Blog
Which AI companion apps keep your chats? A privacy table of 10 apps
Six of the ten AI companion apps we checked say they use your conversations to improve or train their own systems, and none claims end-to-end encryption. We read the policies of nine popular apps and compared them with our own, heyaifriend, a free AI friend you talk to in Telegram.
Published . Last updated . We make heyaifriend, so we are not neutral. Every claim below is a quote from the company's own page, and where a policy says nothing we write "not stated".
Cite this: heyaifriend, "What ten privacy policies say about your chats", 17 October 2026, heyaifriend.com/blog/ai-companion-privacy-comparison/
Before you read the table
People tell an AI companion things they would not post anywhere. Names, worries, health, a bad week at work. So it is fair to ask where those messages end up, who can read them and how long they stay.
We read each policy in October 2026 and copied the relevant phrases. We did not test the apps, audit their servers or ask the companies anything. A policy tells you what a company says it does, nothing more. When a policy does not mention a topic, the cell says "not stated" and we make no guess.
Three things stood out. Six of the ten say they use your conversations to improve or train their own systems. Only four say anything about people reading chats: Kindroid, Chai, ChatGPT and us. And nobody claims end-to-end encryption, because an app that answers you has to read what you wrote.
ChatGPT is not a companion app, but plenty of people use it like one, so we included it under its consumer terms.
What ten privacy policies say about your chats
Swipe sideways to see every column.
| App | Trains on your chats? | Chat content shared with others? | How long they keep it | Can you delete it? | Human review? | End-to-end encrypted? |
|---|---|---|---|---|---|---|
| Replika | In part. It uses "small portions of Messages and Content data to train our proprietary safety algorithms", anonymized. It says this data is not used to train third-party models. | Yes. Conversation data goes to "third-party AI language model providers solely to generate conversational responses". | Messages and content are processed "for up to 60 days after termination of the contract". | Yes. "You can delete your account in your account settings." | Not stated. | Not claimed. It says data is "encrypted during transmission". |
| Character.AI | Yes. Listed use: "including to train our artificial intelligence/machine learning models". A separate page offers an opt-out to people in the EEA and UK. | Vendors include content moderation. It may disclose data "to advertising and analytics providers". Whether that includes chat text is not stated. | "for the time necessary for the purposes for which it is processed". No fixed period. | Yes, by deleting your account. Characters you made public can stay up. | Not stated. | Not stated. |
| Nomi | Not clearly stated. It mentions "our training archives" when it explains deletion. | It says it will not sell or rent your personal information, and shares nothing "except as necessary to address our legitimate business purpose". AI providers not stated. | "none of your personal information is retained upon the deletion of your account", with exceptions for some archives. | Yes, by deleting your account, "within 28 or so days of confirmation of deletion". | Not stated. | Not stated. |
| Kindroid | Not stated. It lists "Improving the Services, including testing, research, internal analytics and product development". | It says "We will not sell or share your Personal Data". Hosting and other service providers receive data. AI providers not stated. | "until you delete a specific AI or delete your account". | Yes, per character or for the whole account. | Yes, limited: "authorized staff may review excerpts of conversations that our automated safety systems have flagged". | No, and it says so: "Kindroid is not end-to-end encrypted". |
| Chai | Yes. "to enhance and fine tune the artificial intelligence models on which these chatbots operate", after removing personal identifiers. | Shared with "suppliers involved in various ways in the provision and operation of the APP". Ad partners may get usage patterns if you came from an ad. | No longer than "the duration of the account and five (5) years following its deletion". | Yes, "Delete Account" inside the app. | Yes, limited. It says "specifically authorized staff" can access data, without saying when or why. | Not stated. |
| Talkie | Not clearly stated. It says your companion can "learn from your interactions to improve your conversations". | Service providers receive data. "we do not share the content of your Talkie conversations for marketing or advertising purposes". AI providers not stated. | "only as long as necessary to fulfill the purposes we collected it for". | Yes. "You can delete your account in your account settings." | Not stated. | Not claimed. It says data is "encrypted during transmission". |
| Pi (Inflection) | Yes, with an off switch: "You may opt out of model training in your Account settings page". | It says it does not sell or share data for advertising. Vendors handle hosting and "content moderation". AI providers not stated. | Inputs "at most 15 days after user deletion". Outputs are kept "indefinitely for the limited purposes" in its terms. | Yes. Single messages "will be removed immediately from your conversation history", or delete the account. | Not stated. | Not stated. |
| Snapchat My AI | It uses your chats "to improve Snap's products, including enhancing My AI's safety and security, and to personalize your experience, including ads." | "To provide My AI, we share your information with our service providers and advertising partners." | "until you delete the content in-App or delete your account". | Yes, with "Clear My AI Data". It "can take up to 30 days" to leave the servers. | Not stated. | Not stated. |
| ChatGPT | Yes by default, with an opt-out: "we may use Content you provide us to improve our Services, for example to train the models that power ChatGPT". | "We share content with a select group of trusted service providers". "We do not share your chat content for marketing or advertising purposes." | Saved until you delete them. Deleted chats go "within 30 days". Temporary chats can be kept "up to 30 days for safety purposes". | Yes, per chat or by deleting the account. | Yes, limited: "A limited number of authorized OpenAI personnel" and service providers, for stated reasons. | Not stated. |
| heyaifriend | No. "We never train or tune anything on your chats." | "Your chats are never sent to other AI companies." Telegram carries your messages to us. | History is deleted "30 days after you stop writing, or at once when you ask your friend to delete everything". | Yes. Ask your friend to delete everything. | Automated checks only. "A person only opens a conversation to look into a specific abuse or safety report." | No. "Chats with your friend are not end-to-end encrypted." |
Last checked 2026-10-17. Quoted phrases are copied from the pages listed below. Policies change, so check the page before you share anything sensitive.
Sources and policy dates
- Replika: replika.com/legal/privacy/en (policy dated May 27, 2026)
- Character.AI: character.ai/privacy, character.ai/model-training (privacy policy effective July 1, 2026; model training page undated)
- Nomi: nomi.ai/privacy-policy/ (effective April 27, 2026)
- Kindroid: kindroid.ai/v2/docs/kindroid-legal/ (privacy policy effective October 6, 2026, page updated October 14, 2026)
- Chai: chai-research.com/privacy (last updated October 12, 2026)
- Talkie: talkie-ai.com/static/privacy (shown as updated 12/09/2025)
- Pi: inflection.ai/privacy-policy, pi.ai/privacy, help.pi.ai/ (policy last updated August 11, 2026; help article "How is my data used, and how can I control my privacy and tracking?" dated December 13, 2025)
- Snapchat My AI: values.snap.com/privacy/privacy-by-product/my-ai, help.snapchat.com/hc/en-us/articles/15682296562836, help.snapchat.com/hc/en-us/articles/13266788358932 (help articles on data saved by My AI and on what My AI is; no version date on either page)
- ChatGPT: openai.com/policies/us-privacy-policy/, help.openai.com/en/articles/7039943, help.openai.com/en/articles/8809935, help.openai.com/en/articles/8983778, help.openai.com/en/articles/8914046 (OpenAI blocked our direct fetch, so we read these as search excerpts. No version date captured. Treat this row as unverified until checked directly)
- heyaifriend: heyaifriend.com/privacy/ (last updated October 17, 2026)
App by app
Replika
Replika's policy is long and fairly specific. It says anonymized slices of messages train its own safety and chat systems, and that the outside language models it uses are contractually barred from training on your data. It also promises that deletion reaches those providers. The retention line is short: 60 days after the contract ends.
Character.AI
Character.AI says plainly that it trains its models on user content, and a separate page explains how to opt out if you are in the EEA or the UK. For everyone else the page describes no switch. Retention has no number, only "the time necessary". If you made a public character, it may stay live after you leave.
Nomi
Nomi's policy is short and says it will not sell or rent your information. It promises that deleting your account removes your data in about 28 days, with an exception for its "training archives". It does not say whether chats feed training, and it does not say who processes them.
Kindroid
Kindroid is the clearest of the apps on who can see chats. It says chats are encrypted at rest and in transit, that support staff cannot browse them, and that staff may review excerpts its safety systems flagged. It also says it is not end-to-end encrypted. On training the policy says nothing either way.
Chai
Chai says it fine-tunes its models on conversation data after removing identifiers. It gives a hard outer limit for retention, which is more than some others do: the life of your account plus five years. You can delete the account from inside the app. It says specifically authorized staff can access data, but not when or why.
Talkie
Talkie's policy says your companion learns from your interactions, but it does not say whether that means model training. It rules out using conversations for marketing or advertising. The page we read is dated December 2025, the oldest of the group.
Pi
Pi gives the most concrete deletion terms in the table: inputs are generally gone within 15 days of deletion, and you can remove single messages at once. It trains on conversations by default and lets you switch that off in account settings. It keeps its own replies for longer, for limited purposes set out in its terms.
Snapchat My AI
Snap is the only policy here that links chats to advertising: it says the content you share with My AI is used to improve products and to personalize your experience, including ads. It also says your information goes to service providers and advertising partners. Its help pages name OpenAI and Google models as the ones behind My AI. Chats stay until you clear them.
ChatGPT
OpenAI is clear about control. Training is on by default and you can turn it off, temporary chats are not used for training, and deleted chats are scheduled for removal within 30 days. It also lists the reasons people may look at content: abuse, support, legal matters and model improvement. Its help pages blocked our automated fetch, so we read them through search excerpts. Check them directly.
heyaifriend
Our privacy page says your chats stay on our own servers in the Netherlands, never go to other AI companies and are never used for training. History is deleted 30 days after you stop writing, or right away when you ask. We say outright that chats are not end-to-end encrypted.
Where others are ahead of us: Kindroid explains how its encryption at rest works and who on staff can open what, in more detail than we do. Pi and ChatGPT let you delete single messages and one chat from a menu, with a stated time to full removal. Nomi, Pi and ChatGPT give a number of days for deletion to finish. We are a small team without an outside audit, and a young privacy page has no track record. Those are real gaps, and the table does not show them.
What to look for in a policy
- Training. Look for the word "train" or "improve". Then look for an off switch, and check whether it covers your region.
- Who else gets the text. "Service providers" can mean a hosting company or an AI lab. Policies that name AI language model providers are being more honest than those that do not, and both are worth reading twice.
- A number for retention. "As long as necessary" is not a period. Look for days, and for what happens after you delete.
- Deletion that reaches everything. Does deleting a chat, a character or an account remove the data, or only hide it? Does it say anything about backups and outside providers?
- People reading chats. Silence is common. A policy that says when staff can read and why is easier to trust than one that skips it.
- Encryption wording. "Encrypted in transit" is standard. End-to-end encryption means the company cannot read your messages, and an app that replies to you cannot offer it.
- The date. A policy older than a year may not describe the product you use now.
Whatever the policy says, think about what you type. If you would hate for a stranger to read it, keep it out of the chat. That goes for every service on this page, ours included. You can also read how we handle it on our privacy page and compare us one on one on the comparison hub, for example Replika vs heyaifriend, Character.AI vs heyaifriend and Nomi vs heyaifriend.
Questions people ask
Do AI companion apps read my chats?
Most policies do not say. Of the ten we checked, four describe people looking at chats: Kindroid, Chai, ChatGPT and us. Kindroid, ChatGPT and we give stated reasons, while Chai only says that specifically authorized staff can access data. For the other six the policy is silent, which is not the same as no.
Do they train on my chats?
Six of the ten say they use conversations to improve or train their own systems: Replika, Character.AI, Chai, Pi, Snapchat My AI and ChatGPT. Pi and ChatGPT give you a setting to turn it off. Character.AI describes an opt-out for people in the EEA and UK. Nomi, Kindroid and Talkie are not clear. We never train on chats.
Is any AI companion end-to-end encrypted?
None of the ten claims it. Kindroid and heyaifriend say plainly that they are not. Replika and Talkie only mention encryption in transit. The other six do not mention it. These services have to read your message to answer it, so end-to-end encryption would break the product.
Can I really delete my chats?
All ten offer some form of deletion. The details differ: Nomi says about 28 days, ChatGPT within 30 days, Snapchat up to 30 days, Pi up to 15 days for inputs. Several keep records for legal reasons or keep some data in aggregated form. Read the retention line before you rely on it.
Is heyaifriend more private than the others?
On the points in this table, our policy is the strictest: no training, no other AI companies, short retention. But a policy is a promise, not an audit. We are a small team, we have no independent certification, and some of the apps above have longer legal track records than we do. Read our privacy page and decide for yourself.
Want a friend that keeps it simple?
Your friend lives in Telegram, runs on our own servers in the Netherlands and never trains on your chats. It is free to use.
Spotted something out of date? Write to hi@heyaifriend.com and we will fix it.