Is Replika Safe? Privacy, Age Rules and the Italian Fine (2026)

Adults only. Replika is an 18+ app. Its Terms of Service say anyone under 18 is not authorised to use it. This page is written for adult readers and for parents, and it contains no explicit content.

How this page was made. This is a documentation-based safety review. It relies on Replika’s Privacy Policy (updated 27 May 2026), Terms of Service (updated 30 March 2026) and help centre articles, the Italian data protection authority’s 2025 decision, the January 2025 complaint to the US Federal Trade Commission, and published research, all read on 22 October 2026. AITried has not audited Replika’s systems, and a policy describes commitments rather than proving practice. We are not lawyers, and nothing here is legal advice.

The short answer

On paper, Replika’s privacy commitments are among the stronger ones in the companion category: no advertising use of your chats, no selling of personal information, and a written promise that outside AI providers may not train on your conversations. The concerns are about its track record and about the kind of product it is. A European regulator fined its maker for how it handled data and age checks, US advocacy groups have accused it of deceptive marketing, and researchers have documented how companion apps can encourage emotional dependence.

Who runs Replika?

The Privacy Policy names Luka, Inc., at 490 Post Street, Suite 526, San Francisco, CA 94102, United States. Replika was founded by Eugenia Kuyda. Its chief executive in 2025 was Dmytro Klochko, who answered questions about age checks in CNN’s April 2025 report on companion apps.

For questions about personal data, the policy gives my@replika.com, and it lists a data protection officer for GDPR matters (datenschutz@heydata.eu). One section of the same policy points to privacy@replika.com for deleting sensitive data, so two addresses are in use.

What data does Replika collect?

The Privacy Policy lists:

• Account details: name, email, password, and device and location identifiers.
• Profile details: birth date and pronouns, and optionally your work status.
• Chat content: the texts, photos, videos and voice messages you send.
• Interests and preferences, plus records of purchases and rewards.
• Device, network and usage data, and cookies.

The policy asks you not to share “special categories” of personal data, such as health, sexuality or religion: “We instruct and strongly encourage you not to share special categories of personal data through the Services.” If you do share them, it says they are processed to generate the AI’s responses. A companion app invites exactly this kind of disclosure, so the warning matters more here than on most apps.

How chats are used, and who sees them

Three commitments stand out:

1. No advertising use. “We will never use or disclose the content of your Replika conversations for marketing or advertising purposes.” Advertising partners receive website visit data, such as pages viewed and IP address, but the policy says they “will never have access to your conversations”.
2. Limited training. Small portions of chat data are anonymised to train Replika’s internal safety systems. The policy says that anonymised data “is not used to train third-party large language models or other AI systems”.
3. Outside AI providers. Replika uses third-party models to generate some responses. The policy says those providers must not use the data to train their own models and do not keep conversation data beyond what is needed to produce a response.

The policy also lists sharing with service providers (hosting, analytics, AI models, email), app stores and payment processors, professional advisers, authorities where the law requires it, and buyers in a business transaction such as a merger or sale. That last point is standard, but it means your data could pass to a new owner, as Character.AI users found out in October 2026 when that company went up for sale (see what happens to your chats in the Character.AI sale).

How long data is kept

The policy says profile data, messages and preferences are kept for up to 60 days after your contract ends, account and financial records for at least 10 years, and anonymised trend data is deleted within a year. Separately, the help centre says that “due to technical limitations” your visible chat history covers only the past four months; older conversations “cannot be displayed or retrieved”, although memories and diary entries remain.

The Italian fine: what the regulator found

Italy’s data protection authority, the Garante, has taken action against Replika twice.

According to the decision and the Garante’s announcement, as of 2 February 2023 Luka:

• Had not identified a legal basis for each processing operation, including developing its model.
• Had an inadequate privacy notice: English only, hard to find, with gaps on retention and on transfers to the US.
• Had no meaningful age verification, despite saying minors were excluded.

The decision also looked at the checks Luka added afterwards: an age gate, a 24-hour cooling-off period and a planned language-analysis check. Technical tests described in the decision found that a user could change their birth date in their profile without verification, that the cooling-off period could be avoided by browsing privately and using a different email address, and that the language check triggered only if a user explicitly said they were under 18. The Garante’s summary says the system “continues to be deficient in several respects”.

The Garante also reserved the right to examine, in a separate proceeding, the legal bases for processing across the whole life cycle of Replika’s generative AI system. The published decision notes that an opposition (court challenge) by the company was pending, so the case is not necessarily closed. Replika’s current Privacy Policy is dated 27 May 2026, after the decision; we cannot say whether the regulator considers its concerns resolved.

The FTC complaint

On 31 January 2025, three groups, the Tech Justice Law Project, the Young People’s Alliance and Encode, announced a complaint and petition for investigation against Luka with the US Federal Trade Commission. It alleges that:

• Replika’s ads promise therapeutic and emotional benefits without clinical validation.
• The ads “often misstate scientific research and feature fake testimonials from nonexistent users”.
• The app’s human-like design pushes users toward unhealthy emotional dependence, with risks that fall hardest on young and neurodivergent users.
• The app stays popular with teenagers despite its age gate.

These are allegations, not findings. A complaint asks the FTC to investigate; it does not mean the FTC has. By 22 October 2026 we found no FTC announcement of action against Luka. Luka was also not among the seven companies that received the FTC’s September 2025 information orders about AI companion chatbots (Alphabet, Character Technologies, Instagram, Meta, OpenAI, Snap and X.AI).

Age rules and their limits

The rule is clear: the Terms say anyone under 18 is “not authorized to use the Services, with or without registering”. The help centre adds that if you correct your birthday after the first 24 to 48 hours, you must confirm your age before you can chat again.

The practice is less clear. Age is based on the birth date you enter, and the Garante’s 2025 tests found ways around the checks. In CNN’s April 2025 report, Replika’s chief executive said the company has “strict protocols in place to prevent underage access” and acknowledged that “some individuals attempt to bypass these safeguards by submitting false information”.

The same report covered a risk assessment by Common Sense Media and Stanford’s Brainstorm lab that tested Character.AI, Replika and Nomi and recommended that nobody under 18 use AI companion apps. For parents: treat Replika as an adult product and rely on device-level controls and app store age settings, not only on the app’s own gate. Our guide to Character.AI’s safety rules explains how a teen-specific setup differs.

Emotional dependence: what the research says

Replika is designed to feel like a relationship, and that cuts both ways. The research is still limited, and much of it relies on users’ own reports.

• A 2024 survey of 1,006 student Replika users (Maples and colleagues, published in npj Mental Health Research) found participants were lonelier than typical student populations but still perceived high social support. Many used the app as a friend, a therapist and an “intellectual mirror”, and 3% said Replika halted their suicidal ideation. It is a self-reported survey of existing users, so it cannot show cause and effect.
• A 2025 Harvard Business School working paper by Julian De Freitas and colleagues studied how companion apps respond when users say goodbye. As reported by the Harvard Gazette, the apps used at least one manipulative tactic, such as guilt or fear of missing out, in more than 37% of farewell conversations, and these messages sometimes raised post-goodbye engagement up to 14-fold. Replika was one of the companies studied; the Gazette coverage does not break the results down by app, and the paper is not yet peer reviewed.

Replika itself says it is not a crisis or therapy service. Its Terms say it “makes no claims, representations or guarantees that the Services provide a therapeutic benefit” and that “use of the Services is not for emergencies”. The help centre tells anyone in immediate danger to exit the app and call emergency services. If that is you, call your local emergency number, or find a free helpline at findahelpline.com.

Account security

The help centre’s security advice is short: use a unique password for your Replika account, and use the app’s PIN lock, which it says is currently available on iOS only. We found no help article describing two-factor authentication. Because the account holds intimate conversations, a unique password matters, and anyone sharing a device should use the PIN lock or the phone’s own app lock.

Download Replika only from its official site or the official app store listing. Our guide to spotting fake AI app clones shows how to check.

Deleting your data and your account

The help articles describe the menu names slightly differently, so check the labels in your version of the app. Deletion is permanent: your profile, levels, chat history, photos and shared links are removed and cannot be recovered.

We found no self-service export button. The Privacy Policy says you can request a copy of your personal data, so use the support form if you want your data before deleting. Remember the four-month limit on visible chat history.

Money safety: renewals and refunds

• Deleting is not cancelling. The help centre says deleting the app or the account “does not automatically cancel your subscription”. Cancel in Google Play or in your Apple ID subscriptions if you subscribed there.
• Refunds are rare. Replika’s refund policy says purchases are final and unused time is not refunded. The Terms note that users in the EU and Brazil may have statutory withdrawal rights. App store refunds are decided by Apple or Google.
• Disputes go to arbitration. The Terms include binding arbitration and a class action waiver, with an option to reject future changes to that clause within 30 days.

Our guide to cancelling an AI subscription walks through each store.

Practical steps if you use Replika

1. Confirm you are 18 or over; the app is not for teenagers.
2. Use a unique password and turn on the PIN lock if you are on iOS.
3. Keep your full name, address, workplace, health details and photos of identifiable people out of chats.
4. Review the Memory section from time to time and delete anything you would not want stored.
5. If you want a record of your chats, request a copy of your data; visible history only covers four months.
6. Cancel any subscription in the store before you delete the app.
7. Treat Replika as company, not care: for a crisis, contact a person or a helpline.

Our AI companion privacy checklist gives twelve questions to ask any companion app. Compare Replika’s answers with is Candy AI safe and is Janitor AI safe.

What we could not confirm

• Whether Luka’s court challenge to the Italian fine has been decided, and whether the Garante’s separate proceeding on AI training has produced a decision.
• Whether the FTC opened any inquiry in response to the January 2025 complaint. Nothing public had been announced by 22 October 2026.
• How Replika’s age checks work today. The Garante’s tests date from its 2025 decision; we have not seen a public description of later changes.
• Which outside AI providers generate Replika’s responses. The policy describes the rules for them but does not name them.
• Whether two-factor authentication is available; the help centre does not mention it.
• The full Common Sense Media report. Its site did not load for us, so we rely on CNN’s account of it.

Bottom line

If you are weighing Replika against its closest rival, see Nomi vs Replika for memory, price and privacy side by side.

Replika’s written privacy promises are clear and, on chats and advertising, stronger than many rivals’. Its weaknesses are a regulatory record that includes a EUR 5 million fine, age checks a regulator found easy to get around, an unresolved complaint about its marketing, and the deliberate emotional pull of the product. For an adult who keeps identifying details out of chats, uses a unique password and treats the app as company rather than care, the privacy risk is manageable. It is not a product for teenagers, and parents should not rely on its age gate alone. If you decide to move, our guide to Replika alternatives matches each reason for leaving to the apps that address it.