conversational-model training.
Character.AI’s Disclosed Uses
Character.AI’s privacy policy lists service analysis, maintenance, improvement, customization, and measurement among its purposes. Its disclosures include AI and machine-learning model training.
That’s a material distinction for anyone sharing sensitive information. Personalization and training are separate uses, even when both appear under broad language about improving a service.
The policy doesn’t establish a fixed chat-retention period. It describes retention based on processing needs, user choices, and possible legal or dispute-related requirements.
These are policy-based assessments, not firsthand security audits. Neither summary establishes routine employee access to chats, end-to-end encryption, local inference, or a particular encryption-key arrangement.
What Deletion and Retention Policies Mean
Deleting a visible chat isn’t proof of complete data deletion. The key question is which records the action removes.
Replika’s policy allows messages and specified profile data to be processed for up to 60 days after contract termination. Financial records and certain automatically collected data may remain for at least 10 years where legally required.
Those categories shouldn’t be confused. A financial-record obligation doesn’t itself establish that intimate conversation transcripts remain for a decade.
Character.AI’s cited privacy policy doesn’t give a fixed chat-retention period. Character.AI also says a Character shared with others may remain active after its creator deletes their account.
Before leaving a service, I check whether chat deletion, memory deletion, account deletion, and subscription cancellation are separate actions. I also look for backup schedules and legal-retention exceptions in the privacy policy.
A deletion request should identify the data categories involved. Keep the confirmation and any explanation of information the company says it must retain.
Local AI and Confidential Cloud Processing
These approaches change where processing happens, but each has different limitations.
Local Models Reduce Server Exposure
A local runtime such as LM Studio can run downloaded models on your computer. With local AI inference and no external integrations, prompts don’t need to reach a remote inference provider.
This gives you more control over storage and deletion, but shifts responsibility to your device configuration.
Check telemetry settings, network connections, plugins, crash reports, and cloud-synced folders. Local transcripts can still leak through backups or an unsecured computer.
The same boundary questions appear in cloud assistants versus local models: local execution is useful, but surrounding software still matters.
Trusted Execution Environments Narrow Access
Trusted Execution Environments, or TEEs, protect data during computation from access outside the protected environment.
For confidential cloud AI, look for remote attestation, which helps verify the running environment, and documented handling of encryption keys.
A TEE doesn’t automatically establish a zero-knowledge architecture. Plaintext application logs, retained outputs, or an unprotected processing step can undermine the claim.
Memory cleanup also requires scrutiny. Protected memory during inference doesn’t prove every prompt buffer is immediately overwritten afterward. Look for documented buffer handling, teardown behavior, logging exclusions, and audits, rather than assuming hardware isolation guarantees erasure.
Reduce Identity Exposure Before Sharing Sensitive Details
A pseudonymous profile reduces one obvious connection to your identity. It doesn’t erase account identifiers, IP addresses, device information, or transaction records.
Character.AI’s data-collection explanation identifies account information and interaction-generated data, including IP addresses and usage information. Check the service’s privacy policy to see what data it documents, even if your display name is fictional.
Payment privacy involves separate identity and billing considerations. A processor can associate a transaction with billing information. The companion provider may receive transaction identifiers or receipts without receiving the full card number. Don’t assume a pseudonym makes a paid account anonymous.
I recommend withholding unnecessary identifiers, including employers, exact addresses, account numbers, and other people’s private details. Automated PII redaction before AI requests can help in technical workflows, but contextual clues can still identify someone.
For workplace information, use approved systems and policies. A personal companion account isn’t an appropriate workaround for business data restrictions.
Move Conversations Without Creating Another Privacy Risk
Migration can preserve useful context while copying sensitive material into another system. I’d transfer only what’s needed for continuity, rather than defaulting to the entire transcript.
- Check whether the original service offers an export or applicable data-access request. Don’t assume every app supports exporting conversation history.
- Save any available export in encrypted storage. Avoid public sharing links and folders that automatically sync to accounts you don’t control.
- Remove identifiers, third-party disclosures, attachments, and conversations you don’t need. A short preference summary may be sufficient.
- Confirm the destination’s import capabilities and data policy. If importing isn’t supported, manually recreate only the preferences you want retained.
- Verify the destination’s saved memories, then request deletion from the original service and address cancellation separately.
Don’t upload an intimate transcript to an unfamiliar online converter just to change its format.
Migration also won’t preserve a companion’s behavior perfectly. Different models interpret the same history differently, and a copied summary can’t guarantee character consistency.
Choose Privacy by Data Access
I judge companion privacy by access, purpose, and retention. A friendly interface or an encryption badge doesn’t answer those questions.
For sensitive conversations, choose the processing boundary you can accept and share only what the interaction needs. Review memory controls, payment-linked identity, and migration handling as separate parts of that decision.
A memorable conversation can become a durable record. Make sure the service’s documented practices justify keeping it.
Frequently Asked Questions
Can AI Companion Companies Read Private Conversations?
Encryption alone doesn’t rule out provider access. Ordinary cloud inference processes usable conversation content. Whether employees can review it depends on documented access controls and policies. Available Replika and Character.AI disclosures don’t establish routine employee reading.
Does Account Deletion Undo Earlier Model Training?
Don’t assume it does. Account records and previously trained model parameters are different things. Look for an explicit explanation of what deletion covers, whether prior training use is addressed, and which records remain for legal or operational reasons.
Are Training Opt-Outs Available Everywhere?
Character.AI documents an “Improve the Model for Everyone” opt-out for EEA and UK users. Its regional privacy disclosures update discusses training and regional rights. The cited documentation doesn’t establish an equivalent US option. The opt-out also doesn’t stop every other improvement use.
