Replika
- The policy allows AI training; it does not describe an opt-out.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
Chats train their safety models, ads partners get site data, you grant a license.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
- Uses your content for AI training with no opt-out
- Fined by a regulator for data practices in the last 24 months · Italian data protection authority (Garante) fined Luka Inc. EUR 5M over Replika's legal basis and age verification (2025)
Collected
Account info, chats, photos, voice, device IDs, usage, and sometimes ad-partner tracking on the website.
Read the exact line
Privacy policy
“This includes the messages you send and receive through the Apps, such as facts you may provide about you or your life, and any photos, videos, and voice and text messages you provide.”
Training
Your companion learns from chats, and they use bits of messages to train their own safety systems.
Read the exact line
Privacy policy
“This includes collecting and immediately anonymizing user feedback, and small portions of Messages and Content data to train our proprietary safety algorithms, enhance chatbot performance, prevent inappropriate outputs, and ensure compliance with safety standards.”
Sharing
Third-party AI companies get chats to generate replies; ad partners get website visit data, not your conversations.
Read the exact line
Privacy policy
“Conversation data — subject to and data minimization measures — is transmitted to third-party AI language model providers solely to generate conversational responses within the app's core functionality.”
Kept
After you leave, chats may stay 60 days; account and payment records can be kept 10 years.
Read the exact line
Privacy policy
“we process account information and financial records (your payments, transactions, and rewards data) and personal data we collect automatically from you for a minimum period of 10 years after termination of the contract due to legal retention requirements.”
Controls
You can delete your account in settings, ask them to delete data, and opt out of ads cookies.
Read the exact line
Privacy policy
“You can delete your account in your account settings.”
Fine print
You give a forever license to your content, and subscriptions auto-renew with no refunds.
Read the exact line
Terms of service
“By uploading any User Content you hereby grant and will grant Replika and its affiliated companies a nonexclusive, worldwide, , fully paid up, transferable, , , license”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Delete your account in the app
Account settings (privacy policy Section 7.D); Terms 3.1 also say delete in the app
Opt out of ad sharing and cookies
Cookie Policy at https://replika.com/legal/cookies
Unsubscribe from marketing emails
Unsubscribe link in emails, or contact my@replika.com
Cancel a paid plan in the app store
Apple Manage App Subscriptions or Google Play Subscriptions, before renewal
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They get a forever right to copy and use what you upload, including for ads, even after you leave.
Read the exact line
Terms of service
“By uploading any User Content you hereby grant and will grant Replika and its affiliated companies a nonexclusive, worldwide, , fully paid up, transferable, , , license to copy, display, upload, perform, distribute, store, modify and otherwise use your User Content in connection with the operation of the Services or the promotion, advertising or marketing thereof”
For example, a photo you sent your Replika could be used in their marketing under this license.
They can shut your account and throw away your chats for any reason.
Read the exact line
Terms of service
“You agree that Replika, in its sole discretion, may suspend or terminate your account (or any part thereof) or use of the Service and remove and discard any content within the Service, for any reason”
For example, they could delete years of companion history without warning.
If someone sues them because of how you used the app, you may have to pay their legal bills.
Read the exact line
Terms of service
“You agree to release, and hold Replika and its affiliates and their officers, employees, directors and agents (collectively, “Indemnitees”) harmless from any from any and all losses, damages, expenses, including reasonable attorneys’ fees”
For example, if a chat you uploaded caused a legal claim, you could be asked to cover their lawyers.
Parts of your chats can be used to train their own safety systems, with no opt-out described.
Read the exact line
Privacy policy
“This includes collecting and immediately anonymizing user feedback, and small portions of Messages and Content data to train our proprietary safety algorithms, enhance chatbot performance, prevent inappropriate outputs, and ensure compliance with safety standards.”
For example, a private message you typed could be and used to teach their filters.
Even after you quit, some records about you can sit around for a decade.
Read the exact line
Privacy policy
“we process account information and financial records (your payments, transactions, and rewards data) and personal data we collect automatically from you for a minimum period of 10 years after termination of the contract due to legal retention requirements.”
For example, deleting the app would not wipe purchase history for at least 10 years.
Paid plans keep charging until you cancel in the app store, and they generally do not refund unused time.
Read the exact line
Terms of service
“The renewal subscription fees will continue to be billed to the Payment Method you provided through the marketplace, automatically until canceled.”
For example, if you forget to cancel Pro, next month’s fee still hits your card.
Website tracking shared with ad companies can count as selling or sharing your data.
Read the exact line
Privacy policy
“Our disclosure of information to these partners may be considered a "sale" or "sharing" of personal information or "targeted advertising" under applicable laws.”
For example, visiting replika.com could help partners show you Replika ads elsewhere.
Outside AI vendors that write replies are told not to train on your chats.
Read the exact line
Privacy policy
“These providers are contractually required to: process your data only in accordance with our agreements and solely for the purpose of providing the AI language model service to us; not use your data for training their own AI models or for any other purpose;”
For example, a third-party model that answers your Replika should not keep your chat to improve itself.
AR face tracking stays on your phone and is not stored or sent out.
Read the exact line
Privacy policy
“Face and head movement data, including all data collected via the TrueDepth API, is processed in real time on your device and immediately discarded: it never leaves the user's device”
For example, a selfie filter would not upload a face template to their servers.
They say they will not use what you tell your companion to target ads.
Read the exact line
Privacy policy
“We will never use or disclose the content of your Replika conversations for marketing or advertising purposes.”
For example, saying you feel lonely in chat should not be used to sell you ads.
Words to know
Legal words from the lines above, in plain English.
- inputs and outputs
- Inputs are what you type, say or upload to an AI; outputs are what it gives back to you. For example, the question you ask a chatbot is an input and its answer is an output, and both may be stored.
- de-identified
- Data with your name and obvious identifiers removed, though it can sometimes still be traced back to you. For example, your chats with names stripped out may still be kept and studied after you delete your account.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- royalty-free
- The company can use your content without ever paying you for it. For example, your photo can appear in the app's ads and you get nothing.
- sublicensable
- The company can pass its rights over your content on to other companies without asking you. For example, an app can let an advertiser or a partner reuse your video under the licence you gave.
- perpetual
- Lasting forever, with no end date. For example, a perpetual licence means the company can keep using your video years after you leave.
- irrevocable
- Cannot be taken back or cancelled once given, even if you change your mind or delete your account. For example, an irrevocable licence to your photos means you cannot withdraw it later.
- worldwide license
- You let the company use your content anywhere on earth, usually for free and for as long as it likes. For example, a video you post can be shown in ads in any country without asking you again.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
How we got here · grade F · score 29/100 · 15 of 15 policy answers backed by a verified quote · 1 not stated
What does the app collect beyond what it needs to work?
They collect account and profile details, your messages and media, plus device, network, cookie, and usage data. Location is described as city or area, not precise GPS.
Does it record your voice, face or body, and what happens to that?
Voice messages you send are kept as content. Face and head motion for AR is processed on the device and discarded, and they say it is not stored as a biometric template.
Are your chats and uploads used to train AI models, and is that off by default?
They use small portions of messages to train their own safety algorithms, with no opt-out described. Third-party language models are contractually barred from training on your data.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They share website visit data with advertising partners for interest-based ads. They say they never share Replika conversation content for ads.
Do they sell or share your data, and can you opt out?
Sharing with ad partners may count as a sale or sharing under some laws, and they point you to the Cookie Policy to opt out.
What rights do they take over what you type and what the AI makes?
You grant a perpetual, irrevocable, sublicensable license to use your uploads for running the service and for promotion and marketing.
How long do they keep your data after you delete it, and can you delete it in the app?
You can delete your account in settings, but messages may be kept 60 days after the contract ends and account or payment data at least 10 years.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They learn interests and preferences over time to personalize chats, and paid plans mention saving messages to memory, but viewing or turning memory off is not described.
Do they commit to basic security, and have they leaked data?
They describe SSL in transit, secure servers, firewalls, and role-based access. No independent audit or bug-bounty program is described.
Is there a real age gate, and are teens protected?
The service is for people 18 and older. They say they will block and delete under-18 accounts if they find them, but no strong age-check method is described.
Will they tell you when the rules change, and is the policy specific?
The privacy policy is dated and lists data types, purposes, and retention. They say they will notify you in advance of changes.
Can they close your account without warning, and can you get your data out first?
They may suspend or terminate for any reason without prior notice and delete your account and files.
If something goes wrong, who pays?
The service is as-is, liability is capped at six months of fees or $100, and you must indemnify them for claims related to your use.
Do subscriptions renew on their own, and can you get a refund?
Paid plans auto-renew until you cancel in the app store. They say sales are generally final and partial periods are not refunded. Prices may change without prior notice.
The privacy policy is 4,574 words at a college graduate level (Flesch reading ease 35.9); the terms are 7,708 words at a college graduate level.
