"Safe" is doing a lot of work in that question. People asking it usually mean four different things at once: will someone find out, is my data being sold, are my conversations stored somewhere, and could this turn up in a breach. Those have different answers, and the answers depend far less on which app you pick than on where the conversation physically runs.
That is the first useful split. Everything else follows from it.
Start with where your words actually go
Every product in this category sits in one of three structures, and the structure decides most of the risk before any policy document is read:
On your own machine. SillyTavern (open source, AGPL-3.0) with a local model keeps the conversation on your hardware — nothing leaves the device unless you connect a hosted API. Same story for anything built around Ollama or LM Studio. The privacy guarantee here is architectural rather than a promise: there is no server to leak. The cost is competence — you install it, you run the model, you own the failure modes.
On the vendor's servers, paid. Replika, Nomi, Kindroid: a flat subscription, your history stored server-side so the companion can remember you, which is the entire product. The honest framing is that memory and server-side storage are the same feature seen from two ends. You cannot have one without the other in a consumer app.
On the vendor's servers, free. Free tiers (Pi, Character.AI, and most of the 145 free tiers we track) move the cost somewhere other than money. Sometimes that is a genuinely funded product, sometimes it is a paywall behind the parts you actually want, and sometimes it is a fine-print clause about improving models with your conversations. It is not automatically worse — but it is the structure where you should read the terms rather than assume.
Nothing in this comparison is a claim that a specific vendor does or does not sell data. We record what each product states about content policy and the verification date on its listing, and we do not publish accusations we cannot support.
The risks, ranked by what actually happens
1. Data retained for model training — the most common, least discussed. Almost every consumer AI product has this switch somewhere in settings. It is usually on by default for free tiers and off (or unavailable) on paid ones. This is not a leak; it is a policy choice that determines whether your 2 a.m. messages become training data. Find the setting. If there is no setting, that is your answer about the product.
2. Payment records that identify you. An adult-oriented subscription shows up on a card statement with a merchant descriptor, and a chargeback dispute or shared household account surfaces it. This is the risk most people underestimate and the easiest to mitigate, below.
3. Breaches and third-party exposure. Any product with a login has a breach risk, and the exposure multiplies with third-party SDKs — analytics, crash reporting, payment processors. You cannot audit this as a user. What you can check is whether the product supports deleting your account and exporting your data, which is both a legal right in many jurisdictions and a decent proxy for whether the company has thought about this at all. We wrote about what that right looks like in practice in the right to delete.
4. Being seen using it. Almost always about the device, not the vendor: a shared browser, an unlocked phone, a notification on a lock screen. Product-side mitigations are thin.
5. Scams wearing a familiar name. Clone apps and fake listings that take a payment and deliver nothing. The check is boring and effective — the name in the app store should match the domain in the site's own footer, and a product that cannot be found anywhere except one ad should be treated as nonexistent.
A privacy checklist that takes ten minutes
- Open the privacy policy and search three words: train, retain, delete. If the policy does not say how long conversations are kept, assume indefinitely.
- Find the model-improvement toggle in settings and turn it off. If the product has no such control, treat your conversations as training data.
- Use a separate email for companion apps — not the one attached to your real name, your work, or your password manager's primary account.
- Pay with a virtual or single-use card where your bank offers one. This solves the descriptor problem and the cancellation problem at once.
- Check for an account-deletion path before you create the account. GDPR and CCPA-style rights apply in many markets; a product that hides deletion is telling you something.
- Do not type identifying details — real full name, address, employer, the names of people you know. This costs you nothing in conversation quality, and it is the one measure that survives every failure mode above.
- Prefer local where you can tolerate the setup. If the words matter, the self-hosted shortlist is the only arrangement with no vendor in the loop.
What "safe" should mean when you evaluate a product
The useful question is not "is this app safe" but "what does this app do with the two things I cannot take back" — the history and the payment. A product that lets you export your history, delete your account without an email thread, and pay in a way that does not label you, has answered the question as well as any consumer app can. A product that offers none of those has not, regardless of what its policy says.
For the rest — the wellbeing angle, the crisis resources, the question of whether leaning on a companion is good for you — those are real but different questions. Our listing entries record content policy and platform coverage per product; the privacy structure is the field we would most like every vendor to state plainly, and the one they state least.
Disclosure: the team that runs this directory also builds SoulChat, an AI companion product. It is listed in the directory on the same terms as every other entry, is not a paid placement, and is not recommended in this article.
How this was checked. Structural facts (self-hosted vs server-side, free tier vs paid, content policy) were verified against each vendor's own product and pricing pages between 2026-09-14 and 2026-09-30 and recorded with verification dates on the corresponding listing entries. This article makes no claim about any specific vendor's data-sale practices; where a vendor's policy is ambiguous, we say so rather than infer.