Is Secrets AI Safe? (2026 Review)

The short answer

Secrets AI is mostly safe, last checked against its privacy policy, terms and wiki on 3 November 2026. It has no public breach history, its payment processing looks standard, and roughly two years of operation have produced no reported incidents. What separates it from a text-only companion app is generated video, which Secrets stores server-side and which reveals more than text or even static images. A compromise at Secrets would expose video prompts and outputs. That gives the basic hygiene advice a little more weight than usual.

What data does Secrets AI collect?

You need an email to join, and a phone number is optional. During use, Secrets stores your full chat history, character customizations, generated images, generated videos, and payment metadata.

The platform also logs IP, browser, session duration and referrer, which any SaaS product does, AI companion or otherwise.

No identity verification, KYC or ID upload is involved, and you can’t upload images of your own at all: the privacy policy says all media on Secrets is generated by the platform. Secrets essentially holds your email, payment descriptor, chat content and whatever media you’ve generated, and that media is what sets it apart from text-only competitors.

Who owns the company?

Secrets AI launched in 2024. The site names the operator as Secret Labs Inc., 8 The Green, Dover, Delaware. A Delaware address is common for startups and says little about where the team or servers are. The privacy policy does name Secret Labs as the data controller for users in the EEA and UK under the GDPR, with Standard Contractual Clauses for transfers out of the EEA. Named leadership and ownership details are still hard to find from the outside.

The policy also spells out deletion: your personal details and chat history are deleted immediately when you delete your account, transaction records are kept for 7 years for tax purposes, and security logs for up to 12 months.

Has Secrets AI had a breach or incident?

No. Through November 2026 Secrets AI has no public breach, no HaveIBeenPwned entry, no credential dump traced to it and no regulatory action. The record is clean, though a clean record can’t prove there was never a breach. Not every incident gets disclosed, and early-stage companies sometimes lack the process maturity to detect one quickly.

Muah.ai’s major breach in October 2024 is the cautionary tale. It leaked generated image prompts tied to user emails (full details in our Muah breach writeup), and it’s the case to remember when you weigh what server-side storage at an AI companion platform can cost you.

Payment safety

A mainstream payment processor handles card payments, so your card details don’t touch Secrets’ own infrastructure directly. It’s the usual SaaS payment architecture, and you won’t find a much safer way to pay by card online.

Charges show as “S LABS INC.” on your card statement, for subscriptions and Moments alike. If you share statements with anyone who might Google unfamiliar line items, pay with a virtual card from Revolut or Privacy.com so the descriptor sits on a throwaway card. Secrets also accepts more than 300 cryptocurrencies (minimum $20), which keeps the charge off your card statement altogether, but crypto payments are never refunded.

Content on your device vs on their servers

Here Secrets’ privacy calculus departs from text-only AI companion apps.

Secrets keeps chats, custom characters, generated images and, most importantly, generated videos on its servers. Its homepage says conversations are “protected with end-to-end encryption”. The privacy policy describes something more ordinary: AES-256 encryption at rest and TLS in transit, with Secrets holding the keys, and it lists training and improving its AI models among the uses of your information. Plan as if the server can read your content. Audio calls are the exception the policy calls out: the audio is transcribed and deleted immediately, and only the text is kept. Video is more sensitive than text for a few reasons: the data itself is larger, the content is easier to identify if leaked, and once a specific prompt is linked to a specific output, that link is hard to obscure after the fact.

Candy.ai keeps generated images server-side, already more than a text-only app stores, and Secrets adds generated video. For your threat model, picture a breach dump with video files linked to email addresses. That’s the exposure profile here.

The UI lets you delete content, and deleting the account removes your chat history and personal details immediately, per the privacy policy. It doesn’t say how quickly generated files leave backups and CDN caches, so assume they linger for a while.

Can anyone see what you’ve done?

Not unless you choose to show them. The account is password-protected and chats are private. Secrets does have optional public profiles at /u/your-username, where other users can see the characters, images and videos you make public and follow you, so check what’s switched on before you share anything there.

A future breach is the risk that matters. A Secrets leak would likely tie your email address to your chat prompts, generated images and generated videos, a bigger footprint than any text-only app leaves. That’s why the alias-email and virtual-card advice carries more weight here than for a chat-only product.

How to minimize your exposure

• Make the account on a dedicated email alias (SimpleLogin, Apple Hide My Email, Firefox Relay). Your main Gmail is the wrong address for this
• Run payments through a virtual card (Revolut, Privacy.com) so a throwaway carries the merchant descriptor
• Protect the account with a strong password that’s unique to it. Credential stuffing is the most likely downstream attack if the platform ever leaks
• No photos of yourself or people you know, even to test features
• Keep your public profile off, or check what it shows, before you publish characters or media.

Is Secrets AI safer than similar apps?

Secrets is roughly comparable to Candy.ai and other reputable 2023-2024 launches on the core safety axes. It has no breach history, uses mainstream payment and protects accounts with passwords, and its social features are opt-in. Storing video makes it a shade more sensitive. Video is new territory for companion apps, and it changes the calculus slightly from text-and-image apps.

Each of them is comfortably safer than Muah.ai, which has a breach on its record. If you’re choosing between Secrets, Candy, and a known-breached product, the first two are the obvious picks.

Our verdict

Secrets AI is mostly safe. Clean breach record, standard payment stack, no identity verification requirements, a clear deletion policy, and a product that behaves like a legitimate commercial operation. The caveats are server-side video storage and an end-to-end encryption claim its own privacy policy doesn’t back up. Video reveals more than text or images alone, so the basic hygiene advice (alias email, virtual card, a private profile) counts for more here.

If server-side storage of the media you generate doesn’t bother you, Secrets is a reasonable pick. Anyone it does bother will have to look beyond commercial AI companions to a locally-hosted open-source model.