Most of the worry about companion apps goes to the conversation. Images deserve at least as much of it. They are easier to copy, they hang around longer, and they fall outside most of what a privacy policy spells out.
How a picture is stored and served
When the app finishes a picture, it writes the file into object storage and sends it to you through a content delivery network, the same plumbing any website uses for photos. The gallery screen is only an index of those files.
What counts is the protection on each file, and there are two styles.
Signed or authenticated addresses. Either the address stops working after a while, or the server confirms it is really you before it sends the file. Paste the address into another browser and you get an error.
Long, unguessable addresses. The file sits at a web address that nobody could realistically stumble on, yet anyone who does have it can view the image, logged in or otherwise, for as long as the file exists.
Developers favour the second style because it costs little and is fast. It is defensible, because guessing the address really is impractical. But the image is then guarded by the link staying secret, and no access check is involved. If the link is forwarded, dropped into a chat, or recorded by a browser extension, it works as a public link.
Try this: open a generated image in its own tab, copy the address from the bar, and paste it into a private browsing window. If the image appears, nothing but obscurity protects it. Better to learn that before creating anything you would not want connected to your name.
The trouble with deleting them
Chats and pictures are normally kept in separate systems. Deletion code written for the chat database may never reach the object store, and the delivery network can go on serving cached copies for a while after the original has been removed.
Malice is seldom the explanation. Deletion was simply built for the main database, and the pictures live elsewhere.
So when you shut an account, put the question plainly: are my generated images included, and how long before they disappear from storage and from cache? Deleting an AI companion account walks through the order of steps. For Canadian readers, PIPEDA gives you a right to see the personal information an organization holds about you, and a complaint that goes unresolved can be taken to the Office of the Privacy Commissioner of Canada.
Flagged images stay on file
Generated pictures pass through screening, done by software and sometimes by staff. Content that gets flagged is usually held for longer than ordinary material, and it is frequently excluded from deletion because holding it is how the operator demonstrates that it enforced its rules.
Policies generally say so, and it is routine. The consequence is that a picture that set off a filter is the one most likely to outlive your account.
Two rules with no exceptions
Never upload a photo of a real person. That rules out a partner, a public figure and a stranger from a dating app. Serious operators forbid it, and it is the quickest way to a permanent, non-appealable ban. More and more jurisdictions also criminalize producing intimate imagery of an identifiable person who has not consented. In Canada, section 162.1 of the Criminal Code makes publishing or sharing an intimate image without consent an offence, and the definition extends to realistic AI-generated or manipulated images.
Here the technical argument and the ethical one agree. The person in that photo has not agreed to be part of your chat history, and that history is stored.
Expect the prompt to be kept with the picture. The wording you used to request an image is ordinarily saved beside it, and it tells a reader much more about you than the picture does. People are careful with images and loose with prompts.
Keeping what you want
Save the pictures that matter to you and regard the gallery as a temporary shelf. Apps restructure their storage, alter plans, remove media from dormant accounts and, occasionally, misplace things.
Then decide where the copies will live. A photo library that syncs into a shared family account, or that uploads on its own to a communal cloud drive, has merely shifted the exposure to a new place.
Bringing this into your choice of app
Two checks belong in a free-tier trial, next to the consistency and latency tests:
- Do image addresses require authentication? Use the private-window test described above.
- Is there a bulk download, or an export that includes media?
The apps that put the most effort into media, for example Candy AI, which bundles images and voice into one subscription, and Secret Desires, which offers image and short video generation, are the ones where your file count will climb fastest. The private-window test is therefore worth even more there.
