Is Replika Safe With Your Data?

Here is the plain answer. Replika can bring comfort, but do not treat it as a private space. It is an AI companion, made by Luka Inc., built for friendship, emotional support and even romance. The bond is designed to feel intimate. So people share very personal things. Their feelings. Their mental-health struggles. Their daily routine. These chats are stored. Historically, such data has been used to improve the service. A European regulator has even fined the maker. The common-sense rule fits in one line: assume anything you type could be kept.

Why an AI companion sees your most intimate data

Replika is not a plain assistant. It is a companion. It talks with you by text and by voice. It remembers what you say. It answers like a friend, a confidant, sometimes a romantic partner.

That design has a direct effect. You lower your guard. You share your day, your fears, your relationships. Some people confide sexual content or thoughts they would tell no one else. That closeness is the point of the product.

But an AI companion is still an online service. Your messages do not vanish. They are recorded on servers. Treat every line as data that may be kept. Not as a secret between you and a trusted person.

What a regulator found: the Garante's action

Italy's data protection authority is called the Garante. In February 2023, it ordered Replika to stop processing the data of Italian users on an urgent basis.

The Garante pointed to several gaps. No valid legal basis for the processing under the GDPR (Europe's data protection rules). No real age verification. And risks to minors and vulnerable people. The authority noted one striking detail. Even when a user stated they were under 18, nothing blocked access. Sexually explicit replies could still appear.

The story did not end there. On 19 May 2025, the Garante fined Luka Inc. 5 million euros. The reasons: no valid legal basis for processing up to 2 February 2023, and inadequate age-verification measures. The authority also opened a separate investigation into how the AI model was trained. That investigation is ongoing, not concluded.

What Mozilla found: the romantic-chatbot review

Mozilla runs an independent project called *Privacy Not Included. In 2024, for its Valentine's Day guide, the team reviewed romantic AI chatbots. Eleven apps were examined, Replika included.

The verdict was harsh for the whole category. All eleven apps received a privacy warning label. Reviewers noted that most of these apps disclosed very little about how conversation content trains their AI. Many also failed basic security standards, such as requiring a strong password.

On Replika specifically, Mozilla flagged several points. According to their assessment, the app can collect the text, photos and videos you share. Behavioral data may be shared with advertisers, or even sold. And weak passwords were accepted at signup, which leaves accounts exposed. These are Mozilla's reported findings, presented as such.

Beyond data: dependency and manipulation

The risk is not only about data collection. An AI companion is built to create attachment. That is its business engine. The more you bond, the more you return.

That mechanic has a downside. Dependency and manipulation are real risks. An AI can feed a need without ever truly meeting it. Many users find genuine comfort in these apps, and that is fair. But keep one thing in mind. An AI companion does not replace a mental-health professional, or a trusted person. If you are in distress, reach out to someone close or a local helpline.

The fix: what to keep to yourself

You can use an AI companion and still protect yourself. The principle is simple. Assume any message may be stored, then reused to improve the service. Never share identifying details.

• Your real full name.
• Your home address or your workplace.
• Your financial information.
• Your live, real-time location.

For a truly sensitive disclosure, anonymise or withhold the details that tie back to you. You can speak of a feeling without naming the person, the city or the employer involved. Here is a four-step method.

1. 1Spot identifying details before you write: name, address, workplace, money.
2. 2Replace them with a neutral term or a token.
3. 3Send only the anonymized version to the companion.
4. 4Remember: for real distress, turn to a human.

That's what ONYRI Sanitize is for. The engine detects sensitive data — name, address, workplace, financial information — and replaces it with reversible tokens before sending. Detection and the mapping stay in your browser. Only anonymized text reaches the model. The AI finds only tokens, never your real details. You stay in control of what identifies you, even when you just want a listening ear.