Replika

Is Replika safe?

Replika is not dangerous to use in the way a scam app is, but it asks for an unusual amount of trust and gives back less protection than it should. People tell their Replika about their loneliness, health and sex lives, and those conversations sit on Luka's servers and pass through third-party AI models. As far as we could find, the account protecting them has only a password: Replika's help pages suggest a unique password and a PIN lock, which is available on iPhone only, and mention no two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login.

We score Replika 43/100, slightly below Character.AI at 45. The regulatory record is the clearest problem. Italy's data protection authority, the Garante, blocked the app in 2023 and fined its maker €5 million in 2025.

What Italy found

The Garante acted after press tests showed the chatbot giving minors replies unsuited to their age, with no block even when a user said they were underage. In February 2023 it ordered Luka to stop processing Italian users' data. Its final decision, dated 10 April 2025 and summarised by the European Data Protection Board, confirmed the problems. Until 2 February 2023 Luka had no legal basis for processing users' data, its privacy policy was inadequate in several respects, and it had no age verification at sign-up or during use, even though it said minors were excluded.

The fine was €5 million. The decision also says technical checks showed that the age verification Replika uses now "continues to be deficient in several respects". The Garante kept open a separate inquiry into the legal basis for the data used across the life of Replika's AI system, which could lead to further action.

Who reads your Replika conversations?

Replika's privacy policy, updated in May 2026, is clearer than many. It says conversations are sent to third-party AI language model providers, after de-identification and data minimisation, only to generate replies, and that those providers may not train their own models on them. Replika says it never uses conversation content for marketing or advertising. It does keep small anonymised portions to train its own safety systems and improve the chatbot.

The policy tells users not to share health, sexual or religious details, then admits that conversations with a companion "may lead you to incidentally share such information". That is the point of the product. In the EU, UK and some US states, carrying on after seeing the notice counts as explicit consent to process those details.

Advertising sits around the conversations rather than in them. Apple's privacy label shows user ID, device ID, product interaction and advertising data used to track you across other companies' apps. The label does not list messages or other user content at all, which understates what the app handles.

Emotional dependence and the FTC complaint

Replika is designed to feel like a friend or partner, and that is where most of the criticism lies. In January 2025 the Tech Justice Law Project, Young People's Alliance and Encode filed a complaint asking the US Federal Trade Commission to investigate Luka. They allege that Replika's ads promise therapeutic benefits without clinical evidence, use testimonials from people who do not exist, and that the app's human-like design deceives users "into developing unhealthy attachments". These are allegations. We found no FTC case or order against Luka.

The Garante's description of the service makes the same point in neutral terms: users create a virtual companion that can act as a confidant, therapist, romantic partner or mentor. For someone isolated or in a mental health crisis, that is a different risk from spam or scams, and no privacy setting fixes it. Replika is not a therapy service.

How to use Replika more safely

1. Use a long password that you use nowhere else, and keep the email account linked to Replika secure.
2. On iPhone, turn on the PIN lock in Replika's settings.
3. Leave out names, addresses, health details and anything about other people. Use the Memory section to delete facts you regret sharing.
4. Refuse the tracking prompt on iPhone, or reset your advertising ID on Android.
5. If chatting starts to replace sleep, work or people, take a break and talk to someone you trust. In a crisis, call a local helpline, not an app.
6. Cancel any subscription through the App Store or Google Play before deleting your account, since deleting does not stop billing.

How we scored it

User control (55) is Replika's best factor: in-app deletion and editable memories, held back because chat history can only be deleted with the whole account. Privacy (38), security (45) and the regulatory record (40) are weak: intimate chats sent to outside AI providers, no two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login and a €5 million GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary fine. For a general assistant with stronger account security, compare ChatGPT.