AI chat privacy: who actually sees your messages and what to do about it

The question «what happens to my AI chat messages?» stopped being theoretical in 2024–2026. Millions of conversations leaked, regulators started fining, and users themselves started to understand: «private» on a service's marketing page and «private in fact» are different things. This breakdown — no product pitch, just two public incidents and three storage layers worth knowing before you sign up.

I'm a developer of an adult AI app, so the topic is workday material: in my system, every active user has between 20 and 200 stored messages, conversation context, memory facts, and session metadata. That's a lot — and it's typical for the industry, not a Velvary peculiarity. Here's what you can do about it from the user side.

Case 1. Muah.AI: what leaked

In September 2024 a hacker using the handle «cutiepie」 claimed to have compromised the AI companion platform Muah.AI. In October 2024 the database went up for sale and was confirmed by independent researchers (HaveIBeenPwned, Bleeping Computer). Public numbers:

• 1,910,261 accounts affected.
• What leaked: emails, IP addresses, password hashes, full chat histories, user-uploaded photos, and in some cases fetish tags and privacy settings.
• What this means in practice: explicit conversations tied to real email addresses ended up in the open. This isn't «phone numbers leaked» — this is content the user wrote expecting privacy.

Muah.AI didn't publicly disclose the size of the breach or announce compensation. The service kept running after the incident; some users only learned about the compromise from public sources. That's the first lesson: «we're secure» is marketing, not fact, and the only real test is how the service behaves when things go wrong.

Case 2. Replika: what got fined

In April 2025 the Italian regulator Garante per la protezione dei dati personali fined Luka (the company behind Replika) €5 million. This is the first major fine in the AI companion industry, and it sets a precedent.

Garante's complaints covered two things. First, the processing of minors' personal data: Replika didn't have a reliable age gate, and children's accounts ended up in the system. Second, the absence of a legal basis for processing sensitive data (in Italy and the EU that's a separate category with separate requirements). The €5 million fine wasn't for one slip — it was for systematic non-compliance with GDPR in an app that operates directly in the emotional and intimate sphere.

For the industry this is the signal that regulators have started treating AI companions as a distinct class of service, not «another chatbot». Similar fines in other jurisdictions are a matter of time, and services that don't get ready now will either close or move to softer regulatory zones.

Brazil bonus: Digital ECA and LGPD

Brazil is one of the most advanced regulators on protecting minors' data in digital environments. Two frameworks directly cover AI companions.

• LGPD (Lei Geral de Proteção de Dados), in force since 2020, regulates processing of any personal data including chat contents. Sensitive data (including sexual orientation and intimate preferences) is a separate category with stricter legal bases.
• Digital ECA (Lei 15.211/2025) took effect on 17 March 2026 and established mandatory age verification for any platform with user-generated content accessible to children. By April 2026, major competitors (including Janitor AI) had begun introducing mandatory age verification for Brazilian IPs.

In practice, this means a Brazilian user is better protected than a Russian or American one. If you're in Brazil, you have every right to demand from a service proof of LGPD compliance and a statement on how it handles sensitive data.

Anatomy of storage: three layers

When you write in an AI chat, your message lands in at least three layers. Different services handle them differently, but the structure is similar.

• Content. The message texts themselves, uploaded photos, sometimes audio. This is what you see in the chat interface. It lives in a database, usually tied to your user ID and a timestamp. Without this layer the chat simply doesn't work — there'd be no history.
• Infrastructure logs. Technical records: which IP you came from, which model answered, how long it took, whether there were errors. Developers need this for debugging and it usually lives separately from the chat. Retention: days to months, depending on policy.
• Account metadata. Email, country, plan, payment history, session tokens, cookies. This is what identifies you as a user. It usually lives longest — as long as the account exists.

The most sensitive layer is content, and it's the main risk in a breach. Logs are usually anonymised, but content is typically stored in plaintext in the database — otherwise the model can't use it. A deep look at how the memory layer works is in the memory deep-dive.

Five questions to ask a service before signing up

These questions are universal — they apply to any AI chat, not just Velvary. If a service can't answer at least three of them, that's a bad sign.

1. Where is the data physically stored? Server region matters: a European server is subject to GDPR, a US one to different laws. A service that doesn't know where its own servers are doesn't control its data.
2. How do I delete my account and conversation? There should be a button in settings, not «write to support, we'll get back in 30 days». Check before signing up, not after.
3. Is content encrypted at rest? When you're not actively chatting, is your conversation stored in a form that can't be read even if the database leaks? That's the difference between your data being in a breach and not being in it.
4. Are conversations used for model training? Are your messages used as training data, and can you opt out? In the EU this is regulated by law, elsewhere — only by the service's policy.
5. Have there been public incidents? Breaches, hacks, regulator fines. A service that survived a breach and talked about it openly is more trustworthy than one that stays silent.

What we do at Velvary

Since you're here — briefly on our setup. This isn't «we're the best», just facts as they stand at the time of writing. Details in the privacy policy.

• HTTPS only. Connection is encrypted; your ISP and Wi-Fi admin only see the domain and the fact of the connection, not the content.
• Email is the only identifier. No phone, no social logins, no document upload. Register with an email that's not tied to your job — your call.
• Payment off our servers. Telegram Stars or a crypto processor — Velvary's name doesn't appear on your bank statement. Not perfect protection, but an extra layer of separation.
• One-click deletion. In account settings — a delete button that wipes history along with the account. Not «on request within 30 days», but immediately. Not unique, but many competitors don't have it.
• Conversations don't go to third parties. Not sold, not shared with partners, not used to train third-party models.

Seven rules of hygiene for the user

Even with a reliable service, some risk is on you. This isn't paranoia, it's normal digital hygiene — like passwords.

1. Don't send photos of documents, bank cards, work files. Not because the service is bad, but because a breach can happen to anyone.
2. Register with an email not tied to your job. If a leak happens, your employer doesn't get your address.
3. Check for a delete-account button in settings. If there isn't one or it asks you to write to support — leave.
4. Use a unique password. A password manager costs pennies and insures you against one broken service opening your email, bank and socials.
5. Don't write what you wouldn't want to see in a breach. Sounds harsh, but that's the definition of private. An AI chat conversation isn't a diary under the pillow — it's a record in someone else's database.
6. Don't link your phone unless the service requires it to work. Phone numbers are unique identifiers, and a phone leak is more dangerous than an email leak.
7. Check default visibility settings. Some services publish previews of your conversations or share history for «recommendations». Turn it off if you don't need it.

Privacy ≠ anonymity

People often confuse the two. Privacy is «my content won't end up in other hands without my knowledge». Anonymity is «nobody knows I'm here». An AI chat can't be anonymous in principle: for the character to remember you across sessions, there needs to be a link between you and the account. Private it can be — if the service takes data seriously.

A good sign that a service takes it seriously: an open privacy policy with specifics (what's stored, how to delete, who it's shared with), not vague «we care about your data». The first is checkable, the second isn't.

What to do right now

• If you have AI chat accounts you don't use — delete them. It's faster than configuring privacy.
• If you use AI chat and haven't checked visibility settings — check them. Takes five minutes.
• If you're thinking of starting — read the privacy policy before registering. If there isn't one or it's two sentences — look elsewhere.