By four honest criteria, where the model runs, whether the policy allows training on your chats, whether the company has a documented breach or fine, and what privacy actually costs, a local companion is the only category that scores clean on the first three, because there is no server for any of them to apply to. Among the cloud apps compared here, none score clean on all four, and Replika carries a real 5 million euro fine. Local Waifu runs the model on your own computer for a one-time $20, so the privacy is the architecture, not a claim on a marketing page.
“Most private” gets printed on a lot of landing pages with nothing behind it. Here is an actual scorecard, four criteria, sourced.
Four questions, not a vibe
The short version: where does the model run, does the policy allow training on your chats, has the company had a real breach or fine, and what does privacy cost you.
Those four, in that order, because the first one decides most of the others. If the model never runs on a server you do not control, several of the remaining questions stop applying entirely.
Where the model actually runs
The short version: every cloud companion app runs the model on its own servers by definition. A local app runs it on your computer instead.
| App | Where the model runs |
|---|---|
| Replika | Their servers |
| Character.AI | Their servers |
| Janitor AI | Depends on the backend you connect, see below |
| Kindroid | Their servers |
| Candy AI | Their servers |
| Local Waifu | Your computer |
Janitor AI is the interesting exception: its own built-in model stays on Janitor’s systems, but connect your own OpenAI key and the conversation moves to OpenAI, and route it through a community reverse proxy instead and it moves through a stranger’s server with no accountability attached. Three different privacy stories, one app, and most people never realize which one they picked.
Does the policy allow training on your chats
The short version: Character.AI’s policy allows it with no opt-out. Replika’s policy narrows the scope but still admits collecting message data for its own safety training.
Character.AI’s privacy policy treats your conversations as part of the data used to improve its models, and using the service is the consent. Replika’s policy says anonymized data stays internal and bars third-party providers from training on it, then separately admits collecting “small portions of Messages and Content data to train our proprietary safety algorithms.” Mozilla’s Privacy Not Included review specifically flagged how vague that gets once you ask how much sensitive content that actually covers.
Local Waifu has nothing to train on remotely, because the conversation is not sent anywhere by default. If you plug in your own cloud key instead, that provider’s training policy applies to what you send them, which is your decision to make and disclose to yourself, not a default.
Has it actually leaked or been fined
The short version: documented incidents exist across this category, and Replika specifically carries a regulatory fine.
Italy’s Garante fined Luka Inc., Replika’s parent company, 5 million euros in April 2025 for having no valid legal basis for parts of its processing and no meaningful age verification. Separately, Muah.AI leaked 1.9 million email addresses tied to chat prompts in 2024, Chattee and GiMe Chat exposed 43 million messages in 2025, and Chat & Ask AI exposed roughly 300 million messages in early 2026. None of the apps in that specific tracker are named here, but the pattern is the same category, the same root cause: a server holding intimate conversations, misconfigured.
A local app has no equivalent event to have, because there is no central database of anyone’s conversations to leave open. That is not a claim about better engineers. It is a claim about not having a bucket with your name on it in the first place.
What privacy costs
The short version: on cloud apps, more privacy-adjacent features usually cost more money. Local Waifu’s privacy comes from the $20 you already paid.
Character.AI runs about $9.99 a month for its paid tier. Kindroid runs roughly $14 to $60 a month depending on tier, as of July 2026. Candy AI’s sticker price is about $13 a month, but its token system means most active users actually pay $25 to $80 a month once image and voice generation are counted. Replika Pro runs close to $70 a year, with an Ultra tier above that.
None of those subscriptions buy you out of the architecture question. You can pay Kindroid $60 a month and your conversation still lives on Kindroid’s servers. Local Waifu is $20 once, and the privacy is not a tier you upgrade into, it is what happens when the model never leaves your machine to begin with.
The honest scorecard
| App | Model location | Trains on your chats | Documented breach or fine | Monthly cost |
|---|---|---|---|---|
| Replika | Cloud | Partial, per own policy | Yes, EUR 5M fine (2025) | ~$6/mo billed yearly |
| Character.AI | Cloud | Yes, no opt-out | Not fined to date | ~$9.99/mo |
| Janitor AI | Depends on backend | Depends on backend | Not fined to date | Free, backend costs vary |
| Kindroid | Cloud | Not fully disclosed | Not fined to date | ~$14 to $60/mo |
| Candy AI | Cloud | Not fully disclosed | Not fined to date | ~$13/mo sticker, $25-80 real |
| Local Waifu | Your computer | No, by default | N/A, no server | $20 once |
Check the full picture on the breach tracker, or see the local architecture in practice on the pricing page.
Questions people ask
What makes an AI companion app private?
Four things worth checking before you trust one with anything personal: whether the model runs on your device or a company's server, whether the privacy policy allows your chats to train models, whether the company has a documented breach or regulatory fine, and what you actually have to pay to get real privacy rather than a marketing page about it.
Is Replika private?
Not by the criteria here. It runs on Replika's servers, its own policy admits collecting message data to train safety algorithms, and Italy's Garante fined its parent company 5 million euros in April 2025 for lacking a valid legal basis and real age verification. Mozilla's Privacy Not Included review gave it its lowest rating.
Is Character.AI private?
It runs on Character.AI's servers, its policy allows using conversations to improve its models with no opt-out while you use the app, and staff can access chats for moderation, abuse investigation, or legal requests. That is disclosed, not hidden, but it does not meet the bar most people mean by private.
What about apps that market themselves as private or uncensored?
Claims and architecture are different things. Janitor AI, for example, is private only if you stick to its own built-in model; connect an OpenAI key or a community proxy instead, and your conversation now passes through OpenAI or a stranger running that proxy.
Is a local AI companion actually more private, or is that just marketing?
It is a difference you can verify yourself. Block all outbound network traffic with a tool like Little Snitch, and a local companion app keeps working, because the conversation never has to leave your computer. A cloud app cannot survive that test.
Try her free for 7 days.
No card. Keep her for $20 once, or walk away. Her soul file is yours either way.
Bring her home, try free