Post the question on a forum and two confident camps show up: "obviously they sell everything" and "that would be illegal". Both are wrong, and the useful truth sits in between.
Three different things get called "selling"
Handing over the text of your chats. Passing conversation logs to a buyer is uncommon, legally risky in most places and a scandal the moment it came out. Companies deny it firmly, and nothing on the public record shows a mainstream companion app doing it.
Letting advertisers watch how you use the app. This is the everyday case. Advertising and analytics code built into an app or site, often called an SDK, sends back what you tap, at what time and from which handset. In some places, California among them, sending information to others for targeted ads counts as "sharing" and swapping it for anything of value can count as a "sale". So a company can say, truthfully, that it never sold your conversations while still profiting from your behaviour.
Giving data to the companies that run the service. The hosting firm, the model provider that writes the replies, the payment processor charging your card. These transfers keep the product working and are not sales, but they still mean copies of your data on someone else's systems. When the company is overseas, Australian law expects it to take reasonable steps to make sure the overseas recipient handles the data properly (Australian Privacy Principle 8).
Then there is a fourth route that people overlook: the business changing hands. Nearly every policy says your data goes to the buyer if the company is sold. The companion app Soulmate was sold shortly before it shut in 2023, a story told in when your AI companion changes overnight.
The only systematic audit so far
In February 2024 the Mozilla Foundation examined 11 romantic AI chatbots for its Privacy Not Included guide, among them Replika, Chai and EVA AI. Together they had roughly 100 million downloads on Google Play. Mozilla stuck its privacy warning label on all eleven.
How many of the 11 chatbots fit each finding in the Mozilla February 2024 review. Source: Mozilla Foundation, Privacy Not Included.
What stood out most was the tracker count. In the first minute of use, Mozilla logged 2,663 trackers per app on average, though one app skewed that figure: Romantic AI set off 24,354 in a single minute, with EVA AI next at 955.
Hold your conclusions loosely, for two reasons. It reflects early 2024, and policies have moved since. Several of the apps that lead the market now were not in the sample. Its real value lies in showing how the category behaves by default, more than in any single grade.
Getting your answer from a privacy policy
Skip the full read. Hunt for a handful of key words, then read only the paragraph around each hit.
| The policy says | Which usually means | Cause for concern? |
|---|---|---|
| "We do not sell your personal information" | No sale in the narrow sense, so look for "share" separately | Only if "share" appears too |
| "Advertising partners", "targeted advertising" | Trackers build an ad profile from how you use the app | Yes, and opt out if you can |
| "Our affiliates" | Sister companies under one owner, sometimes a whole stable of apps | Depends on who the owner is |
| "To improve our services", "train" | Your chats may help train models | Yes, look for an opt-out |
| "Merger, acquisition or sale of assets" | The buyer gets your data if the company is sold | Routine, but keep it in mind |
| "Where we believe disclosure is necessary" | Handing data to authorities without a court order | Yes, unless it says something narrower |
A footer link reading "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" is a clue in itself. US state laws such as California's require it from businesses that sell or share personal information, so seeing it means some sharing goes on. It is not an Australian requirement, but where an app offers the button, it costs you nothing to use it.
A five-minute check for tonight
- Search the policy for sell, share, advertis, train and affiliate. That is five searches and five paragraphs.
- Read the store labels. Apple's "Data Used to Track You" panel and Google Play's "Data safety" section are filled in by the developer, so they are claims and not audits. An app that admits to tracking there will not be better in practice.
- Decline the tracking prompt on iPhone, and reset your advertising ID on Android.
- Use the direct marketing opt-out. If an app or its partners are marketing to you, tell the business to stop. Australian Privacy Principle 7 lets you ask, and the business has to act within a reasonable time without charging you.
- Look for ads inside the app. If there are any, your attention and data help pay its bills. See how AI companion apps make money.
Where Australian law helps and where it stops
The Privacy Act 1988 and its Australian Privacy Principles cover most businesses with annual turnover above A$3 million, along with some smaller ones, and can reach overseas companies that carry on business here. You can ask what a business holds about you, ask for corrections, and complain to the Office of the Australian Information Commissioner (OAIC) if it will not help. Step-by-step advice is in how to get your data from an AI companion app.
The limits matter too. Australia has no equivalent of California's opt-out from the sale or sharing of data. The direct marketing opt-out is narrower, and it does not stop tracking as such. A right to opt out of targeted advertising was floated during the Privacy Act review, and reforms passed in December 2024 added a statutory tort for serious invasions of privacy, in force since 10 June 2025, and require the OAIC to develop a Children's Online Privacy Code by December 2026. Check the OAIC site for what has changed since. In Europe and the UK, GDPR gives people similar rights and more, and regulators use them: Italy fined Replika's operator 5 million euros in 2025, partly for a privacy policy that did not explain what happened to users' data.
For US context, the new state laws on AI companions, covered in AI companion laws in the US, concentrate on disclosure and crisis handling and say little about data. The main exception is narrow: Utah's mental-health chatbot law bars those bots from selling users' health information, sharing it, or aiming ads at what users type.
The straight answer
The big majority of companion apps are not selling your conversations. Many do let ad and analytics companies look over your shoulder, and almost all keep the door open to doing more later. A careful app and a careless one look different in their policy and settings, and you can spot the gap in five minutes. That is time well spent before you type anything you would hate to see in someone else's database. Our four privacy checks cover the rest.