AI companion privacy is the question of what a companion app stores about you, who can read it, and what it does with it. Most consumer companion apps are not private by default: chat transcripts and memories usually sit on company servers in readable form, may be reviewed by staff, and can be used to train future models. Before you share anything personal, check the app’s training clause, its retention and deletion terms, and whether sensitive data is encrypted with a key only you hold.
Key Takeaways
| Point | Details |
|---|---|
| Memory means storage | The more a companion remembers, the more it stores about you. |
| Check the training clause | Search the policy for “model training” and look for a real opt-out. |
| Deletion needs a timeline | A real deletion policy names a number of days. |
| No legal privilege | Companion chats are not protected like conversations with a lawyer or doctor. |
| Ask who holds the key | Server-side encryption is readable by the platform; client-side encryption is not. |
Table of Contents
- What Data Do AI Companion Apps Collect?
- How Companion Apps Use Your Conversations
- Which Controls Should a Companion App Give You?
- Retention, Deletion and Legal Exposure
- How to Read a Companion App’s Privacy Policy
- Privacy and Memory: Can You Have Both?
- Using Your Data Rights
- FAQ
What Data Do AI Companion Apps Collect?
The collection surface is wider than most users expect:
- Chat transcripts and memories, every message plus the notes the app writes about you (“prefers X”, “mentioned Y”)
- Uploaded media, photos and generated images tied to your account
- Profile and onboarding data, age, preferences, and for adult apps often kinks and limits
- Usage logs, session times, feature use and how long you stayed
- Device data, device model, OS, IP address and sometimes an advertising ID
- Payment data, handled by a payment processor but linked to your account
- Analytics SDKs, third-party tools that track behavior across sessions
The metadata matters as much as the content. Timestamps show when and how often you use the app, and memory labels can encode sensitive preferences you never stated outright.
Pro Tip: Before installing a companion app, read the App Store privacy label or the Google Play data safety section. It lists the data categories the developer declared, including third-party analytics.
How Companion Apps Use Your Conversations
Generating a reply is the obvious use. What happens afterwards is where apps differ:
- Personalization and memory. The app stores summaries of past chats so the companion stays consistent. This is the feature most people want, and it requires persistent storage.
- Safety and moderation. Automated classifiers scan messages, and flagged content may be read by a human reviewer.
- Model training. Conversations are often used to improve models under broad “improve our services” language.
- Third-party sharing. Analytics, cloud and sometimes advertising partners each receive a slice of your data.
Business model is a useful signal. Free apps funded by advertising have an incentive to share behavioral data; paid subscriptions depend less on it, though a subscription alone proves nothing about internal practices.
Pro Tip: “De-identified data” does not mean anonymous. Re-identification from behavioral patterns is well documented, so treat the phrase as a legal hedge.
Which Controls Should a Companion App Give You?
Consent should be specific, upfront and reversible. A well-designed app offers:
- A clear statement at signup about whether chats are used for training, with an opt-out
- A way to view or clear what the companion remembers
- A data export of your conversations and profile
- Account deletion with a stated timeline
- Two-factor authentication or another way to protect the account
Look under Settings, then Privacy or Account. If you cannot find these, search the help center for “delete my data” or “export”, or use the privacy contact listed in the policy.
For adult companions, boundary controls belong in the same list. Hard limits and a safe word set before the first session are not privacy features, but they show whether an app was designed with care. Our guide to ethical AI intimacy covers what good consent design looks like.
Retention, Deletion and Legal Exposure
Deletion is not always erasure. Deleting an account usually removes your active profile, but backups, compliance logs and models already trained on your data may remain. Retention periods vary a lot between apps, so read the specific number in each policy rather than assuming.
Companion chats have no legal privilege. A civil lawsuit, a law enforcement request or a regulator can reach stored chat history, and the platform has no duty to resist the way a lawyer would. The exception is data the platform cannot read: if it only holds ciphertext, that is all it can hand over.
Warning: If you receive a legal notice or think your chats could be relevant to a dispute, preserve an export and talk to a lawyer before deleting anything. Deleting data after a legal hold can create its own problems.
How to Read a Companion App’s Privacy Policy
Four clauses predict most of what you need to know: training, sharing, retention and deletion.
| Policy element | Green flag | Red flag |
|---|---|---|
| Model training | “We do not train on your content” or a clear opt-out | “We may use data to improve services” with no opt-out |
| Third-party sharing | Named categories (hosting, payments) | “Trusted partners” with no list |
| Retention | Specific days or months | “As long as necessary” |
| Deletion | Completed within a stated time | “Reasonable efforts” |
| Human review | Disclosed and limited | Not mentioned |
| Encryption | Says who holds the key | “Bank-grade security” with no detail |
The encryption row is worth a closer look. TLS protects data in transit, server-side encryption at rest protects against outside attackers but not the platform, and client-side encryption means the server stores data it cannot read. Our explainer on encrypted AI chat explains why true end-to-end encryption is rare for AI.
Privacy and Memory: Can You Have Both?
Turning off memory and training protects your data but costs continuity: the companion forgets your preferences, history and rituals. The alternative is to keep memory but store it encrypted with a key the server does not have.
That is the approach Mistrix takes. Your fetish map, hard limits, inventory and safe word are encrypted on your device with a key derived from your PIN, and chats are stored encrypted the same way and decrypted locally. The server stores ciphertext. The trade-off is that a forgotten PIN means that data is gone. It is client-side encryption of stored data, not end-to-end encrypted messaging, and it does not make an unlocked phone private.
Using Your Data Rights
Under GDPR (EU and UK) and US state laws like California’s CCPA, you can usually request access to your data, ask for deletion and object to certain uses.
- Export your data first so you have a record.
- Submit the request through the app’s rights form or privacy email, and screenshot the confirmation.
- Track the deadline: under GDPR, one month in most cases; under the CCPA, 45 days.
- If there is no response, complain to your data protection authority or, in the US, to the FTC or your state attorney general.
The FTC has also opened an inquiry into AI chatbots acting as companions, focused on safety and data practices around children and teens.
For the device side of companion privacy, such as lock screens, notification previews and backups, see our guide to adult app privacy.
This article is general information, not legal advice.
FAQ
Are AI companion chats private?
Usually not by default. Most apps store chats in readable form on their servers, may review them for moderation and may use them for training.
Are AI companion chats legally protected?
No. They carry no attorney-client, medical or other privilege and can be requested through legal process.
What does client-side encryption mean for a companion app?
Your data is encrypted on your device with a key the platform does not hold, so the server stores only ciphertext. Mistrix uses this for sensitive data and stored chats, with a key derived from your PIN.
How do I stop a companion app training on my chats?
Look for a training or data-use toggle in privacy settings. If there is none, check the policy for an opt-out contact and use your GDPR or CCPA rights.
How long do companion apps keep data after deletion?
It varies by app. Look for a specific number of days in the policy, and remember that backups and trained models may be handled separately.