Is Your AI Companion App Safe? A 10-Point Check
By myaicompanion Editorial · Updated 2026-10-23
Is your AI companion app safe? For many apps, the honest answer is "not as safe as you think."
I built this checklist after reading through the breaches and reviews below, and I now run it on every app before I write about it.
People tell these apps things they tell no one else. That makes companion apps some of the most sensitive software on your phone, and the track record so far is poor. Here is what has gone wrong, and a 10-point check you can run on any app in about ten minutes.
Quick answer. Assume anything you type could one day be read by someone else. Use an email that doesn't identify you, check whether the app lets you delete your data, and look up its breach history before you pay. Never share your full name, address, workplace or photos of real people. My 10-point check is below. An app that fails three or more is one to avoid for anything personal.
What has already gone wrong
These are documented cases, not hypotheticals.
A breach that tied 1.9 million emails to private prompts
In September 2024, a hacker took data from Muah.AI, an "AI girlfriend" site.
According to Have I Been Pwned, about 1.9 million email addresses were exposed together with the prompts users had written to generate images.
Many prompts were sexually explicit, and some described child exploitation scenarios.
Many addresses were real, identifiable emails, and law firm Linklaters noted the obvious risk: blackmail and extortion.
According to reporting by CyberInsider, the hacker described the site as poorly assembled from open-source components.
Most romantic chatbots failed a privacy review
In February 2024, Mozilla's *Privacy Not Included team reviewed 11 romantic AI chatbots and gave every one of them its privacy warning label.
Ten of the 11 failed Mozilla's minimum security standards.
About 90% could share or sell personal data, and about half did not let users delete their data.
A regulator fined a major companion app
In 2025, Italy's data protection authority fined Luka Inc., the company behind Replika, €5 million, according to IAPP and Silicon UK.
The regulator found problems with the legal basis for processing data, the privacy policy and age verification.
Chats can be sold with the company
When a company goes bankrupt, its data can become an asset.
Character.AI's Chapter 11 sale is a live example: user chats are reported as excluded from Disney's bid but still held by the estate.
I explain that in can Character.AI sell your chats?
The 10-point safety check
Run this on any app before you share anything personal.
| # | Check | Green flag | Red flag |
|---|---|---|---|
| 1 | Breach history | No known breaches, or a clear public response | Breaches with no explanation |
| 2 | Data deletion | You can delete chats and your account in the app | Only by email, or not at all |
| 3 | Training use | Policy says chats are not used for training, or lets you opt out | Vague "to improve our services" |
| 4 | Selling or sharing | No selling of personal data | "Partners", "affiliates", advertising |
| 5 | Company identity | A named company, country and contact | No company name, no address |
| 6 | Account security | Strong passwords, two-factor login | Accepts "11111111" |
| 7 | Payments | Mainstream processor, clear billing name | Unclear billing, crypto only |
| 8 | Age protection | Real age checks, no minor-coded content | Anything goes |
| 9 | Data in a sale | Policy says what happens if the company is sold | Silent, or "assets may be transferred" |
| 10 | Trackers | Few third-party trackers | Heavy ad and analytics tracking |
If an app fails three or more checks, don't use it for anything personal.
How to check each point quickly
Breach history (point 1)
Search the app's name plus "breach" or "leak", and check Have I Been Pwned.
Some breaches, including Muah.AI's, are marked sensitive, so you can only check them by verifying your own email.
Privacy policy (points 3, 4 and 9)
Open the privacy policy and search for four words: "train", "sell", "share" and "merger".
Those four searches tell you most of what you need.
Deletion (point 2)
Look in the app's settings for "delete account" or "delete data" before you pay.
If you can't find it, that is your answer.
Company identity (point 5)
Scroll to the bottom of the website and look for a company name, a country and a real contact address.
An app that hides who runs it is asking you to trust nobody in particular.
Age protection (point 8)
Check whether the app verifies age with more than a typed birth date, and whether it blocks minor-coded content.
If you are an adult who got locked out by a selfie check, my guide to Character.AI age verification explains the legitimate ways back in.
How to protect yourself on any app
- Use a separate email that does not contain your name or workplace.
- Use a strong, unique password and turn on two-factor login if it exists.
- Keep real identities out. No full names, addresses, workplaces, or details about real people.
- Never upload photos of real people, including yourself, to apps you haven't checked.
- Export, then delete chats you would not want leaked.
- Pay carefully. A card statement can reveal what you use, so check the billing name.
Why this matters more than for other apps
A leaked shopping history is embarrassing.
A leaked companion chat can expose your relationships, health, sexuality and loneliness, with your email attached.
That is why the bar for these apps should be higher, and why I include privacy in every review I publish.
Frequently asked questions
Are AI girlfriend apps safe?
Many are not very safe for your privacy.
Mozilla's 2024 review of 11 romantic AI chatbots gave every one a privacy warning, so check each app before sharing anything personal.
What happened in the Muah.AI breach?
In September 2024, about 1.9 million email addresses were exposed alongside users' image-generation prompts, many of them explicit.
Have I Been Pwned lists it as a sensitive breach.
Can AI companion apps read my chats?
Usually, yes.
Most apps store conversations on their servers, and policies often allow staff access, model training or transfer in a sale.
How do I check if my email was leaked by an AI app?
Use Have I Been Pwned.
Sensitive breaches can only be checked by verifying that you own the address.
What should I never tell an AI companion?
Your full name, address, workplace, financial details, passwords, and photos or details of real people.
The bottom line
Is your AI companion app safe? Run the 10-point check, use a separate email, and assume anything you type could become public.
The apps that pass are the ones worth your trust, and your money.
How I report. This guide relies on Have I Been Pwned, Mozilla's *Privacy Not Included review, regulator decisions and press reporting, all linked above. My app reviews add these checks to every test. Last checked on October 23, 2026. This is not legal or security advice. myaicompanion Editorial
Related reading