Are AI girlfriend apps anonymous? What they know about you, and how to limit it

What an AI girlfriend app knows about you

• Your account: an email address, or a Google, Apple, Discord or X login.
• Your device and connection: IP address, rough location, device type and usage data, like most websites.
• Everything you type and generate: messages, character descriptions, picture prompts and, in apps with calls, voice.
• Your payment: through the card processor, app store or crypto gateway.
• Age check results, where the law requires a check. Candy AI's privacy notice says it stores the results of third-party age estimation or ID checks where required.
• Ad and analytics data. Roger's privacy policy, for example, names the Meta Pixel, TikTok and other trackers, and says sign-ups and purchases are sent to Meta with a hashed email when you accept cookies.

Mozilla's review of 11 romantic chatbots found an average of 2,663 trackers per minute of use, pushed up by one app that fired 24,354 in a single minute.

Signing up: email, Google or Apple

Sign-up options, from each app's own pages:

The simplest step is a separate email address used only for apps like these. Our list of AI girlfriend apps with no sign-up covers the apps you can try before creating an account.

Paying: what shows on your bank statement

Most apps bill under a company name rather than the app's name, according to their own pages:

• Candy AI: shows as "EverAI".
• Secrets AI: shows as "S LABS INC".
• Roger: shows as "Life AI Technologies LLC", and its upgrade page promises no adult transaction on your statement.
• Lovescape: says payments appear with neutral descriptions.
• Swipey AI: says charges appear under a neutral company name, never "Swipey AI", and purchase emails are neutral too.

Crypto hides the most. Candy AI, Secrets AI, OurDream, Lovescape and Swipey AI accept it; Secrets AI takes 300 or more coins through NOWPayments with a $20 minimum. Paying through the App Store or Google Play shows Apple or Google on your statement instead. Our pages on discreet billing and AI girlfriend apps that take crypto compare the options.

Age checks can mean ID or a face scan

Age checks are the biggest new threat to anonymity. Since 25 July 2025, UK law has required highly effective age checks for services that allow pornographic content, and apps have added them:

• OurDream sends UK and Australian users to Go.cam or AgeVerif for a face age estimate, a selfie, ID or a card check, and says it receives only a pass or fail result.
• Roger asks UK visitors to verify with Yoti or continue without adult content.
• Swipey AI uses Ondato for UK users: a selfie estimate first, with ID if needed.

Elsewhere most apps still rely on a self-declared age. If a check is required, choose a method where the app gets only a pass or fail. Our guide to AI girlfriend age verification explains each method.

Who can read your chats

Even where an app advertises end-to-end encryption, the AI model has to read your messages to reply, so the company's systems see them. Secrets AI, for example, states AES-256 encryption for stored data and claims end-to-end encryption on its homepage. What other apps' own policies say:

• Candy AI: chats are "generally confidential" but scanned by automated moderation, with manual review of flagged content, and third-party AI providers may receive message content.
• Nomi AI: its wiki says end-to-end encryption is not practical for an AI chatbot.
• OurDream: its homepage claims end-to-end encryption, while its privacy summary says third-party AI model providers process each message.
• Anima: shares your name, gender and conversations with AI providers such as OpenAI to generate replies.

Our guide to whether AI girlfriend apps read your chats goes app by app.

Breaches and leaks

The risk is not theoretical. In September 2024 the AI girlfriend site Muah.AI was breached, and Have I Been Pwned lists 1.9 million email addresses exposed along with users' prompts. Anyone who signed up with a work or personal email could be linked to what they wrote.

Security across the category is weak. Mozilla found 73% of the romantic chatbots it reviewed published nothing on how they handle security vulnerabilities, and 45% allowed weak passwords such as "1". Our guide to AI girlfriend data breaches tracks the known incidents.

How to use an AI girlfriend app as privately as possible

1. Sign up with a separate email address, or Apple's Hide My Email where supported.
2. Use a nickname, and keep your full name, address, employer and photos out of the chat.
3. Pay with crypto or through an app store if you do not want a company name on your statement.
4. Decline marketing cookies at sign-up.
5. Use a strong, unique password.
6. Delete your account when you stop, not just the app. Retention varies a lot: Secrets AI says it deletes chat history immediately, Nomi deletes all data after a short delay, Candy AI keeps account data up to three years after your last activity unless you ask, and Swipey AI keeps personal information for 6 years after you close the account. Our guide on deleting an AI girlfriend account covers each app.