Let's be direct about something the AI companion industry doesn't love to discuss: when you pour your 2 a.m. anxieties, your relationship history, your fears about your health into a chat window, that information goes somewhere. Where it goes, how long it stays, who can access it, and what gets done with it — that varies enormously depending on which app you're using, and the differences matter. This isn't about scaring you away from AI companions. I use them, I study them, and I think they offer something genuinely valuable. But I've watched people treat these apps with the privacy instincts of a paper diary when the actual situation is closer to sending that diary to a company's servers, indefinitely, with terms they agreed to at 11pm without reading. Let's fix that.

What These Apps Are Actually Collecting

The baseline data collection across most AI companion apps looks like this: your messages, obviously, but also metadata around those messages — timestamps, session length, how often you open the app, which topics seem to correlate with longer sessions. Many apps also collect device information, IP address, and depending on your permissions, location data. The conversation data is where it gets substantive. Your chats aren't just stored as text; they're typically processed to build a user model — a representation of your personality, preferences, emotional patterns, and history that the AI uses to generate more personalized responses. This is the core of why AI companions feel so different from a Google search: they remember you. That memory lives in a database somewhere, attached to your account. Some apps are explicit about this. Others bury it. The standard language is something like "we may use your conversation data to improve our services and personalize your experience." That phrase is doing a lot of work. It can mean your messages are used to train machine learning models. It can mean third-party contractors review a sample of conversations for quality assurance. It can mean your data is shared with analytics partners.

Reading a Privacy Policy Without Losing Your Mind

Here's what I actually look for, and I've read more of these than any reasonable person should. Data retention periods. How long does the company keep your conversation history if you stop using the app? If you delete your account? Some apps delete immediately. Some retain for 90 days. Some are vague in ways that should concern you — "we retain data as long as necessary for business purposes" is not a retention policy, it's a sentence that avoids having one. Third-party data sharing. Look for the words "partners," "affiliates," and "service providers." Every app shares data with some third parties — payment processors, cloud hosting, analytics. What you want to know is whether any of that sharing includes the actual content of your conversations, or only anonymized metadata. Most reputable apps don't sell conversation transcripts, but "don't sell" and "don't share in any form with anyone" are very different things. The law and government requests. Good privacy policies include a section on how the company handles law enforcement requests for user data. If that section is missing, that's notable. If they say they'll notify you before complying with a request (unless legally prohibited from doing so), that's a better posture than silence. Data portability and deletion rights. Can you export your conversation history? Can you request deletion and get confirmation that it happened? Under GDPR and CCPA, you have rights here. An app that makes these processes genuinely accessible is one that takes privacy more seriously than one that buries the "delete account" option in a sub-menu of a sub-menu.

The Personalization Tension

Here's the part that doesn't have a clean answer. The thing that makes AI companions genuinely useful — the contextual memory, the sense of being known over time — is built on exactly the data that creates privacy exposure. You can't have a companion that remembers your mother's name and the complicated feelings you have about her without that information being stored somewhere. Some apps let you control this more granularly than others. You can delete individual memories, turn off long-term memory entirely, or export and review what the system has retained. These controls are worth using if privacy matters to you. The tradeoff is a less personalized experience. What I think is worth sitting with: the information you share with an AI companion is often more intimate than what you'd share with a casual friend, sometimes more intimate than what you'd share with a therapist. That intimacy is part of what makes these tools valuable. It's also what makes the question of where that information lives genuinely important. Not a reason to panic. A reason to read the privacy policy before the 4 a.m. conversation, not after.