Think about what is inside one of these accounts after six months: conversations more candid than anything in your email, generated images, a payment method, and an email address that links it to the rest of your life.
Now consider that the operator is usually a small company with a small engineering team and no regulator looking over its shoulder. That gap — high value, ordinary protection — is the whole of the problem.
What these apps typically do not do
Not universally, but commonly enough to assume unless you have checked:
- No two-factor authentication. A password is the only thing between an account and whoever has your email.
- No session list. You cannot see where you are logged in, and cannot revoke a session you do not recognise.
- No login alerts. A sign-in from a new device passes silently.
- Thin account recovery, which cuts both ways: hard for you when you are locked out, easy for someone impersonating you to a support agent.
- Long-lived sessions, so a device you stopped using may still be logged in months later.
Where an app does offer 2FA and a session list, that is worth noticing. It usually indicates a team that has thought about the rest too.
The four things that matter
1. A unique password, from a manager
Obvious and still the whole ballgame. The realistic threat is not someone attacking this app — it is credential stuffing, where a password leaked from an unrelated breach is tried here.
A password manager makes this free. Anything reused is one unrelated breach away from being someone else's.
2. A dedicated email address
This does two things at once. It stops the account being findable from your main identity, and it means a compromise of one does not lead to the other.
Use a real mailbox you control rather than a disposable address — you need to be able to receive a password reset in a year. Aliasing services, or a second mailbox from your provider, both work.
The same address should receive the billing receipts, per payment privacy.
3. Turn on 2FA where it exists
If the app offers it, use it, and prefer an authenticator app to SMS. Where it does not exist, protect the email account with 2FA instead — that is the recovery path, and securing it covers every app that can email you a reset link.
This is the highest-value move available when the app itself offers you nothing.
4. Log out of devices you are done with
Especially anything shared or borrowed. If the app has no session list, changing the password is the blunt instrument that invalidates other sessions in most implementations.
The threat that is not technical
Worth naming plainly, because it is the one that does real damage in this category: someone with access to your unlocked device.
No password policy addresses this. The relevant work is on the device side — separate browser profiles, notification previews off, downloads out of synced folders — and it is covered in using an AI companion on a shared device.
If an app is breached
It happens, and the playbook is the same every time:
- Change the password immediately, and anywhere you reused it.
- Watch the email address for password resets you did not request.
- Check the payment method and consider replacing the card number.
- Decide whether to stay. A breach handled with a clear notice and a real timeline is a different signal from one disclosed by journalists three months later.
Read what the operator actually says. Vagueness about scope — which is to say, whether conversations were included — is itself an answer.
Before you subscribe
Two minutes in the settings before you pay tells you more about an operator's engineering than any marketing page:
- Is there 2FA?
- Is there a session list?
- Is there a self-service delete, or only a support address?
Apps built for years of accumulated history — Nomi, Replika — are the ones where this compounds most, simply because they are the ones that will be holding the most about you. What that material consists of is in what your app knows about you, and how to get rid of it is in deleting an account.
