All articles · Privacy
Who can read your AI companion chats?
You are about to tell an app something you have not told anyone. The reasonable question is who else can see it, and most privacy pages answer that in four thousand words of nothing. Here is the short version, including the parts that are uncomfortable.
Who can technically read my messages to an AI companion?
Three parties, in almost every app in this category.
The app operator, because the messages sit in their database. The model provider, because the text is sent to them to generate a reply. And anyone the operator is legally compelled to hand data to. Almost no companion app is end to end encrypted, and any that claims to be while also having a model generate replies is describing something that cannot work: the model has to see the text.
Does the model provider train on my conversations?
Usually not, when the app uses a business API, but you should check rather than assume.
The major model providers offer business tiers where submitted data is not used for training, and serious apps use those. Consumer chat products are a different matter. The thing to look for in a privacy policy is a plain sentence saying conversations are not used to train models, naming who the provider is.
What questions should I ask before typing something personal?
Four, and you can usually answer them in ten minutes.
- Where is the data stored, in which country, and does the policy actually name it?
- Is there a real delete function that removes conversations, or only an account deactivation?
- Does the policy say plainly that conversations are not used to train models?
- Is there a data export, and does it work? An app that can export can usually also delete.
What X-Friend does, including the uncomfortable part
Data is stored in Europe, in London, on eu-west-2. Messages go to the model provider under a business agreement that excludes training. Deleting your account removes your conversations and characters.
The uncomfortable part, stated plainly: your messages are not end to end encrypted, and they cannot be, because a model has to read them to answer. We can technically access the database. So can every other app in this category, and any of them telling you otherwise is either confused or lying.
London is in Europe but outside the EU, under a UK data protection regime the EU currently treats as adequate. If EU only storage is a hard requirement for you, that is a real distinction and worth knowing before you decide.
What about the app store, my phone and my partner?
This is the risk people actually run into, and it has nothing to do with servers.
Purchases show up on a card statement and in the app store account, notifications appear on a lock screen, and the app icon is on a home screen. If discretion matters, those three are worth more attention than the hosting question, and every one of them is under your control.
Questions people ask
Are AI companion chats private?
They are private from other users but not from the app operator or the model provider, both of which can technically see the text. No companion app can be end to end encrypted while a model generates the replies, because the model has to read the message.
Do AI companion apps train on your conversations?
Serious apps use business tier model APIs where submitted data is excluded from training, but this varies. Look for a plain sentence in the privacy policy stating that conversations are not used for training, and naming the provider.
Where does X-Friend store its data?
In Europe, in London, on the eu-west-2 region. That is inside Europe but outside the EU, under a UK data protection regime the EU currently treats as adequate.
Sources
- Hosting region verified directly from the project configuration, September 2026.
- Training exclusions depend on the model provider's business terms and can change; check the current policy.