Are AI Girlfriend Apps Safe? What a Security Audit of 17 Apps Found in 150M Users’ Chats

So here’s the thing that stopped me mid-scroll: every major U.S. AI developer trains on your chats by default. And I don’t mean just the scrappy companion apps with anime avatars. I mean OpenAI, Google, Meta, Microsoft, Anthropic, and Amazon. Default-on, opt-out-if-you-can-find-the-toggle. That sent me down a rabbit hole, and the two pieces of evidence I pulled up on the way down are worth sharing: a security audit by the firm Oversecured of 17 AI companion apps on Google Play, and a Stanford HAI study that read 28 privacy documents from the six biggest chatbot developers so you don’t have to. What follows is the teardown I wish existed before I’d ever typed anything personal into one of these apps: what gets collected, where conversations actually end up, and what to check before you trust an install screen.

The short answer: are AI girlfriend apps safe?

No, AI girlfriend apps generally aren’t safe on the privacy and data-security front. That’s not a vibe, it’s a count: security firm Oversecured audited 17 AI companion apps on Google Play, services used by more than 150 million people combined, and found 14 critical and 311 high-severity vulnerabilities. In 10 of the 17 apps, attackers could reach stored conversations. Six had critical vulnerabilities that allowed direct access to chat data. And these weren’t edge cases discovered in some long-shipped legacy build; the vulnerabilities were unpatched at the time the findings were published.

Here’s what makes that number land differently than a typical “app has a bug” headline: people confess to these apps. Personal confessions, relationship details, sexual content, stuff people don’t tell their best friends. Sergey Toshin, the security researcher behind the audit, compared the data sensitivity to therapy apps. So the attack surface isn’t just “someone reads your meme requests.” It’s someone reads your diary and you didn’t know you were keeping one.

The harm isn’t hypothetical either, and I want to frame this carefully as reported context rather than cause-and-effect claims: some of the audited apps have faced lawsuits over harm to minors, privacy fines, and a case where chatbot interactions were linked to a user’s death. Before the audit, earlier misconfigured servers and cloud databases in this space had already exposed tens of millions of messages and user photos. Classic cloud-misconfig story, the kind any dev has seen in a postmortem. Except this time the payload was intimate conversations at scale.

Now, the honest nuance, because “not safe” isn’t the whole verdict: safety varies app by app, and the risk can be reduced, not eliminated. Some developers take security seriously. Some at least offer training opt-outs and clearer retention terms. The problem is that nothing in the install flow tells you which kind you’re getting, and the defaults, default-on training, default retention, opt-outs buried in settings, are the trap across this whole category. That’s the spine of everything below.

What data AI girlfriend apps collect

AI girlfriend apps collect your chats, photos, and voice messages, cache them on your device alongside authentication data, and store copies on remote servers tied to your account. Two copies, two risk surfaces. Your phone is holding more than you think: check the app’s local storage sometime and it’s not just the conversation text, it’s cached media and login tokens sitting there too.

Your phone is holding more than you think

The on-device cache is the part nobody thinks about. Chats, photos, voice messages, and authentication data all live locally, which means any app bug that exposes internal storage exposes all of it. More on exactly that in the hacking section, because the audit found precisely that failure mode.

Why “we don’t sell your data” misses the real mechanism

The bigger issue isn’t selling, it’s inference. Stanford’s Jennifer King, a privacy and data policy fellow at Stanford HAI, has a scenario that explains the cascade: ask a chatbot for a low-sugar recipe and you can get classified as health-vulnerable, which can cascade into medication ads and potentially reach insurers. One innocent prompt, ecosystem-wide ripple. It’s a described possibility, not a documented incident, but the mechanism is straightforward.

And at multiproduct companies like Google, Meta, Microsoft, and Amazon, chatbot interactions can merge with your search queries, purchases, and social media engagement. Not a conspiracy, just data gravity: when one company owns your chatbot, your search history, and your shopping cart, the merge is trivial.

As a proxy for the collection list itself, ChatGPT’s own disclosures cover account details, prompt content including uploaded files, and technical info like IP address, browser, device type, and general location (with fingerprinting when you’re logged in). That’s vendor-sourced and doesn’t necessarily describe every companion app, but it gives you the shape of what these systems collect.

Where your conversations actually go

Here’s the comparison nobody wants to be true: companion apps handle therapy-level data with weaker safeguards than people assume even mainstream chatbots have, and the mainstream ones aren’t much better. The Stanford HAI study (arXiv 2509.05382, lead author Jennifer King) found that all six major U.S. developers train on chat data by default:

• Amazon (Nova)
• Anthropic (Claude)
• Google (Gemini)
• Meta (Meta AI)
• Microsoft (Copilot)
• OpenAI (ChatGPT)

Someone actually did the homework here: the researchers analyzed 28 documents (privacy policies, subpolicies, FAQs, chat-interface guidance) using a CCPA-based framework, which works as the measuring stick because all six have to comply with it. The findings: some developers keep chats indefinitely. Some, but not all, claim to de-identify personal information before training, and the “claim” and the “not all” both matter, so trust but verify. Some allow human review of transcripts.

Defaults can silently worsen

Anthropic quietly changed its terms of service so that Claude conversation training became the default unless users opt out. Fine print changed while you weren’t looking. No need to speculate about motives; the operational lesson is that a privacy setting you checked once is not a privacy setting you checked.

King’s answer when asked whether these chatbots pose a privacy risk: absolutely yes. And the genuinely surprising part? Hundreds of millions of users, and almost no privacy research on chatbots. An oddly understudied corner of tech.

The takeaway for companion-app users specifically: deleting a chat in the app says nothing about what the underlying model provider has already ingested. In practice, most people assume deleting a chat deletes the data, and a recurring friction point is discovering months later that opt-out settings existed all along.

Can someone hack an AI girlfriend app and read your chats?

Yes, and it’s demonstrated, not theoretical. Toshin’s framing: companion apps handle data at the level of therapy apps, personal confessions, relationship details, sexual content, and they grew so fast that basic security was never part of the process. The audit found the pattern repeated across install bases, not in one bad app, including among the most usable free AI girlfriend apps, where paywalled demos and message caps often mask what’s actually free. One class per bullet:

• Hardcoded credentials, 10M+ installs. An app embedded its OpenAI token and a Google Cloud private key (tied to the developer’s invoicing system) right in the APK. Extractable with basic reverse engineering and standard tooling, not elite hacking. One careless build, and you’ve handed over both the AI backend and the billing infrastructure. How did this ship?
• XSS in the chat interface, 10M+ downloads. Code injection that could read on-screen messages, steal session tokens, and insert fake messages. The chat window being the attack surface is grimly poetic.
• File theft in an adult-content app. Any file in internal storage could be pulled: local chat databases, cached media, login tokens. Stated plainly, no judgment about the app category.
• Ad SDK weakness, 50M+ installs. A malicious ad could launch internal components and query database tables containing conversations. Third-party SDKs as supply-chain attack surface, the familiar dev lesson.
• Component launch plus hardcoded token, another 10M+ app. The combo exposed authentication and session functions and could redirect users to attacker-controlled servers.

Remember the earlier misconfigured-server exposures, tens of millions of messages and photos? This audit shows the front door has problems too. I’m not going to walk through any exploit, and the audit doesn’t name the apps; the point is the repetition.

Red flag: Hardcoded API keys and private keys shipped inside an app package mean anyone with standard tooling can reach both the AI backend and the billing infrastructure.

Red flags to check before signing up

Five things to check before you sign up: does the developer name its LLM provider and data-retention terms, does a training opt-out exist at all, is there any history of breaches, lawsuits, or fines, does the app request unnecessary permissions, and is there any security disclosure anywhere. Each one traces to a documented failure mode:

• Named LLM provider and retention terms? The Stanford study found privacy policies lacking essential information and written in convoluted legal language. The docs fail code review; if a developer can’t summarize theirs, that’s the answer.
• A training opt-out at all? Remember that opt-out availability varied across all six major developers.
• Incident history? Lawsuits, fines, and prior server exposures already exist in this space.
• Unnecessary permissions? A companion app asking for more than it needs is telling.
• Security disclosure, anywhere? Anything, a responsible disclosure email, a security page, anything.

Here’s the composite failure mode to avoid, because it’s common: people check star ratings and feature lists but never check update history or security posture. A changelog full of character and persona updates with zero security notes is the tell, and it tracks with the audit finding that vulnerabilities were unpatched at the time of the findings. This checklist also doubles as the framework for evaluating any named platform, which is exactly how the later section on Janitor AI works.

If you delete a chat, is it really gone?

Deletion is a UI event, not a data event. The retention ladder, using ChatGPT’s stated policies as the worked example:

• Chat history on: conversations stored indefinitely.
• History off or temporary chat: data retained up to 30 days for moderation, abuse prevention, legal compliance, and auditing.
• Deleted chats: remain available to trainers up to 30 days.
• Personal Data Removal Requests: don’t guarantee complete removal.
• Full account deletion: the only thing that removes everything, and it’s permanent.

These are self-described policies, not verified behavior, but here’s what each bot says about itself: Claude saves conversations until deleted, and data from users who opted in to training can be retained up to five years. Note that’s the opted-in training data, not everything. Gemini saves chats to your Google account, where you can view, delete, or switch them off in settings, the most user-controllable of the three. All three may retain flagged chats longer for legal purposes. So “off” isn’t fully off, and “deleted” is queued.

Already shared personal info? Opt out via settings, file a removal request through OpenAI’s Privacy Portal (verification and a form, honest friction), consider full account deletion if you want the nuclear-and-permanent option, and change any passwords or credentials you typed into a chat. That last one takes thirty seconds.

Can developers read your private chats?

Yes, by design. “Encrypted” in chatbot marketing means HTTPS/TLS in transit only. There’s no end-to-end encryption like WhatsApp or Signal, and the architecture explains the policy: the platform must read server-side data to review and train on it, so E2E would break the product. OpenAI engineers and moderators may review select conversations, with “select” doing real work in that sentence, not every chat gets a human.

And even the big ones have receipts. A March 2023 caching bug briefly exposed other users’ chat titles and billing info, chat titles and billing, not full conversations, but still. Separately, Group-IB reported in March 2024 finding over 100,000 ChatGPT credentials on dark web forums between June 2022 and May 2023. The attribution matters: that came from malware and reused logins, not a platform breach.

Emotional dependency and documented harm

Yes, emotional dependency is a real risk, and it’s also a data-accumulation mechanism. The usage-drift pattern is the point: conversations start casual and drift toward personal confessions, relationship details, mental health, sexual content, exactly the sensitivity Toshin compared to therapy apps. The more attached a user becomes, the more therapy-level data accumulates in an app category with a documented track record.

On that record, framed as reported context: some audited apps have faced lawsuits over harm to minors, privacy fines, and a case where chatbot interactions were linked to a user’s death. I’m keeping that sober and non-causal on purpose; no app names, no speculation about what caused what. Watchdog context rounds it out: Common Sense Media rated ChatGPT 48% for privacy and flagged it as not well-suited for minors.

Is anyone regulating these apps?

Legally, AI girlfriends are permitted in most jurisdictions; the risk is data liability and harm, not the product itself, but nobody currently forces these apps to secure chat data. The classification failure is the story: companion apps collect therapy-like disclosures but aren’t treated as healthcare products, and existing rules focus on child safety, suicide prevention, and bot transparency rather than stored-conversation security. Falling between the regulatory cracks means chat logs become long-term archives of intensely personal exchanges, a diary you didn’t know you were keeping on someone else’s server. U.S. protections are a state-by-state patchwork with no federal floor; the config file is a mess.

Enforcement has teeth against the underlying platforms, though: the Italian Data Protection Authority fined OpenAI €15 million in 2024 for GDPR violations, citing lack of age verification, inadequate transparency, and no legal basis for collection. ToS;DR gives OpenAI a D rating for vague consent and default training use. To be clear, regulators haven’t specifically acted against AI girlfriend apps.

Stanford’s three recommendations, short version: comprehensive federal privacy regulation, affirmative opt-in for training (make the good setting the default), and default filtering of personal info from chat inputs. King’s closing thought is the right scale: society has to weigh capability gains against privacy loss.

Children’s data and the consent gap

The part that should worry parents, stated plainly: most developers do not remove children’s input from data collection and model training. The three-company contrast shows the range. Google would train on teenagers’ data if they opt in. Anthropic bans under-18 users but requires no age verification, an honor-system gap. Microsoft collects data from under-18s but doesn’t use it for language models, which is partial credit, note the distinction.

The structural point underneath: children cannot legally consent to data collection, and even the strictest policy is unenforceable without verification. A minor’s intimate conversations can enter training pipelines no legal consent ever authorized.

Your chats are a legal record: subpoenas and discovery

Your chats aren’t just breach risk, they’re potentially discoverable legal evidence. OpenAI’s privacy policy permits turning over incriminating content to authorities, and ex-partners can subpoena chat records for use in court, which is honestly the most relatable threat in this whole piece. Data may also be shared with contractors, affiliates, and service providers under their own policies. That’s policy-permitted behavior, not a claim any specific app has complied with a subpoena, and it’s not legal advice.

Specific platforms: is Janitor AI safe? Are AI girlfriends legal?

No independent audit data exists for Janitor AI or NewGirl AI, so the audit framework, not a verdict, is the answer. I’m not going to assert that either platform has or lacks the vulnerabilities Oversecured found in the 17 audited apps; nobody has checked them the same way. What you can do is run the Section 6 checklist against any named platform: named LLM provider, disclosed retention terms, training opt-out, incident history, permission requests, security disclosure. That’s also the honest answer to “which app is the safest for privacy”: no per-app audit exists, so the checklist is the evaluation tool rather than a ranking.

Where the underlying developers are auditable, Stanford gives us something to work with. By developer:

One line on legality, since it’s the second half of the question: AI girlfriends are legal in most jurisdictions, and the legal risk lies in data liability and harm, not the product itself.

Tiered privacy is worth knowing even within a single product: ChatGPT’s Enterprise and Team plans don’t train on your data, with encrypted storage and admin-set retention, unlike the free and Pro defaults. Paying more can literally change whether your data trains a model. Framed plainly, not as an upsell.

And the advertiser question, because it’s a common fear and balance keeps this credible: OpenAI doesn’t sell personal data to advertisers. It also complies with GDPR and CCPA, publishes privacy policy updates, and runs a bug bounty program. The caveat: limited data still goes to service providers under guidelines, and “we don’t sell data” says nothing about the inference and ecosystem-merging mechanisms from earlier in the piece.

How to use AI companion apps more safely

If you’re going to use these apps, here’s how to keep the blast radius small.

What to never share

Names, addresses, financial details, passwords, company secrets, personal health or legal issues. Keep prompts generic and treat the chatbot like a public forum, that mental model is the gift. Redact personal info from files before uploading; small habit, big payoff. Use temporary chats for the sensitive stuff, with the honest caveat that even they’re retained up to 30 days.

Settings, tools, and what they actually buy

The copy-pasteable one: Settings > Data Controls > toggle off “Improve the model for everyone.” Throwaway accounts help. 2FA and strong unique passwords are the boring advice that actually works. And watch third-party plugins and integrations, which run their own privacy policies and may store or analyze your inputs independently. Your data has roommates.

Now the calibration, because “safer” has limits: a VPN masks your IP but does nothing about what you type. Deleting a chat leaves a 30-day trainer-access window. There’s no end-to-end encryption in this ecosystem. Full account deletion through the Privacy Portal is the only complete removal, and it’s permanent. That’s what safer buys, and that’s all it buys.

If you want the feature-and-pricing side of the category rather than the security side, our breakdown of the best AI girlfriend apps covers what’s actually worth using, and the plain-geek explainer of how AI girlfriend chatbots work covers the tech under the hood.

The insecurity here is measured, not speculative, and the risks are real but reducible, never eliminable. The deeper point is that even fully compliant, best-resourced developers train on chats by default, so the ecosystem problem outruns any single app choice. Run the checklist, flip the defaults, and stay aware of the 30-day windows.

Frequently Asked Questions