Is Pinku AI Safe? Privacy, Chat Access, and Deletion Reviewed

Is Pinku AI safe? Its published policy does not justify a blanket yes. It promises no model training on your content, but also describes server-side storage and content review.[1] The practical answer depends on what you are willing to share with an operator. Do not submit identifying or intimate material whose processing or potential disclosure you could not accept.

This review covers pinku.ai by Polaris Bitworks

The short version: This is a review of pinku.ai, whose privacy policy identifies its operator as Polaris Bitworks, S.L., a Spanish company.[1]

The full privacy and cookie policies were reviewed on October 26, 2026. Both display “Last updated: September 2025.”[1][3] This article does not cover the similarly named offline app by Saga Ltd.; its processing claims must not be transferred to pinku.ai.

This was public-policy inspection, not an authenticated account test, encryption audit, or investigation of incident history. Account visibility, export delivery, and deletion were not tested. Pinku also states that its service is not intended for anyone under 18; enforcement was not tested.[1]

No-training does not mean no-processing or no storage

The short version: Pinku promises not to train AI models on user content or generated outputs, while explicitly saying it stores submitted prompts, uploads, and generated media.[1]

Pinku says all its AI models are hosted on its own servers in Europe and that it does not use third-party AI providers.[1] That describes cloud processing, not an offline model running on your device. European hosting alone does not establish GDPR certification or independently verified routing.

The policy describes automated prompt scanning for safety and compliance, particularly to prevent content involving minors.[1] No-training therefore does not mean no inspection.

Another passage says only final AI outputs are stored, not intermediate processing steps. Read that alongside the collection section’s explicit prompt-storage statement, not as a zero-storage guarantee.[1] Ask how conversation text differs from intermediate processing records. The broader guide to mapping where an AI message goes helps separate these questions.

Content review and service exceptions limit absolute privacy claims

The short version: The policy reserves generated-content monitoring and review rights in its section addressing minors; it does not establish zero operator access.[1]

Privacy from other users, visibility to character creators, and access by the operator are different questions. The reviewed evidence does not provide a complete permissions matrix. Ask who can see private conversation text, under what conditions, and whether that access is recorded. Our guide to who can read AI companion messages explains the distinction, not Pinku’s specific permissions.

Pinku claims encryption at rest and in transit.[1] That is not evidence of end-to-end encryption or user-only key ownership. Its no-third-party-AI statement also does not mean no outside services: the policy permits necessary access by email and payment providers, plus legal and safety disclosures.[1] This does not establish that those providers receive chat text.

Use this policy-versus-proof matrix before sharing sensitive material:

Content retention follows the account, with a seven-day backup window

The short version: Pinku’s explicit account-lifetime retention rule names generated content and uploads; it should not be silently extended to every kind of log.[1]

The policy says those items remain as long as the account exists. When an account is deleted, Pinku promises permanent removal of personal data and content from active systems, with backup copies potentially remaining for up to seven days before automatic purging.[1] These are stated deletion terms, not verified erasure results.

Submitted prompts are explicitly collected, but the reviewed policy does not give separate retention timers for chat-message logs, moderation records, or error logs.[1] It also does not establish a universal seven-day schedule for outside payment providers. Ask for category-specific answers rather than assuming the backup window covers every system. Keep any exports you retain secure yourself.

Export and deletion promises need a confirmed outcome

The short version: The policy offers generated-content downloads per chat and a fuller export by contacting Pinku; its 48-hour promise concerns a response, not completed export or erasure.[1]

The privacy contact is legal@pinku.ai.[1] A downloaded image or video is not proof that a complete conversation transcript has been exported. The reviewed wording does not specify transcript fields, file formats, or completeness.[1]

Use this proposed checklist, not a claimed walkthrough of tested account controls:

1. Confirm the exact service and account. Save a dated copy of the policy before making requests.
2. Download generated content you want to keep. Separately request conversation text, timestamps, uploads, outputs, account data, and available formats. These are requested fields, not guaranteed export contents.
3. Ask legal@pinku.ai which staff roles can access private chats and whether character creators see messages. Request retention details for prompt, chat, and moderation logs, including any service providers involved.
4. Open the delivered files and check their date range and contents before using the stated self-service account-deletion flow. No current settings path was tested for this review.
5. Keep the deletion confirmation. Ask how the seven-day backup purge applies and whether any records fall outside that process. A reply within 48 hours is not confirmation that every copy has been erased.[1]

Privacy checks matter more than a blanket safety verdict

The short version: Decide whether operator-held processing fits your boundaries, then resolve the unanswered access and export questions before sharing more.

If you want less optional analytics, Pinku’s cookie policy says declining analytics cookies leaves the site working normally, but it still describes anonymous visit counting.[3] Network behavior was not tested here.

If considering Local Waifu or another local option, verify local-processing claims for the actual configuration. A local label alone is not proof of the route your messages take.

For Pinku, the next useful step is specific: keep sensitive identifiers out, request written access and retention answers, and inspect your export before deleting. Those checks support a personal decision without pretending this policy review proves the service safe or unsafe.

Sources

[1] https://pinku.ai/privacy-policy - privacy [3] https://pinku.ai/cookie-policy - cookies

Questions people ask

Back to the blog