Plenty of people tell a companion app what they have never said aloud. That is the service working as designed, and it is the reason to spend ten minutes on how that writing is handled before you send anything, not once it makes the news.
Start with one fact
These apps cannot offer end-to-end encryption. To answer you, the company's servers must be able to read what you wrote. If an app boasts of end-to-end encryption on your chats, it is either rebranding the standard encryption used in transit or describing a feature that does not cover the conversation.
There is no scandal in that; it is how the system works. It does mean the useful questions concern how long data is kept and who can see it, not cryptography.
Check 1: what else is gathered
Messages are the obvious part. Look also at:
- Your account record, including whether sign-up lets you use an email other than your main one.
- Billing history, the most telling trail you leave in this category. A merchant name on a statement has outed more people than any data breach.
- Device and usage details, such as the times you open the app and the length of each visit.
- Images it generated for you, which remain on its servers even if you never saved them.
Check 2: does it train a model
Scan the privacy policy for the words "train" and "improve our services", then see whether settings offer a matching switch.
Apps fall into one of three groups: none trains on what users write, some train but let you decline, and some train with no control you can see. Any group may be tolerable to you. Being unsure which one you are in is the real problem.
Check 3: how long it is kept, and what deletion removes
Privacy policies tend to blur two separate questions.
Retention covers how long material stays while you hold an account. Deletion covers what disappears when you request it. A company can wipe your chats while keeping pictures, invoices and backup copies far longer, which may be entirely lawful and still not what you pictured.
The details are in deleting an AI companion account.
Check 4: the rights you have in Canada
Federal private-sector privacy law, PIPEDA, gives you a general right to see the personal information a business holds about you. Ask in writing, sending the request to the privacy contact named in the policy. In general the company must respond within 30 days, which can be extended by up to 30 more if it tells you within the first 30. If it refuses or stalls, it must explain in writing that you can complain to the Office of the Privacy Commissioner of Canada. In Quebec, the private-sector privacy statute as amended by Law 25 also applies, and complaints go to the Commission d'accès à l'information. Our data request guide gives wording you can adapt.
Whether a company outside Canada is caught by these laws depends on its connection to Canada, so the first reply from an app is sometimes a dispute about that. Its own privacy policy usually states which laws it follows.
In practice, what counts is not whether the right exists but how you exercise it: a button inside the app, or a letter to a mailbox followed by waiting. The difference tells you how the firm sees its customers.
A quick, free precaution list
Sign up with an email address used for nothing else. Find out how the charge is labelled on your card statement before month two. Switch off training where the option exists. Then settle early on what stays out of a service that must keep it all: your workplace, your home address, and details about anyone who never agreed to be in your chat log.
Replika and Nomi are the two apps in our ranking likeliest to build up years of such material instead of weeks, because continuity is what they sell. On those two, the precautions above matter even more.
