AI companion app privacy: what 14 apps' own policies say
The Morse teamPublished 8 min read
AI companion app privacy is weaker than most people expect. As of October 2026, most of the 14 companion apps whose policies we read can use your chats to improve their AI and keep data for an open-ended "as long as necessary," and several let staff see some conversations. SpicyChat's terms say it may "access, review, edit, and delete Your content at any time and for any reason," three apps share word-for-word policy clauses, and age checks range from a typed birth date to a Persona or Yoti selfie.
We read each app's own privacy policy, terms, safety page, or help center on October 23, 2026, and put the answers in one table. Five apps we set out to include aren't in it: Talkie, Janitor AI, Chub, Muah, and CrushOn. Their pages either refused our reader or load the policy only through in-browser scripts we couldn't read, so we left them out rather than guess. Where a policy is silent, the table says so.
AI companion app privacy compared: 14 policies, October 23, 2026
| App (policy date) | Trains on your chats? | Retention after deletion | Human review | Age check | Ads and sharing |
|---|---|---|---|---|---|
| Character.AI (July 1, 2026) | Yes; opt-out only in the EEA and UK (help) | "Time necessary"; public Characters can stay up (policy) | Not described; gives data to content moderation vendors (policy) | Persona selfie, ID if needed (help) | Tailored ads with ad partners (policy) |
| Replika (May 27, 2026) | "Small portions," anonymized, for its own models (policy) | Messages up to 60 days (policy) | Not described (policy) | Birth date; 18+ (policy) | No chat content for ads; site visitor data to ad partners (policy) |
| Nomi (April 27, 2026) | Not stated; mentions "training archives" (policy) | Deleted "within 28 or so days" (policy) | Not described (policy) | Birth date; 18+ (terms) | No ads "currently"; no sale (policy) |
| Kindroid (October 22, 2026) | Not stated; uses data for "research" and "product development" (policy) | Kept until you delete it (policy) | Flagged excerpts only; support "cannot browse your chats" (policy) | Payment, or a Yoti selfie or ID if flagged (help) | "Will not sell or share" (policy) |
| Chai (October 12, 2026) | Yes, identifiers removed (policy) | Up to 5 years (policy) | "Specifically authorized staff" (policy) | Persona selfie or ID (safety) | Ads on free plan, with consent (policy) |
| PolyBuzz (June 1, 2026) | Model "may evolve based on user inputs" (terms) | "No longer than is necessary" (policy) | May "access and use the contents" (terms) | Ondato and Yoti, UK only (terms) | Ad networks such as TopOn; no sale (policy) |
| Candy.ai (October 19, 2026) | Yes, de-identified (policy) | 3 years after last activity, unless you ask (policy) | Yes, for training sets and flags (policy) | Third party, where law requires (policy) | Marketing sharing needs opt-in (policy) |
| SpicyChat (terms July 23, 2026) | May review content "to improve our services" (terms) | "As long as is necessary" (policy) | "Access, review, edit, and delete" (terms) | Video selfie or ID, in listed regions (docs) | "Use, sell, license" chat content (terms) |
| OurDream (August 26, 2026) | Yes (policy) | "Time necessary"; popular Characters can stay (policy) | Not described (policy) | Third party, where law requires (policy) | No ads "as of the date of this Policy" (policy) |
| Secret Desires (October 24, 2024) | Yes (policy) | "Time necessary"; popular Characters can stay (policy) | Not described (policy) | Terms bar under-18s (policy) | No ads "as of the date of this Policy" (policy) |
| Anima (no date shown) | Yes, "to train and improve our AI models" (policy) | "Reasonably necessary" (policy) | Not described (policy) | Users promise they're over 16 (policy) | AppsFlyer and Facebook Custom Audiences (policy) |
| Tolan (August 24, 2026) | Not stated for chats (policy) | Backups "for a limited time" (policy) | Not described for chats (policy) | Under-13s allowed with a parent's consent (policy) | Third-party advertising partners (policy) |
| DreamGF (no date shown) | Not stated (policy) | "As long as necessary" (policy) | Only chats you report (policy) | 18+ in policy (policy) | Shares with suppliers as needed (policy) |
| Sakura.fm (January 6, 2024) | Not stated (policy) | "As long as is necessary" (policy) | Not described (policy) | "Does not address anyone under the age of 13" (policy) | "May sell and may have sold" identifiers (policy) |
"Not described" means the policy we read says nothing either way, not that the company doesn't do it.
Do people at companion app companies read your chats?
Some say so. SpicyChat's terms, updated July 23, 2026, say: "We may access, review, edit, and delete Your content at any time and for any reason, especially to improve our services." The same terms say "SpicyChat.AI does not provide facilities for sending or receiving confidential electronic communications."
Candy.ai lists "human review of de-identified and/or anonymized interactions" when it prepares training data, and human review of content its moderation tools flag (Candy.ai). PolyBuzz's terms authorize it to "reasonably access and use the contents you and/or you child upload" for product analysis. Chai says your data is accessible "only by specifically authorized staff" (Chai).
Two apps draw tighter lines. DreamGF reviews "the chat correspondence you conduct with AI only if you have reported a problem" (DreamGF). Kindroid's policy, effective October 22, 2026, says "Our customer support staff cannot browse your chats," while authorized staff "may review excerpts of conversations that our automated safety systems have flagged."
Chats kept on a company's servers can also be ordered into court, which we cover in can AI chats be subpoenaed.
How do AI companion apps check your age?
Most ask for a birth date, and a few run a face or ID check. Character.AI said in October 2025 that it would end open-ended chat for users under 18 "no later than November 25" and combine an in-house age model with Persona (Character.AI blog). Its help center says most people only take a selfie, an ID is asked for only if that fails, and Persona deletes both "within 7 days." Chai uses Persona too, for a selfie age estimate or a government ID (Chai safety center).
Kindroid treats a payment on file as proof of age, and a background system "analyzes interactions to estimate whether an account is likely to belong to someone under 18" for free users (Kindroid). A flagged user can pay or use Yoti, whose selfie check "passes if Yoti estimates you are 21 or older," and Kindroid "only receives a pass or fail result."
SpicyChat requires a video selfie, with an ID fallback, only to see NSFW content in France, the UK, Italy, Australia, and 26 US states, and it decides by "your current connection location (IP address)" (SpicyChat docs). PolyBuzz checks UK users through Ondato and Yoti (terms). Tolan goes the other way: its policy has a Children's Privacy Notice for users under 13, with a parent's consent.
Why do some companion app privacy policies match word for word?
Three policies in our table share whole sentences. Character.AI's, OurDream's, and Secret Desires' policies all list "Analyze, maintain, improve, modify, customize, and measure the Services, including to train our artificial intelligence/machine learning models" among their uses of your data (Character.AI, OurDream, Secret Desires). All three also have a "Popular Characters" clause that lets the company keep a public Character "active on the Services, even if you otherwise delete your data and your account."
The wording has drifted. OurDream and Secret Desires keep a Character only if it "reaches a certain threshold of popularity." Character.AI's July 2026 policy keeps any Character that "has been made available to other users." Secret Desires' policy was last updated October 24, 2024, OurDream's on August 26, 2026, and Character.AI's took effect July 1, 2026.
Do companion apps train on your chats, and how long do they keep them?
Eight of the 14 policies say outright that chats or interactions can improve or train their models, and only Character.AI names a training switch, offered to EEA and UK users alone (Character.AI help). Retention runs from Nomi's "28 or so days" to Chai's five years after deletion, and most policies give no number at all; our Character AI alternatives guide walks through Nomi, Replika, and Chai clause by clause.
Do AI companion apps sell your data or show ads?
The answers split. Character.AI discloses personal information to advertising partners "in connection with the provision of tailored advertising" (Character.AI), and Sakura.fm's policy says, under California's definition, that it "may sell and may have sold in the last twelve (12) months" identifiers and internet activity (Sakura.fm). SpicyChat's terms go furthest: "SpicyChat.AI has the right to and will use, sell, license the content generated through chats for the proper working of the Service, promotion and this License."
Nomi and Kindroid get credit here. Nomi says "We do not and will not sell or rent to any third party any of your personal information" (Nomi), and Kindroid says "We will not sell or share your Personal Data, and have not done so over the last 12 months" (Kindroid). PolyBuzz says "We DO NOT sell User Information" (PolyBuzz), though its ads come through networks such as TopOn; we cover its two operators in is PolyBuzz safe.
How Morse keeps your companion chats out of a company's hands
In every row of the table, the company holds your chats, and its policy decides what happens to them: who reads them, how long they stay, and whether they're licensed onward. A policy can be rewritten, copied from another app, or sold with the company. Morse takes that decision away from us by not holding the chats. Characters on Morse keep your chats, the characters you make, and your personas in your browser, encrypted, and our servers don't keep your messages or log what's in them (privacy policy).
That changes each question above:
- Who can read them. Nobody at Morse browses your history, because it isn't on our servers. It locks when you sign out, and opening it takes a key that never leaves your device plus one our server issues at sign-in.
- How long they last. As long as you keep them. Clearing your browser or deleting your account erases them, and we can't restore them, so save a copy of any story you want to keep.
- What the policy lets us do. Morse doesn't train AI on your content, sell your data, or show ads, and it has no advertising trackers or third-party analytics. Your account stores sign-in details, your plan, your balance, and a usage ledger with no content.
- Age. Morse is adults only, and every user confirms they're 18 or older.
If a character conversation reads like suicidal thinking, Morse shows crisis lines, and the check runs on your device. Your Character.AI characters, chats, and personas can come with you through Morse's importer, free on every plan. For conversations outside Characters, Chat lets you choose a mode per chat: Private, the default, runs open-weight models like DeepSeek, Kimi, and GLM on providers that agreed to keep nothing, and Anonymous sends GPT, Claude, or Gemini your message without your account, email, or IP address, though the provider may keep it for a limited time to check for abuse under its own policy.
Send a first message from the Morse home page without an account, or start free with unlimited character messages and no card.
Common questions
Do companion apps send my chats to OpenAI or other AI companies?
Several say so. Replika's privacy policy says third-party AI language model providers generate its replies and are contractually barred from training on your data, Candy.ai's says third-party LLM providers "may receive the content of your messages," and PolyBuzz's lists sharing with third parties "including the Chat-GPT platform."
Does the selfie I send for an age check stay with the app?
Usually not with the app itself. Character.AI's help center says Persona handles the check and deletes any selfie or ID "within 7 days," PolyBuzz says it doesn't store your ID, and SpicyChat says its partner deletes the data "according to their privacy standards" without giving a period.
Is the government looking into AI companion apps?
Yes. On September 11, 2025, the FTC ordered seven companies, including Character.AI's parent Character Technologies, Meta, OpenAI, and xAI, to explain how they "monetize user engagement" and how they use or share what people say to their chatbots.
Which companion apps let children sign up?
Of the 14 we read, Tolan is the one whose policy plans for it: a Children's Privacy Notice covers users under 13, with a parent's consent given during sign-up and managed under Settings, then Family. Character.AI's policy sets its minimum at 13, or 16 in the EEA and UK.