Before sharing personal details with an AI companion, check five things: what the service collects, who receives your prompts, what memory and permissions are active, how long data remains, and what deletion actually removes. Start with a low-stakes message, read the current policy, and do not assume that a friendly conversation is confidential.
Key Takeaways
- Read for specifics: look for collection, inference providers, retention, backups, training use, and deletion routes, not just labels such as “private” or “secure.”
- Treat memory and chat history as separate questions: a visible empty thread does not tell you what may remain in local storage, logs, backups, or a processor’s systems.
- Keep high-risk information out: do not enter passwords, one-time codes, financial details, government-ID numbers, private documents, or another person’s confidential information. The FTC advises AI companies to honor privacy and confidentiality commitments, and Australia’s privacy regulator recommends that organisations avoid putting personal, especially sensitive, information into public AI products (OAIC guidance).
- Check age eligibility first: Kruthika’s Terms require users to be at least 18, or the higher local age of legal majority. Adult supervision does not override that rule.
What should I check before sharing personal details?
Use this five-step triage before a conversation becomes personal:
- Entry: identify what is required to start, including an account, email address, phone number, social login, identity check, or device permission.
- Recipients: find out whether prompts go to the service operator, an inference provider, a voice or notification vendor, or other processors.
- Memory and access: separate the current session, saved memory, chat history, browser storage, telemetry, and backups.
- Retention and deletion: ask how long each data type remains and whether clearing a thread, clearing browser storage, deleting an account, or contacting support has a different effect.
- Permissions and reporting: enable only the access a feature needs, and learn what information a report creates or retains before you submit one.
This is a user-facing checklist, not a legal test. Privacy obligations and individual rights vary by jurisdiction. The point is to make the service’s data flow understandable before you disclose something you cannot easily take back.
Start with the entry point
Ask why each requested detail is necessary and whether a lower-data option will work. An email address, phone number, social login, and identity check each create a different identity and data-sharing exposure; none is automatically “safe” or “unsafe” in every context. A request deserves more scrutiny when it seems disproportionate to the feature you want to use.
No account is not the same as anonymity. Guest access can reduce the account information tied to a session, while technical telemetry, browser storage, cookies, network information, and third-party processing may still exist. For the difference between guest access and anonymity, see why no-sign-up AI chat is not automatically anonymous.
Read the privacy notice for answers, not slogans
Words such as “private,” “secure,” and “anonymous” are not enough to evaluate a chat service. Look for plain answers to these questions:
- What is collected when you send a prompt, upload an image, use voice, or enable notifications?
- Which model or inference providers receive the prompt, and in which countries may processing occur?
- Are prompts used for public-model training, safety review, analytics, or product improvement?
- How long do chat data, technical logs, consent records, and backups remain?
- Can you view, export, correct, or delete the information, and what happens at the processor or backup layer?
If the answer appears only after several cross-references, treat that as a practical warning sign for a reader: pause and verify the details before sharing more. It is not proof that the service is mishandling data.
What Kruthika’s policy says, checked 20 October 2026
Kruthika’s Privacy Policy says chat text is transmitted over TLS 1.3 to an AI inference provider to generate a reply. It says those providers process prompts for response generation and do not use them to train their public models. The active provider cascade is configurable and may change, so the policy’s current processor table matters more than this snapshot.
Advertisement
The same policy says conversation continuity and memory remain in the browser’s local storage rather than a readable user database. It also describes technical telemetry, including a truncated or anonymised IP address, device and browser information, referring page, visited paths, and response latency. Raw technical logs are described as being purged on a rolling 90-day schedule; backups use a rolling 14-day window. Processors may operate in the United States, European Union, and India. These are service-specific statements, not a general promise about AI companions. Re-check the live policy before a sensitive conversation because providers, settings, and retention practices can change.
Separate memory, history, logs, and deletion
“Delete my chat” can describe several different actions. A service may keep context only for the current session, save selected details as local memory, store a visible history, retain technical logs, or maintain backups. Products differ, and a single control may not cover every layer.
For Kruthika, the policy says local chat memory stays on the device until you use “Clear Chat” or wipe browser storage. It also provides a route to request access or erasure of residual telemetry. That does not turn every deletion action into a universal guarantee: the policy’s retention windows and processor arrangements still matter. For the deeper questions about saved details and deletion semantics, read the AI companion memory and deletion guide.
A blank visible thread is not proof that every related record has disappeared. Before entering a sensitive detail, find out what the service says about local storage, server logs, backups, inference providers, and derived or aggregated information. The OAIC warns organisations that once personal information is entered into a generative AI system, it can be very difficult to track or control and potentially impossible to remove. That guidance is written for organisations under Australian privacy law, but it is a useful reason for individual users to minimise disclosure too.
Check permissions and reporting controls
Text chat does not need the same access as voice notes, image analysis, contacts, or location-aware features. Decline access that is not necessary for the feature you want, then revisit the setting only after you understand the benefit. On many browsers and phones, permissions can be changed later in site or device settings, but the route varies and changing a permission cannot undo data already collected.
Useful controls include viewing or exporting data, correcting it, turning memory off where offered, clearing local history, deleting an account or session, changing notification permissions, and reporting unsafe output. Before reporting, preserve only what is needed to explain the issue: the date, prompt, output, and a session or account reference if one exists. A report may itself be retained for safety or abuse review; reporting is not the same as deleting the underlying data.
The NIST Privacy Framework is a voluntary tool for organisations to identify and manage privacy risk. It does not certify a product or prove that a user control works. It is still a useful lens: a provider should be able to explain what it collects, why it needs it, who handles it, and how a user can exercise available controls.
Keep sensitive information out of the prompt
Do not use a companion chat for passwords, one-time passcodes, bank or card details, government-ID numbers, private documents, account-recovery answers, or confidential information about another person. Health information, intimate material, precise location, and identifying details about children also deserve particular caution. These examples are high-risk in practical terms; their legal classification varies by jurisdiction.
The FTC has told AI companies that privacy and confidentiality promises still matter when people provide sensitive or confidential information. The OAIC’s guidance is directed at organisations, and it recommends not entering personal information, particularly sensitive information, into publicly available AI chatbots as a matter of best practice. Neither source guarantees that a consumer can remove a disclosure later. The safer decision is to leave the detail out unless the service’s purpose, recipients, retention, and deletion route are clear.
Use a low-stakes test first
Before disclosing anything personal, try a neutral prompt such as: “Give me three ideas for a weekend activity in my city.” Then inspect the policy, memory setting, permission requests, and clear-data route. This test does not prove confidentiality; it gives you a chance to learn how the interface behaves before the stakes rise.
Do not confuse a warm or responsive tone with human confidentiality. A 2026 arXiv preprint analysed 2,909 privacy-related posts from 79 AI-companion subreddits collected between 7 November 2024 and 7 November 2025. The authors describe concerns becoming salient at different stages, including disproportionate entry requirements, more sensitive intimate use, uncertainty about data practices, and difficulty regaining control during exit. It is a qualitative study of public Reddit discourse, not a population survey, technical audit, or causal finding about every companion service. Read the preprint and its methods.
Check age eligibility before use
Kruthika’s Terms require users to be at least 18, or the higher age of legal majority in their jurisdiction. A minor should not use the service merely because a parent or guardian is nearby. If you are comparing services for a younger person, start with the provider’s minimum-age rule and the youth-specific guidance in AI companion safety for teens and families.
Australia’s eSafety Commissioner’s October 2025 findings cover notices sent to four named providers: Chai, Character.AI, Chub AI, and Nomi. The notices concerned their practices during the reporting period from 1 July to 30 September 2025. eSafety discussed age assurance, reporting, prompt handling, and output safeguards, but it also said the notices were not a comparative compliance ranking and that it did not technically verify providers’ responses. Use the report as a scoped regulatory snapshot, not as evidence about every AI companion. See eSafety’s scope and findings.
If the conversation touches health or immediate danger
An AI companion is not a doctor, therapist, emergency service, or crisis responder. Kruthika’s Terms say its outputs may be inaccurate and are not professional advice. Do not share a medical record or crisis details merely to get a more personal-sounding reply. If someone faces immediate danger, contact local emergency services or a crisis service in their country, and involve a trusted person who can provide real-world help. A provider’s reporting button is not a substitute for urgent care.
Visible FAQ
What information should I avoid sharing with an AI companion?
Avoid passwords, one-time codes, bank or card details, government IDs, private documents, and confidential information about other people.
Does no sign-up mean an AI companion is anonymous?
No. Guest access may reduce account information, but it does not by itself explain technical data collection, retention, or third-party processing. Read the current privacy information.
What to do before you share
Use the service only after you can answer five concrete questions: who receives the prompt, what is saved locally or remotely, how long each layer remains, which permissions are active, and what deletion removes. If the answer is unclear, keep the conversation general or compare another provider using a privacy, memory, and control checklist. Reading a policy cannot guarantee confidentiality. It can, however, show you where the uncertainty is before you add personal details.
Sources and further reading
- Kruthika.fun Privacy Policy (service-specific data flow and retention; checked 20 October 2026).
- FTC: AI Companies: Uphold Your Privacy and Confidentiality Commitments.
- OAIC: Guidance on privacy and the use of commercially available AI products (organisational guidance).
- NIST Privacy Framework (voluntary organisational risk-management framework).
- eSafety Commissioner: Findings from transparency notices on AI companion apps (four providers; 2025 reporting period).
- Tracing Users’ Privacy Concerns Across the Lifecycle of a Romantic AI Chatbot Experience (2026 qualitative preprint; Reddit discourse, not a platform audit).
