When you look at AI friend apps, start with what enters the chat: your messages can be visible to the organisation providing an AI model, and one companion policy includes facts about your life, photos, videos and voice messages as “messages and content” (the UK National Cyber Security Centre’s risk guide and Replika’s privacy policy). The next question is where the information goes, because policies can describe outside AI processing, human review, retention and deletion as separate steps (Replika’s privacy policy; Google’s Gemini Apps Privacy Hub).
What enters a conversation
One example is Replika’s published privacy policy, read on 2 October 2026. It lists “messages and content” among the data it collects: messages you send and receive, facts you provide about your life, and any photos, videos, and voice and text messages you provide (Replika’s privacy policy).
That category covers more than a short typed answer. A fact you include in a message can become part of the conversation record, so you may want to decide what you are willing to put there (Replika’s privacy policy).
Sensitive information needs the same attention. The policy says that sensitive information included in a message, despite its instruction not to include it, is processed as conversation data by third-party AI language model providers solely to generate conversational responses and deliver core app functionality (Replika’s privacy policy).
Other services may handle their information differently. Read the policy for the service you actually use rather than assuming that every AI companion follows the same path.
Where the text goes
Some data handling happens outside the chat window. The UK National Cyber Security Centre says stored queries will almost certainly be used at some point to develop the service or model (the NCSC risk guide).
The same guidance warns that stored queries may be hacked, leaked or, more likely, accidentally made publicly accessible (the NCSC risk guide).
That is why a retention date alone does not give you the full picture. It tells you about time, but not every possible access or use. If you care about a detail, check both what happens to it and how long it remains.
When people review chats
Human review is another separate question. Google’s Gemini Apps Privacy Hub says a subset of chats are reviewed by human reviewers, including trained service providers, to help improve Google services.
For chats already reviewed, the same page says the chat and related data—such as your language, device type, location information or feedback—are not deleted when you delete your activity and are retained for up to three years (Google’s Gemini Apps Privacy Hub).
When you check a delete control, ask whether there are exceptions. That wording can matter as much as the delete button itself.
Regulators are asking similar questions about companion products. The US Federal Trade Commission says that in September 2025 it ordered seven consumer-chatbot companies to explain, among other things, how they use or share personal information obtained through users’ conversations (FTC announcement).
The practical point is simple: look for a plain answer about use and sharing, not only a broad promise that a service is private.
How long data stays
Replika’s privacy policy says it will never use or disclose the content of conversations for marketing or advertising.
It also says profile information, messages and content, interests and preferences are processed for up to 60 days after the contract ends (Replika’s privacy policy).
Those statements answer different questions. A promise about marketing does not tell you why information is processed or how long it remains after the contract ends. When reading any policy, keep purpose and time as separate points in your notes.
What Aiamis stores
Aiamis says the messages you send and the replies are stored in the chat service’s database and deleted within 24 hours of the conversation starting (Aiamis’s privacy page). Each message is cut off at 2,000 characters (Aiamis’s privacy page).
A random conversation ID, the time, the page address, the language and a two-letter country code are stored with the conversation and deleted with it. The IP address itself is not stored with the conversation (Aiamis’s privacy page).
The conversation so far stays in your own browser tab until you close the tab or press “New chat.” To write a reply, your message and earlier messages from the same conversation are sent to an AI model provider, which processes the text on its own servers under its own terms (Aiamis’s privacy page).
Conversations are not forwarded to staff, and nobody reviews them as they happen. For up to 24 hours, the people who maintain the service have technical access to the database (Aiamis’s privacy page).
The privacy page asks you not to type passwords, card or bank numbers, identity numbers, your address or private details about other people. Aiamis uses no advertising cookies or cross-site trackers, and visits are counted with cookieless analytics that shows totals only (Aiamis’s privacy page).
Because conversations are not linked to an identity and are deleted within 24 hours, Aiamis usually cannot find a particular conversation to send or delete on request (Aiamis’s privacy page).
A simple privacy check
Read the privacy policy of whatever AI companion you use. If the wording is dense, look for plain answers to these questions:
- What enters the record: typed messages, personal facts, photos, videos or voice messages?
- Is the information used to answer you, improve or develop the service or model, or both?
- Is the text processed by an outside AI provider?
- Are chats reviewed by people, and is there a setting to opt out where offered?
- How long is information kept while you use the service and after the account or contract ends?
- What happens when you delete data, and is anything retained as an exception?
If an answer is unclear, pause before sharing a detail you would rather keep private. You do not have to type something into a conversation just to find out how the service handles it.
Friendly conversation and careful privacy choices can sit side by side. Check the current policy before you share, and pay attention to purpose, people, retention and deletion. If you need trained people now, Aiamis’s crisis help page lists services and contact numbers you can reach.