Is Chai AI Safe in 2026? Privacy, Data & What to Watch For

Chai AI is a mobile-first AI chat platform built by Chai Discovery, a UK-based startup that launched in 2021. By 2026 it has over 5 million users, more than 500,000 community-created characters, $70 million in annual revenue, and a $1.4 billion valuation trajectory. It's one of the fastest-growing AI companion platforms by revenue, and it's also one of the more complicated when it comes to safety.

The complications come from a few places: the platform's open character creation system means moderation is reactive rather than proactive, the 17+ rating with self-reported age verification has obvious gaps, and the data practices are documented but not particularly user-friendly. Let's break it down honestly.

A British company storing American data for five years

Chai Discovery is registered in the UK, which means the platform is subject to UK GDPR and the Data Protection Act 2018. That's actually a reasonable regulatory baseline. UK data protection law gives users meaningful rights including the right to access, the right to deletion, and the right to know what's being collected.

The complication: while the company is UK-based, the privacy policy discloses that user data is stored on servers in the United States. This is a normal arrangement for cloud-based services, but it has practical consequences. US data is potentially accessible under Section 702 of FISA and other legal frameworks that don't apply to UK-stored data. The retention period documented in the privacy policy is up to five years, even after account deletion.

For most users, this is academic. Your AI roleplay conversations aren't likely to attract government attention. But for users in jurisdictions where the content of those conversations could create real legal exposure, the data location matters. The Electronic Frontier Foundation has extensive resources on understanding data jurisdiction and threat modeling that are worth reading if this matters to you.

The 70-message free tier with a 2.5-hour catch

Chai's free tier advertises 70 messages per day, which sounds reasonable until you read the fine print. The actual limit is 70 messages per 2.5 hours, on a rolling basis. Hit the limit mid-conversation and you wait. Most users describe this as more frustrating than the message count alone would suggest because the cap arrives just as you're getting into a good roleplay flow.

Chai Premium at $13.99/month removes the message cap and unlocks better AI models. Chai Ultra at $29.99/month adds further model upgrades and exclusive characters. The pricing is on the higher end for what you get compared to alternatives. Character AI Plus at $9.99/month is cheaper and includes voice. CrushOn AI starts at $4.99/month with similar content freedom. The Chai premium isn't unreasonable for the mobile experience the platform delivers, but it's not the cheapest option in the category either.

For users on the free tier, the data practices include a meaningful trade: your conversations contribute to model training. The privacy policy is explicit about this and there's no opt-out while continuing to use the service. Free users are paying with data rather than money. That's a fair trade if you understand it. It's a problem if you don't.

The character library is the platform's killer feature and biggest moderation gap

Chai's 500,000+ community-created characters are genuinely impressive in scale. You can find characters for any niche imaginable, from celebrity simulations to original anime characters to custom-built personalities. The platform's discovery feed surfaces popular characters effectively, and the rating system helps quality rise.

The catch: when anyone can create characters, moderation is necessarily reactive. Characters violating policy get removed after they're reported, not before they're published. This means problematic characters can exist on the platform until enough users flag them. The BBC has reported on cases where AI chatbots, across multiple platforms including Chai, produced harmful responses including encouragement of self-harm. Chai has implemented real-time suicide detection classifiers since 2023, which is a meaningful improvement, but the underlying moderation challenge of user-generated content at scale remains.

For adult users browsing characters they're explicitly choosing, this is manageable. For minors gaining access through weak age verification, it's more concerning. The rating system surfaces the popular characters, which often skew adult, which creates discoverability paths that age verification doesn't gate effectively.

The age check that does almost nothing

Chai is rated 17+ on the Apple App Store and requires age verification at signup. The verification is a date input. Type a birth date that makes you appear 17+ and you're in. There's no document verification, no biometric check, and until recently no real identity confirmation at all.

In March 2026, Chai began rolling out Apple Age Verification API integration on iOS. This is a meaningful improvement because Apple's age verification ties to App Store account-level identity rather than just user input. Users on Apple devices with verified ages get appropriate content restrictions. Users on Android, web, or with unverified Apple accounts still go through self-reported verification.

For parents wondering whether Chai is safe for teenagers, the answer in 2026 is more nuanced than it would have been in 2024. The platform has improved age verification, content filtering, and crisis response. It still isn't designed for or appropriate for users under 17, and a determined teenager can still access it. The Common Sense Media reviews of AI companion platforms generally apply: these tools are designed for adults, and teen use carries real risks regardless of platform-level safety measures.

What the platform does and doesn't encrypt

Chai uses standard SSL/TLS encryption for messages in transit. The conversations are protected from interception between your device and Chai's servers. Once they arrive, they're stored without end-to-end encryption, which means platform employees with sufficient permissions could technically access conversation content during debugging, abuse review, or law enforcement compliance.

The lack of end-to-end encryption is industry-standard for AI companion platforms (none currently offer it), but it's worth knowing. Your conversations are in Chai's custody, not yours. The Mozilla Foundation's Privacy Not Included project hasn't reviewed Chai specifically as of early 2026, but their reviews of similar platforms consistently flag this as a concern.

For users who want truly private AI conversations, self-hosted setups running local models are the only real answer. The conversations never leave your hardware, and the privacy is total because there's no third party involved.

What you should actually do if you're using Chai

The standard NSFW AI privacy practices apply here:

Use a dedicated email when registering. ProtonMail and similar privacy-focused providers offer free accounts that aren't tied to your primary identity.

Use a pseudonym. Chai doesn't require real identity. The username and any persona details you create can be entirely fictional.

Don't share genuinely identifying information in conversations. The AI doesn't need your real name, address, workplace, or other personal details for any creative purpose.

Skip the social media login if it's offered. Connecting Chai to your Facebook, Google, or Apple account creates a direct identity link that email-only signup avoids.

Review the privacy policy before signing up if data practices matter to you. The document is more readable than most.

If you're a parent monitoring teen device usage, parental control resources like Google Family Link and Apple Screen Time can restrict app access. The ConnectSafely guide to AI chatbots is a useful reference for ongoing conversations with teenagers about AI use.

The honest verdict

Chai AI is reasonably safe for adult users who understand the privacy trade-offs and use basic precautions. The platform is a legitimate UK-registered company with documented practices, real revenue, and meaningful improvements in age verification and content moderation since 2024. The risks are the standard AI companion platform risks rather than anything unusual.

It's not safe for minors despite the 17+ rating, and the emotional engagement design that makes Chai effective also makes it risky for users prone to dependency. The 70-messages-per-2.5-hours free tier limit is annoying enough that heavy users will end up paying or migrating to alternatives. The data location and retention policies are documented but not particularly user-friendly.

For casual creative use by adults who treat their conversations as fiction rather than confession, Chai is fine. For anyone whose threat model includes "what if my conversations leaked," the architecture itself is the limitation, and running your own model locally is the only complete answer to that question.