Who can read what you type

One privacy policy in our catalogue prints the list. Get Harder names OpenAI, Fireworks.ai, Together.ai, Groq, Deepgram, 11Labs and Kling/Nano Banana, then cloud hosts, analytics platforms, advertising networks, Zendesk, SendGrid and Solidgate. Read it for what it is rather than as a scandal: it is the inventory of companies that can be handed something you typed, published by the company that hands it over.

It is the only inventory of its kind on the nineteen platforms we rank. The other eighteen do not contradict it — they describe the same shape of architecture in categories. “Service providers.” “Technology partners.” “Third-party LLM or hosting providers.” The machinery is disclosed; the names are not. This guide reads that machinery layer by layer and says, for each one, who is actually named and by whom.

A conversation is not an exchange between two parties

The interface is built to suggest otherwise. There is a name at the top, a typing indicator, a thread that looks like every other thread on your phone. Nothing in it hints that a sentence has to leave the building to come back answered.

But it does. A companion reply is generated by a model, the model runs on inference infrastructure, and on most of this market neither belongs to the company you bought from. Candy AI‘s notice says it in one line: third-party LLM or hosting providers may receive chatbot-message content. DONDI writes that technology partners may process content for model training and improvement, safety, quality assurance and service delivery. Those are not loopholes buried in a schedule. They are the description of how the product works.

Around that core sit layers with different appetites. A classifier that sees every message and keeps none of it in a way a person can read. A moderator who sees almost nothing, until something is flagged. A transcription service that turns speech into text. An analytics vendor that watches the interface rather than the words. A helpdesk that reads whatever you paste into a ticket. Each has its own answer to the question in the title, and the answers are not interchangeable.

Read from the privacy policies, terms, moderation and safety pages published by the nineteen platforms we rank, between 14 and 21 August 2026. A named company means that platform’s own documents name it; an empty name is not evidence that no such company exists, only that none is published. We did not audit any implementation, inspect network traffic or verify that a named provider is still in use. Vendors change without announcement and policies are revised without notice.

One platform of nineteen names the companies that write the replies

This is the finding that surprised us most, because it is the layer that matters most. Every other party on that list receives a by-product: a flag, a page view, a support ticket, a card number. The inference provider receives the sentence.

Get Harder is the exception, and it is worth being precise about what its list shows. Those are not obscure vendors. They are the infrastructure of the current AI industry, and the presence of Deepgram next to 11Labs tells you the voice path is built from parts too. The policy also sits next to a pricing page promising that payment is “100% anonymous”, which is its own problem — but the provider list is the most informative single document in our corpus.

GoLove is the instructive contrast. Its privacy policy names Google for analytics, advertising and search, so the document is clearly capable of naming a vendor when it wants to. It names no LLM, image or video provider anywhere. Our review records that disclosure as not established rather than absent: a service that generates replies is using something to generate them, and the policy simply does not say what.

The honest reading of the other eighteen is not that they are hiding a provider. It is that the category has settled on a drafting convention — name the analytics tool, describe the model provider — and nobody has had a reason to break it. The reason exists. A reader deciding whether to type something sensitive is entitled to know which companies will hold it, and one platform has demonstrated that publishing the list is possible.

The reader that never misses a message is a classifier

Seventeen of the nineteen document an automated layer that inspects content. It is the most consistent disclosure in the entire corpus, and it is routinely mistaken for the frightening one when it is the opposite.

Xtease states that all user-to-AI messages receive automated checks — every message, with no threshold. Promptchan‘s moderation policy says automated image and text systems scan prompts, outputs and uploads across image, video, chat and Explore. DarLink says text and voice messages, plus images sent during chats, can be stored and analysed with automated tools.

Two platforms go further and name the machinery. Joi AI‘s safety page describes RoBERTa classification of user and model messages, with compliance-officer scrutiny in difficult or suspicious situations. GoLove documents a proprietary LLM moderation filter. Note what that means on Joi: the only model this market names in connection with your messages is the one reading them, not the one writing them.

A classifier is not a person and a scan is not a reading. Nothing in these documents supports the idea that staff sit in front of conversations. But it does settle the question a homepage padlock is designed to leave open. Content that is scanned is content the operator can process, and an architecture that can flag a message is an architecture that can retrieve it.

Seventeen of nineteen document a human who can read flagged content

The same seventeen. OurDream AI and Secrets.ai are the two whose published documents, as we read them, describe neither an automated moderation layer nor a human review route. That silence is worth naming carefully: it is not a commitment that nobody reads flagged material. Both reserve broad processing rights elsewhere in the same documents. An absent clause protects nobody.

Among the seventeen, almost all describe the route in the same shape — automated detection, escalation on a flag, possible manual review, removal or termination. Three publish the part that actually matters, which is when the human arrives.

Moderation policies read between 14 and 21 August 2026. Lovescape and Xtease are operated by the same company, which is why their thresholds match — the two documents are close relatives, not independent confirmations. A published threshold describes a policy, not an audited practice: we did not trigger a violation, file an appeal or test enforcement on any platform.

Kindroid‘s version is the narrowest disclosure in the corpus, and the only one we can describe without a caveat. Chats are encrypted at rest and in transit so staff cannot view them in normal operation; automated scanning looks at recent relevant context with no human reader during detection; a two-day window can be decrypted by a trained employee, and it opens only if the user appeals. The same policy reserves the right to decrypt where legally or contractually necessary. That is a weaker promise than “nobody can read your chats”, written precisely, and it is more useful than the stronger version.

We covered the contradiction between homepage language and policy language in what the terms actually say, where twelve of the nineteen front pages turned out to conflict with a document their own company publishes. This is the layer underneath that finding: not who promises what, but what the architecture is described as doing.

Speaking creates a transcript even where the audio does not survive

Voice is sold as intimacy and priced as a premium, and it adds a step that text does not have. Speech has to become tokens before a model can answer it, which means a transcript exists — and the transcript and the recording have different lifespans.

Secrets.ai documents the split explicitly: calls are transcribed in real time, the call audio is deleted, and the text can be retained so the companion can remember. That is a defensible design and an unusually clear description of one. It is also the plainest available illustration of the point: deleting the recording is not deleting what was said.

Swipey AI says voice input can be transcribed and may be processed or recorded for moderation, quality assurance, safety, performance and legal compliance — quality assurance being the phrase to notice, because it is the one that historically covers a person listening. Joi AI says text and voice messages can be used to improve quality and develop the AI. DarLink puts voice messages and images in the same sentence as text for automated analysis.

Kindroid again documents the tightest version, and it contains the caveat most readers would miss. Microphone audio, output audio and video are described as processed ephemerally and not stored — yet a call can still influence memory when unified history is enabled. The audio is transient and the consequence of the audio is not. Something said out loud can come back in writing, weeks later, in a text conversation.

What memory does with the resulting text is a separate mechanism with its own guide: how AI companion memory works covers what these products actually retain between sessions, and how little of it anyone has proven across days.

The parties that never read a word

Four of the nineteen name an analytics or advertising vendor: DarLink names Google Analytics and Facebook Pixel, Promptchan names PostHog alongside Google tools, and GoLove and Swipey AI name Google analytics products. Several others describe trackers without naming one; on Dream Companion we observed multiple analytics and advertising trackers loading, and the Xtease site loads Lovescape-hosted assets while connecting to analytics and advertising services.

These vendors receive behaviour, not content: pages, sessions, devices, referrers, conversions. On an ordinary retail site that distinction is comfortable. On this one it is thinner than it looks, because the behaviour itself is the sensitive part. Which companion you opened, how long you stayed, which generator you used and what you bought describes a person adequately without a single sentence of chat.

Promptchan‘s disclosure is the one to read twice. PostHog product analytics and session replay, hosted in the EU, with non-essential tracking in the EU, EEA and UK described as consent-dependent. Session replay reconstructs an interface session — what was clicked, what was scrolled, how a form was filled. It is a category of collection that sits much closer to the content than a page-view counter, and Promptchan is the only platform in the corpus that publishes it. Disclosing it is to the platform’s credit; it is also the reason it belongs in this guide rather than in a footnote.

Age verification is the cleanest case of a third party that genuinely never sees the conversation. Four platforms name a vendor — Yoti on Kindroid and FLIRTcam.AI, VerifyMyAge on Joi AI, Didit on Dream Companion — and what those vendors receive is a selfie or an identity document. Kindroid states that Yoti deletes the images and biometric data after verification and that Kindroid does not receive them. None of these flows ran in our sessions, and the state of age gating across the market is covered in what the terms actually say.

The billing chain is the last one, and it is the best documented of all of them because a card leaves a trace a policy cannot soften. GPTGirlfriend names CCBill and TrustPay, Get Harder names Solidgate, Dreamz.ai loads a Praxis SDK while an older page still refers to PalWallet. What each of them knows about you, and what your bank will print on the statement, is the subject of who takes your money.

Why “encrypted” does not answer this question

Encryption is the word this market reaches for when asked who can read your messages, and on a large part of the market it is doing no work at all. The three platforms that describe a mechanism rather than a mood are the ones that show why.

Secrets.ai documents AES-256 at rest, TLS 1.2 or higher in transit, role-based internal access and logged access controls — a real description of real controls. The same policy describes real-time call transcription and lists training and improving AI models among its processing purposes. OurDream AI describes encryption at rest and in transit, and in the same document permits service-provider and affiliate processing. Kindroid ties the encryption to a consequence — staff cannot view chats in normal operation — and then names the exceptions.

Xotic AI shows the opposite drafting choice. Its Safety Center promises end-to-end encryption for conversations, while the platform’s own disclosures describe AI processing, automated real-time scanning, third-party infrastructure and possible human review of flagged sessions. We cannot determine the actual architecture without an audit, and the two statements cannot both be describing the same system.

At-rest and in-transit encryption protect your conversation from everyone outside the chain. They do not protect it from the chain. A model provider cannot generate a reply to a message it cannot read; a classifier cannot flag content it cannot inspect. Both sit inside the trust boundary by construction. That is not a flaw in the products — it is what a hosted AI service is — but it means an encryption claim and the question in this title are simply about different things.

The claims that would be about this question are the end-to-end ones, and we could not audit a single one of them. Where a platform’s marketing asserts end-to-end encryption while its own policy describes server-side processing, we record the conflict rather than pick a winner; the full list of those conflicts is in what the terms actually say. An unverified claim is recorded as unverified, not as a lie.

What this changes in practice

The padlock answers a different question. Transport and storage encryption stop outsiders. The parties described in this guide are insiders by design — they are how the reply gets written and how the platform stays lawful. A homepage that offers encryption in answer to “who can read this” has changed the subject.

A published list is the signal, not a strong promise. The most reassuring document in our corpus belongs to a platform we rate cautiously, and it is reassuring precisely because it is unflattering. When you are comparing two services, the one naming its providers is telling you something; the one promising that nobody can see anything is telling you less than it appears to.

Voice is a text decision. Once you speak, a transcript exists, and it can outlive the audio and reappear through memory. If a thing would be unwise to type, saying it does not make it safer.

Silence is not a guarantee. Two platforms document no moderation layer at all. That is not a promise that nobody reads flagged material — it is an absence of information, and it sits beside the same broad processing rights everyone else grants.

The four questions that hide inside the word “safe”, and what happens when you read all nineteen sets of terms end to end, are in are AI girlfriend apps safe. The evidence labels behind every statement on this page — documented, tested, not established — are explained in how we test AI companions. And the practical version, the eight things to check before you pay, is in our checklist.

⚠ This guide reads published documents and contains no affiliate links in its text. The reviews it links to do: if you click through and subscribe, AI Companion Atlas may earn a commission, at no extra cost to you. Every policy, term and moderation page behind this page was read between 14 and 21 August 2026, and we audited no implementation — providers change and documents are revised without notice, so check the current policy on the platform before you decide what to type into it. The sidebar banner is a paid advertisement: an affiliate link to LiveJasmin, a live webcam service this page does not rate.