Can AI Companion Apps Read Your Messages?

"Can they read my chats?" has three parts: can the system read them (yes), can employees read them (depends on the policy), and who else receives them (service providers, sometimes outside AI companies). This guide takes each in turn. It belongs to our AI companion privacy section; every app fact comes from official policies, terms and help centers, and we did not test any app.

Why AI Companion Chats Cannot Be End-to-End Encrypted

End-to-end encryption, as in Signal or WhatsApp, means only the people in a conversation hold the keys. In a companion app, the other party is the company's AI running on the company's servers, so the company has to decrypt your message to generate a reply. Nomi's wiki says end-to-end encryption "is not possible with an AI chatbot". Kindroid's legal page says "Kindroid is not end-to-end encrypted" for the same reason.

That does not make encryption pointless. Encryption in transit stops others on your network from reading messages on the way, and encryption at rest protects stored chats if disks or backups are stolen. Neither stops the company itself, or anyone it authorizes, from reading.

What Each App Says About Encryption

Here is what the documents state, word for word where it matters. Several apps make vague claims on marketing pages ("advanced encryption") without saying what is encrypted; we list those as general claims.

Store labels are declared by developers, not audited. Muah AI is a warning here: press coverage of its 2024 breach noted that users had been told communications were encrypted, yet a hacker still took prompts linked to email addresses.

Do Staff Read Your Chats?

Policies fall into four groups.

Apps that limit staff access in writing

• Replika: its help center says "No humans join your conversations, and your messages are never read or responded to by people on Replika's behalf." The privacy policy itself does not describe safety review by staff.
• Kindroid: support staff "cannot browse your chats". Authorized staff may review excerpts that automated safety systems flagged, and Trust and Safety decrypts only the flagged context when a user appeals a lock and consents. Production access is limited to a small group of engineers.
• Romantic AI: its Content Management Policy says "We do not continuously review all interactions in real time". A moderator looks only when a user reports content, asks for removal, appeals, when a rights holder, payment partner, regulator or police sends a notice, or when a case is ambiguous.

Apps where moderators review flagged or reported content

This is the common model. Character.AI's Trust and Safety team of staff and contracted moderators acts on flagged and reported content. Candy AI says EverAI or authorized partners may review flagged content, and its privacy notice adds random quality-assurance checks and human review of de-identified interactions when preparing training data. CrushOn.AI uses "a combination of human moderators and automated systems" to review accounts, characters and interactions. GirlfriendGPT, Kupid AI and Anima say flagged content may be reviewed manually. Chai's Trust and Safety team reviews reports, and Talkie describes "human oversight" alongside AI moderation.

DreamGF's privacy policy is narrower: it reviews your chat correspondence "only if you have reported a problem related to it in our support center", although its separate moderation policy describes human moderators reviewing content its algorithms flag. Janitor AI's moderators review anything reported, and its Safety page says "The conversations you have on Janitor are yours", but it does not say whether staff can open private chats.

Apps that reserve broad rights

Some terms go further than moderation. Character.AI's Terms reserve the right to "access, review, screen, edit, modify and delete your content at any time". SpicyChat's Terms say it "may access, review, edit, and delete Your content at any time and for any reason, especially to improve our services", while an internal policy bars employees and contractors from unauthorised access to chats.

Apps that do not say

Nomi's policy is silent on staff reading chats; its CEO said in an April 2026 Q&A that NSFW and self-harm detection runs automatically "entirely within Nomi". Paradot and Muah AI say nothing beyond a complaints process at Muah. Nastia AI does not address ordinary chats, though restricted accounts can ask for a human review. EVA AI's Terms say only that "our representatives might moderate the activity of the chatbot", which does not settle whether they read user messages. GirlfriendGPT's FAQ claims only you and your AI can see your chats, which sits awkwardly next to its own policy on manual review of flagged content.

Automated Scanning Comes First

Before any person looks, software usually does. Chai scans every user message in real time for self-harm content. Kindroid says its automated detection involves no human reading, and Romantic AI's automated controls act without human involvement. Anima and GirlfriendGPT describe moderation filters built on their own language models, Nastia AI screens requests and generated media automatically, and Janitor AI's mobile apps run keyword checks on chats in Restricted Mode.

Laws push in this direction too. California's SB 243 and New York's Article 47 require companion operators to keep a protocol for detecting suicidal ideation or self-harm, which means the app needs some way to detect such messages. Our overview of US companion chatbot laws has the details.

Who Else Receives Your Messages

• Outside AI model providers: Replika sends de-identified conversation data to third-party language model providers (contractually barred from training on it). Candy AI says third-party LLM providers may receive message content, and CrushOn.AI lists the "operator of the AI basic model" as a sub-processor. On Janitor AI, chats go to whichever external model you connect.
• Infrastructure providers: hosting and "AI infrastructure" companies named in general terms by Romantic AI, Nastia AI and others.
• Not advertisers, at least for chats: Replika, Talkie and Paradot say conversation content is never shared with advertising partners.
• Not age-check providers: where Kindroid, Janitor AI, Nastia AI and SpicyChat use outside age assurance, the app receives only a pass or fail; the provider never needs your chats.
• Authorities and buyers: most policies allow disclosure to courts or police on legal request and transfer to a buyer if the company is sold, which is now a live issue for Character.AI in its Chapter 11 sale.

Character.AI makes one useful promise for creators' audiences: the people who create public Characters cannot see users' chats with them.

How to Keep Your Messages More Private

• Write as if a moderator could read any message, because at most apps one can if it gets flagged.
• Leave out names, addresses, employers and anything that identifies other real people.
• Know that reporting a problem or appealing a lock can open the relevant chat to review (DreamGF, Kindroid).
• Prefer apps that document limits on staff access and encryption at rest; our private AI chat apps list ranks them.
• For chats no company can read, run a model on your own computer; see local vs cloud AI companions.

Read our Kindroid review for the most detailed staff-access policy in this group, and how long apps store your chats for retention.