Picture what sits inside one of these accounts after six months: chats more honest than most of your emails, generated images, a saved payment method, and an email address that ties it all back to the rest of your life.
Now picture who runs the thing. Usually a small company, a handful of engineers, and no regulator watching over them day to day. Very valuable contents, ordinary locks: that mismatch is the whole issue.
What the apps often leave out
Not every app, but often enough that you should assume so until you have checked:
- No two-factor login. Your password is the only barrier, along with whoever controls your email.
- No list of active sessions. You cannot see which devices are signed in, or kick out one you do not recognise.
- No new-login alerts. A sign-in from a stranger's phone goes by without a peep.
- Flimsy recovery. Frustrating when you are the one locked out, and easy pickings for someone posing as you to a support agent.
- Sessions that never expire. A phone you stopped using ages ago can still be signed in.
When an app does provide 2FA and a session list, take note. It usually means the team has thought about the rest as well.
Four changes that do the most
1. Give it its own password, from a manager
It sounds boring and it is the biggest single win. The likely attack is not someone targeting this app. It is credential stuffing: a password leaked from some unrelated breach gets tried here.
A password manager makes unique passwords painless. A reused one is only ever a single unrelated leak away from being someone else's.
2. Use a separate email address
This does two jobs. Nobody can trace the account back to your main identity, and trouble with one mailbox does not spill into the other.
Pick a genuine mailbox you control, not a throwaway, because you will need to receive a reset link a year from now. An alias service or a second mailbox from your current provider both do the trick.
Send the billing receipts to the same address, as suggested in keeping payments private.
3. Switch on 2FA wherever it is offered
If the app has it, use it, and choose an authenticator app over SMS codes. If the app has nothing, put 2FA on your email account instead. That inbox is the recovery route, so locking it down protects every app that can send you a reset link.
When the app itself gives you nothing, this is the best move left.
4. Sign out of devices you have finished with
Particularly borrowed or shared ones. With no session list available, changing your password is the blunt fix, and in most setups it ends every other session.
The risk that is not about tech
It deserves a plain mention because it causes the most real harm here: someone picking up your unlocked phone or laptop.
No password rule stops that. The fix lives on the device: separate browser profiles, notification previews turned off, downloads kept out of synced folders. The details are in using an AI companion on a shared device.
If the app gets breached
It does happen, and the steps are the same each time:
- Change the password straight away, plus every other place you reused it.
- Keep an eye on the email address for reset requests you never made.
- Look over the payment method and think about swapping the card.
- Decide whether to stay. A clear notice with a proper timeline is a very different sign from a breach that journalists reveal months later.
- If your details were misused, report it through ReportCyber at cyber.gov.au, run by the Australian Signals Directorate's cyber security centre, and IDCARE (1800 595 160) offers free help with identity and cyber problems.
Read what the company actually says. If it dodges the question of whether conversations were exposed, that dodge is an answer too.
Before you pay
Two minutes in the settings menu tells you more about a company's engineering than any sales page:
- Can you turn on 2FA?
- Is there a session list?
- Can you delete the account yourself, or only by emailing support?
Apps designed to hold years of history, such as Nomi and Replika, are where all this matters most, because they end up storing the most about you. What that material includes is covered in what your app knows about you, and clearing it out is covered in deleting an account.
