Three companion privacy policies diverge on chat data

What happened

As retrieved on 16 September 2026, three companion apps publish separate privacy policies describing what happens to a chat once it is sent. Character.AI's privacy policy lists 'chat communications' among the content it collects and states that, for information gathered during the 'initial development' of its language models, the company 'no longer' carries out that processing. Replika's privacy policy lists 'messages and content' among the data it processes and tells third-party service providers not to use that data to train 'their own AI models'. Nomi's privacy policy says the only information collected beyond an account email is 'whatever content you provide' through the system, which includes chats.

What the documents show

The three diverge most on retention wording. Replika's policy states messages are processed for 'up to 60 days' after a contract ends. Nomi's policy states that, with an exception for a 'training or communications archive', personal information is otherwise 'not retained' once an account is deleted, and that archived information becomes 'no longer attributable' to the user. Character.AI's policy names disclosure categories, including 'affiliates' and 'service providers', and a 'legal requirements' basis for sharing, but the sections reviewed here do not state a specific chat-retention period. Read together, one document names a day count, one names an exception process, and one leaves the period unstated.

The mechanism

A privacy policy is a disclosure instrument, not a technical description of a model. When a policy describes data moving into a 'training archive' or becoming de-identified, it is describing a data-handling decision the company can change, not a property of a trained model's parameters. Nomi's own wording, that archived data becomes 'no longer attributable' to a person, is a claim about record-keeping and de-identification; none of the three documents opened here states whether a model's weights are retrained, filtered or left unchanged after a deletion request. That is a genuine gap between what a privacy policy promises and what it can verify.

What it leaves open

None of the three policies, in the sections reviewed, explains whether a deleted chat can still shape a model indirectly through data aggregated before the request. This is an editorial reading, not a documented answer, and it is the reason 'delete' in a privacy policy should not be assumed to mean a model forgets the way a person does.

• Does the policy state a specific retention period for chat content, or only a general rule?
• Does the policy distinguish an account deletion from a training-data deletion?
• Does the policy name who receives the data beyond the company itself?

Comparing three policies side by side does not establish which company is safer; it shows which questions each document actually answers on the page, and which are left to the reader to assume.