Replika — privacy & data policy

Provider: Luka. PromptPrivacy score: 67/100. Last verified November 01, 2026.

What happens to your data?

Your conversation messages, profile details, and uploaded media are processed to deliver personalized interactions with your AI companion and are kept on secure servers. Minimal conversation data is sent transiently to third-party AI model providers under strict terms preventing them from training models, while small anonymized excerpts are used internally to refine safety algorithms. Replika does not share conversation content or photos with advertising partners, but device and web interaction metrics are shared with platforms like Meta and Google unless opted out.

Does it train on your data?

Trains on your content by default. Replika collects and immediately anonymizes user feedback and small portions of messages and content to train proprietary safety algorithms and enhance chatbot performance internally. User data is not used to train third-party large language models, and external AI providers are contractually prohibited from using user data for model training.

Can you opt out?

Not specified. While the policy states that anonymized portions of conversation content and feedback are used internally to train proprietary safety algorithms and enhance performance, it does not specify an opt-out toggle or setting to disable this training.

Data retention

Text conversation history is retained for 24 months, while photos, videos, and voice messages are stored for 12 months unless saved to profile memories or diaries. Profile information, customization, and memories are kept for the life of the account and deleted within 60 days of account deletion. Biometric age-verification data is permanently deleted within 24 hours, while tax and accounting transaction records are preserved for up to 10 years. Inactive unpaid accounts may be deleted after 12 months with prior notice.

Encryption & security

Data in transit is encrypted using standard Secure Socket Layer (SSL) encryption. Data at rest is hosted on secure servers with multi-layered protections including firewalls, role-based access controls, and passwords. Encryption at rest is not explicitly mentioned, and no third-party compliance standards (such as SOC 2 or ISO 27001) are cited.

Is it safe for work?

No. Replika is designed strictly as a personal, consumer AI companion for adults aged 18 and older. It lacks enterprise administration features, team management controls, business-grade confidentiality guarantees, and business Data Processing Agreements (DPAs).

Source policy: https://replika.com/legal/privacy