How do AI apps handle voice and media privacy in 2026?

Affiliate disclosure: Dating Auditors may earn a commission if you join Candy AI, Muah AI, or DreamGF through links on this page. The retention, training, and license statements below come from those operators’ public pages and apply regardless of that relationship.

Evidence used

Checked 31 August 2026. These are operator statements, not a lab of audio paths, face models, or backup wipes. We did not test “four platforms,” and we do not claim an encrypted audio path, a short-lived DreamGF face map, or a process-then-discard architecture.

• Muah General FAQ — posted 18 December 2023, last marked updated 17 August 2026. Player data is stored in the cloud and used for service improvement and AI training. Communications are described as encrypted and stored on a cloud host (that is not a public E2EE proof). restart123 archives memory; archived material can reappear. User-uploaded photos and videos are stated to self-wipe every 7–30 days; generated photos “every few weeks.” Account deletion is at the bottom of companion settings. Ultra VIP / Early Access real-time calls require pairing a phone number. No native iOS/Android app; operator says store listings that impersonate Muah are scam/phishing; an Android APK is linked from the FAQ.
• Muah Privacy Policy (effective 17 May 2022) — may collect name, email, phone number, IP, device, and activity logs; may share with service providers. No numbered media-retention schedule.
• Candy Privacy Notice (revised 30 July 2026) — Content includes prompts, outputs, and calls; Voice call is a listed processing purpose; Personal Data is defined to include photos. Third-party LLM/hosters may receive chatbot messages. Account data generally retained three years after last activity unless deletion is requested.
• Candy help: What can I do with tokens? — tokens cover image generation, listening to a voice message, and Voice Calls (beta).
• DreamGF Privacy Policy — login profile can include a picture; Google/Patreon signup can pass a profile photo; processes comments, generated content, chats, and voice messages; names DigitalOcean as a storage provider; chat review if you report a support problem; retention “as long as necessary,” then delete or anonymize (including for research or statistical purposes). No numbered upload-wipe window.
• DreamGF Terms — User Content (text or other media you upload) is licensed to DreamAI on a non-exclusive, royalty-free, worldwide, perpetual, and irrevocable basis for operating the site. Content made to resemble real individuals may be deleted.

Chat-log comparison (Candy vs Muah, without the voice/upload job): AI chatbots that don’t save logs. Product review of Muah’s in-chat flow is a separate URL: Muah AI multimodal review.

Why this is riskier than text

Editorial inference, not a lab measurement: a nickname and a prompt are easy to stop reusing. A face stills set and a voice sample are identifying in a way you cannot rotate. Hosted products that accept those inputs also tend to keep account data, not just the file you meant as a one-off.

Input	What you hand over	What the documents on this page actually cover
Face / photo upload	Likeness tied to an adult account	Muah states a 7–30 day wipe for user-uploaded photos/videos. DreamGF has no such number and takes a perpetual User Content license. Candy lists photos as Personal Data; a sourced selfie-lock feature is unknown here
Microphone / calls	Timbre plus whatever you say	Candy documents Voice Calls (beta) and processes calls as Content. Muah documents phone-number pairing for real-time calls. DreamGF lists voice messages. None of those pages prove a first-party “encrypted audio path”
Generated media	Outputs the operator can store or train on	Muah states generated photos are cleared “every few weeks.” Candy and DreamGF do not publish an equivalent media-only clock

Assume retain-until-the-operator-writes-otherwise. Marketing “encrypted” or “private” copy does not override the legal/FAQ pages.

What to look for in the policy — not a claimed architecture

This is a buyer checklist, not a description of any partner’s internals:

1. A numbered retention window for your uploads, not only “as long as necessary.”
2. Whether training, QA, or a perpetual content license covers those files.
3. Whether a call feature asks for a phone number.
4. Whether Delete Account is documented, and what it does not cover.

If the vendor cannot answer those in public text, do not feed it a government-ID-quality photo or a live mic.

What the operators actually document

Platform	Voice	Face / upload	Material limit	Fit
Candy AI	Voice notes and Voice Calls (beta) are token features; privacy lists Voice call / calls as Content	Photos appear in the Personal Data definition. No sourced 7–30 day media wipe	Multi-year account retention unless you request deletion; third-party model/hosters may see messages	Primary if you stay in text and skip the mic
Muah AI	Real-time calls on Ultra VIP / Early Access after pairing a phone number	Operator-stated 7–30 day wipe for user-uploaded photos/videos; generated photos “every few weeks”	Training use and archived memory disclosed. Encryption is described as stored-on-cloud. Privacy policy (May 2022) has no media schedule	Only when voice or in-chat media is the job
DreamGF	Voice messages listed in the privacy policy	Registration picture; Google/Patreon can pass a profile photo; perpetual User Content license	Retention “as long as necessary”; hoster DigitalOcean named; no short-lived LoRA/face-map claim found	Visual builder. Not a privacy pick
Local / offline tool	You keep the files	You keep the files	More setup; no current Dating Auditors partner	Hard stop on cloud biometrics

We are not publishing a generic-TTS row. Cheap public voice APIs often log; that is not a sourced census on this page.

If you can skip the mic and the selfie: Candy AI

Choose Candy when the product you actually want is hosted adult text, memory, and optional generated companion images — not a recording of you. Confirm Delete Account under Danger Zone before you load sensitive material. Do not treat Candy as zero-log or E2EE; those conflicts are already on the Candy safety page.

Do not choose Candy to become unidentifiable, or if you will use Voice Calls (beta) while claiming this page said Candy is text-only. Voice on Candy is still Candy Content.

CTA: Open Candy AI — stay in text if biometrics are the concern

If voice or in-chat media is the job: Muah AI

Muah is the partner that documents in-thread photos and voice as the product. The FAQ’s 7–30 day upload wipe is useful as an operator claim. It is not a lab result, not a full-account clock, and it sits next to training use and archived memory. Ultra VIP calls that require pairing your phone number are an identity step, not a privacy feature. Prefer the website; the FAQ says store apps impersonating Muah are scams.

Do not choose Muah as the privacy-first chat. For logs without the multimodal job, Candy remains the documented hosted default.

CTA: Open Muah AI — voice/media with the FAQ limits

DreamGF is the visual job, not the privacy alternate

Use DreamGF when mix-and-match stills are the reason to pay. Do not upload a real person’s face without a lawful basis and their consent. The previous version of this page called DreamGF a short-lived face map / LoRA lock. That architecture is not in the privacy policy or terms we retrieved. Token metering belongs on SoulGen alternatives. Identity-mapping vs local tools: cloud identity mapping — that URL is not a deepfake how-to.

---

Candy AI if you can stay in text — Muah only when voice/media is the job