AI Girlfriend Privacy 2026: What Data Do They Collect?

An AI girlfriend collects five categories of data: the content of your conversations, generated or uploaded media, your account identity, your payment data, and technical data. That’s what the privacy policies of the apps in our comparison show, as reviewed on September 30, 2026.

• Conversations: every message you write is sent to the publisher’s servers to be processed by the language model. It’s stored so the character has “memory.” This is the most sensitive data: you share intimate preferences in it, sometimes details of your life.
• Media: generated images, voice messages, and videos are kept in your gallery, so on the servers. If you send a photo of yourself (some apps allow it for selfies or “calls”), it’s stored too.
• Account identity: email, username, sometimes date of birth for age verification. Few apps require an ID document as of September 30, 2026.
• Payment: handled by a third-party payment processor; the publisher normally doesn’t see your card number, but your name and the transaction descriptor show up on your bank statement.
• Technical data: IP address, device type, cookies, usage statistics, often shared with analytics tools.

The key point: no AI girlfriend can work without reading your conversations, since the model generates the replies. So the question isn’t “does it collect data” but “who has access, for how long, and can you delete it.”

The encryption some apps advertise protects your data from third parties, not from the publisher itself. Encrypting means making data unreadable without a key. There are three levels to tell apart.

Encryption in transit (HTTPS) protects traffic between your browser and the server; every app in our comparison uses it, it’s the web standard. Encryption at rest protects data stored on servers against a leak or a stolen drive; it’s a real plus, but the publisher holds the key. End-to-end encryption, where only your device can read the messages, is incompatible with an AI girlfriend: the model has to read your text to reply.

Secrets AI states on its public pages that conversations are encrypted and puts privacy at the center of its pitch; it’s the only app in our comparison to do so this explicitly. On the pages we reviewed, we found no detail on the exact level (at rest or not). Treat the claim as a credible commitment, not technical proof. Candy AI, OurDream AI, GirlfriendGPT, and Lovescape don’t say much on this point.

Italy’s data protection authority, the Garante, fined Luka Inc., the publisher of Replika, €5 million for failures in how it processed personal data. It’s the only public penalty of its kind among the thirteen apps we track, as of September 30, 2026.

The decision notably concerns the lack of a clear legal basis for processing data and age verification deemed inadequate. It shows that European regulators are now looking at AI companions, and that even a player established since 2017, with apps in the stores and a multilingual interface, can be found at fault.

Should you avoid Replika because of it? Not necessarily: the app is still non-explicit, which limits how sensitive the chats are, and the penalty is meant precisely to force fixes. But it’s a reminder that “big name” doesn’t mean “data handled well.” Newer publishers, often based outside the European Union, simply haven’t been examined yet.

Where the publisher is incorporated determines which law applies and how easy it is to seek recourse. Here’s what the legal notices state as of September 30, 2026.

The GDPR, the EU’s data protection regulation, applies to any company targeting European users, wherever it’s based. In practice, though, exercising your right of access or erasure with a Maltese or Romanian company is easier than with a Delaware entity. In the US, there’s no single federal equivalent, so your rights depend on your state’s privacy law, if any. The publisher’s headquarters doesn’t tell you where the servers physically are, information that’s rarely published.

Kupid AI’s terms of service mention a data retention fee of $3.99/month after cancellation, a mechanism we haven’t seen at any other app in our comparison. In practice, if you stop your subscription but want to keep your character, gallery, and history, the platform can bill you that amount every month.

It isn’t a scam in itself, since it’s written in the terms, but it’s exactly the kind of clause nobody reads before subscribing at “$3.44/week.” The right question to ask: what happens if you don’t pay the fee? Is the data deleted, and how quickly? The terms we reviewed don’t make that clear, so ask support before paying.

More broadly, check what happens to your account when you cancel at each app: immediate deletion, retention by default, or the option to export. Our article on canceling Candy AI covers the issue of non-refundable tokens.

Ten minutes of checking before entering a card saves you from most nasty surprises. Here’s the list we apply to every app.

1. Find the legal notice: company name, address, country. If you can’t find it in two clicks, walk away.
2. Read the “data retained” section of the privacy policy: how long conversations are kept, sharing with subcontractors, use for training models.
3. Look for the right to deletion: a “delete my account” button in settings beats an email you have to send to support.
4. Spot hidden fees in the terms: retention (Kupid AI), non-refundable tokens (Candy AI), auto-renewal.
5. Note the billing descriptor: some publishers bill under a neutral name, others under the app’s name, which will appear on your statement.
6. Check authentication: a unique password, and two-factor authentication if it’s offered.

If an app fails two of these points, the price doesn’t make up for it. Our guide to choosing an AI girlfriend builds this checklist into its six criteria.

You can’t be fully anonymous, but you can shrink what ties you to your account to almost nothing. Three steps cover the essentials.

• A dedicated email, created for this purpose, without your name in it. Most apps require nothing else to open an account.
• A pseudonym in conversations: the character doesn’t need your real first name, your city, or your employer to be believable. What you write is stored; write as if someone could read it one day.
• A virtual or single-use card, offered by many online banks. It limits unexpected charges and hides your main card.

Avoid sending identifiable photos of yourself, even if the app offers it to personalize the experience. And on a shared device, use a private browsing window: since Candy AI, Secrets AI, and most competitors are web-only, your browser history is the first place your use shows up.

The full comparison lists the publisher, the country, and billing red flags for each app.