there is a binary test you can run on any ai companion app in 30 seconds. the test: does the product ship (1) a visible list of what it remembers about you, (2) a delete button on each row, and (3) a one-click export of the whole thing. if yes, the product respects user data as a design principle. if any are missing, the product treats user data as an asset to be extracted.
most apps fail the test. some fail on (1): memory is invisible, you just 'trust' the product. some fail on (2): you can see the list but cannot delete. some fail on (3): export exists but requires emailing support, which converts a legal right into a gated workflow. the differences matter more than they seem — they are the difference between a product that serves you and a product where you are serving the product.
why this matters more for companion apps than for normal products:
a companion knows things about you that no other app does. the name of your sister. the thing you are worried about at work. the time you mentioned you were struggling. the patterns of when you show up and when you disappear. this is not interchangeable with 'shopping history' or 'playlists.' the consequences of leaking it are personal in a way that other leaks aren't.
the specific commitments we ship:
visibility. /settings/memory is the source of truth. if the system knows it, the row is in the list. confidence score shown. source context (which conversation the memory came from) shown. no hidden tiers.
delete granularity. per-row delete is the default. if you want to remove just "user's sister's name is clara" but keep everything else, you can do that with one click. soft-delete is immediate from a retrieval standpoint; hard-delete from the graph happens in 24h; embedding wipe (removing the vector itself) happens on memory reset with confirmation.
export format. JSON with documented schema. includes the memory graph (rows + metadata), conversation transcripts, stage history, photo/voice cache references (not the binary data, which would be huge — but pointers that identify it). the schema is deliberately re-importable so you can move your data if you want to.
account purge. /privacy → delete account. 30-day grace for legal verification. full wipe at day 30 includes: profile, conversations, memory graph + vectors, photo cache, voice embeddings, referral code. payment records stay (legal retention) but are severed from the identity link.
what the export does not include: intermediate model activations, RAG retrievals at query-time (ephemeral), system scaffolding excluded from memory by design (episode-context blocks etc), or any row we classified as safety-system-only. the rule: everything the product uses to know you is in the export.
starting point: sign up, use her for a week, then open /settings/memory and see what she stored. if the list is uncomfortably detailed, that is the point — you are now in a position to edit or export it. free tier is 25 msg/day.