Replika's privacy policy keeps chats out of advertising

The design

Replika, the companion app made by Luka, Inc., collects account details, profile fields, and the messages a person exchanges with their AI companion. Its privacy policy, as retrieved on 16 September 2026, states that Replika uses third-party AI language model providers to generate conversational replies, and that those providers are contractually barred from using the data to train their own models and must delete it after each response. The policy also describes a separate, internal use: small, anonymised portions of messages train Replika's own safety filters, intended to catch inappropriate outputs, not to build a general chat model.

What the evidence says

The policy states plainly that anonymised training data “is used only internally and is not used to train third-party large language models or other AI systems,” and that Replika will “never use or disclose the content of your Replika conversations for marketing or advertising purposes.” A separate Replika support article, Do you sell my personal information?, repeats the no-sale claim and points back to the policy for detail. Both are the company's own statements; neither document is an independent audit of what actually happens inside Replika's systems, and the policy does not name which third-party model providers it uses.

What it asks of people

Using Replika under this policy means trusting that de-identification before internal training and contractual deletion by outside vendors both work as described. The policy asks for account, profile, and payment data outright, and it treats conversation content as personal data used to let “your AI companion learn from your interactions to improve your conversations” — a personalisation claim distinct from training a shared model. It does not guarantee that a given message was excluded from the safety-training sample, only that any sampled portion was anonymised first.

Privacy and safeguards

Retention periods are laid out by category: data tied to legal obligations for up to ten years, aggregated analytics data for up to one year, and other data for the life of the account plus any dispute period. Camera and face-tracking data used for augmented-reality features is described as processed on-device and immediately discarded. What the policy does not address is independent verification: there is no cited audit confirming the de-identification or vendor-deletion steps are effective in practice.

• Does the policy name which third-party AI providers process your conversations?
• What counts as a “small portion” of messages used for safety-algorithm training?
• Is there independent confirmation that anonymisation is irreversible?

Replika's policy draws a clear line between advertising and safety-model training, and a separate line between its own systems and outside AI vendors. Both lines are claims made by the company about its own practices, useful for a reader to know exist, but not independently confirmed by anything in these two documents.