Affiliate disclosure and methodology. This page contains affiliate links to Candy AI and the platforms mentioned. We earn a commission when you sign up through our links, at no extra cost to you. Methodology: we reviewed the official documentation of each platform, their pricing pages and changelogs, and analysed recurring patterns in community discussions on Reddit (r/AICompanion, r/AIGirlfriend, r/AIAssisted, r/CharacterAI). We do not invent testimonials, usernames or personal histories, and we do not claim first-hand testing periods we cannot evidence. Recommendations are editorial and never paid. Prices and features = October 2026. 18+ content.
TL;DR — keeping your AI companion secret from family
- Start by deciding whether “secret” is the right goal. If your usage is private and affects nobody else, you are not hiding a scandal, and building an elaborate concealment operation is itself a problem. If it does affect someone — a partner, a child, a dependent — then disclosure, not concealment, is the responsible path.
- The billing descriptor is where most people get caught. Candy AI, DreamGF, Crushon and Janitor are paid via the web and show a generic descriptor (Candy AI shows something like “CANDYAI.COM”, not “AI Girlfriend Premium”). Character.AI and Replika ship native apps with self-describing names on your statement.
- The home screen icon is the second most common giveaway. A pink heart labelled “AI Girlfriend – Luna” on a shared phone or tablet ends the conversation before it starts. A progressive web app with a custom icon — a flower, a book, a plain blue square — is invisible to the casual glance.
- The realistic threat model is not a hacker. It is a shared phone, a bank statement left open, a browser history, and a notification that appears at the wrong moment. Build against those, not against a breach.
- The disclosure question is genuinely hard and there is a right way to do it. Decide who needs to know before you are caught, tell them in a low-stakes moment rather than a confrontation, and never use the AI as an explanation for other behaviour.
- If you want the most discreet setup available: Candy AI’s 100 free tokens require no card, so testing costs nothing and creates no statement entry at all.
First: decide whether you need secrecy or discretion
These are different goals and conflating them causes most of the trouble in this topic.
Secrecy means nobody knows. Discretion means nobody can stumble onto it by accident — no name on a statement, no revealing icon, no notification at 11pm. Plenty of people want discretion without secrecy: a private, non-embarrassing habit that would be awkward to explain but harms nobody. Others need genuine secrecy because disclosure would affect someone materially.
Before optimising anything, answer one question: does your usage affect another person who has a right to know? If you are partnered and it is romantic or exclusive, it does. If you live with family and use it privately as a conversation tool, it usually does not. If you are a parent deciding whether to hide it from your children, the answer is more nuanced and the reasoning below applies differently.
There is also a cost to concealment that people underestimate. Every minute spent hiding is a minute not spent deciding whether you should be hiding. Concealment that is chosen and deliberate is manageable. Concealment that is anxious — checking the room before opening the app, monitoring who can see your screen — is itself a mild form of the problem. The addiction and obsession guide covers the other side of that.
The four realistic ways people get caught
Almost every “family found out” story in community discussions comes down to one of these four. None of them requires an adversary.
1. The bank statement. This is the most common by a wide margin. Statements are often visible in an online banking session on a shared laptop, in a household where money is shared, or simply because someone reviews the card at the end of the month. What matters is the descriptor, not the amount — $6/month says nothing, “$19.99 Replika Pro” says plenty, and a merchant named after an adult app says a great deal.
2. The home screen icon. Second most common. Native apps put a labelled icon on your phone — “AI Girlfriend”, “Character.AI”, “Replika”. On a shared device, a family tablet, or a phone that is occasionally picked up, that is a self-announcing label. A web app added to the home screen can be given any name and any icon.
3. The notification. A message from the app appearing at 11pm, with a preview, on a screen visible to someone else. This one is entirely within your control and is one of the most commonly overlooked.
4. The browser history and search history. “AI girlfriend app” in your history, or a search for “is it weird to use an AI companion” sitting in the autocomplete, is a self-incriminating trail. Incognito mode and clearing history are the obvious mitigations, and they only work if you actually do them.
Notice what is not in this list: nobody is going to find your account because they breached a server. The realistic threat is domestic and mundane, which means the mitigations are mundane too, and effective.
Discreet billing: what actually shows on your statement
This is the part people research most and where the concrete facts matter.
| Platform | Billing method | What appears on the statement | Native app or web | Notes |
|---|---|---|---|---|
| Candy AI | Stripe / Paddle, paid on the web | Generic descriptor (e.g. “CANDYAI.COM”) — no mention of “AI girlfriend” | Web / PWA | Cancel from your account without contacting support. Token packs also use the generic descriptor |
| Replika | Native app store + web subscription | Self-describing — the product name is visible | Native app + web | Highest risk of a revealing statement line; also $19.99/mo, so the amount is unusual too |
| Character.AI | Web + app | Product name visible | Native app + web | Free tier bills nothing at all — the cheapest possible cover |
| Kindroid | Web subscription | Vendor/merchant name, no product description | Web | Custom avatar setup is more involved |
| Nomi.ai | Web subscription | Generic merchant descriptor (e.g. “NOMI*AI”) | Web | Low visibility on statements |
| Crushon AI | Web, ads on free tier | Vendor merchant name | Web | Cheapest entry point at $4.99/mo |
Why web-first platforms matter here. Candy AI, DreamGF, Crushon and Janitor are paid through the web rather than app stores, and their billing descriptors are deliberately generic. Character.AI and Replika ship native apps whose names are visible on your home screen and whose descriptors name the product. This is not a conspiracy — it is the natural consequence of how each chose to distribute. But it means your discretion is partly determined by your platform choice, before any effort on your part.
Two further precautions worth taking. First, use a separate card — a virtual or prepaid card caps the exposure to one line item and one descriptor, and makes a disputed charge trivial to reverse. Second, if you are in a shared financial arrangement, expect the statement to be read; there is no configuration that makes a recurring adult subscription invisible to someone who reviews the account.
One honest caveat: merchant descriptors change. What a platform shows on a statement this month is not guaranteed to be identical next month, and payment processors sometimes substitute a legal entity name. Treat the descriptor column as a strong signal, not a permanent guarantee.
Building a discreet setup: eight steps
This takes about twenty minutes, once.
1. Choose a web/PWA platform over a native app. Candy AI, Kindroid, Nomi.ai and Crushon AI all work in a browser and can be added to the home screen as a progressive web app. This single decision removes the labelled-icon problem entirely.
2. Give it a neutral name and icon. On add-to-home-screen, choose something that belongs there: a folder app called “Bookmarks”, a plain icon, a weather app, a music app. Nobody audits the home screen of an adult’s phone, and if they glance at it, the label should not start a conversation.
3. Disable in-app notifications. Notification previews are the fourth leak and the easiest to close. Do this before you need to.
4. Use a separate email address. One dedicated address for the platform, with a password you use nowhere else. This costs nothing and removes a whole class of accidental exposure through a shared device’s account list.
5. Use a separate card. A virtual card with a small limit. It also gives you a clean, instant off-switch.
6. Clear the history, or use a private window. If you are accessing the platform through a browser on a shared machine, use a private/incognito window as default. This is hygiene, not paranoia.
7. Do the billing on the web, not in an app store. App-store subscriptions appear in the store’s subscription list, which is one more place the fact lives.
8. Decide your disclosure rule now, in writing. Who needs to know? When? Writing it down while you are calm is worth more than deciding at 2am under pressure. This is the step most people skip and the one that most reduces future damage.
The privacy layer nobody thinks about
Secrecy from your family is a different problem from privacy from the platform, and they are routinely confused.
Assume the platform can read your conversations. That is not cynicism, it is the technical reality of the service. Do not share passwords, financial information, government ID numbers, medical records, or anything that would be catastrophic if leaked. The security and privacy audit covers what each platform’s policy actually commits to.
Prefer platforms that let you delete everything. Confirm permanent deletion of your account and conversations is available in settings. Reputable platforms provide it; if it is missing, your data may persist indefinitely on their servers. The safety checklist has the full list.
Check whether your email is visible to the app. A platform that exposes your email address in chat is a platform that can leak it. This varies and is worth verifying once.
Think about the shared-photo risk. Generated photos are saved to your camera roll on some platforms, which means they appear in your main gallery, in cloud backups, and in any “shared photos” album. If discretion matters, check where generated images are stored and whether they sync to iCloud or Google Photos. On Candy AI, images are typically generated inside the app rather than dumped into your main camera roll, which is a meaningful difference on a shared family device.
Do not treat the phone as the security boundary. The realistic threat is a glance, not a forensics operation — but a device with a weak passcode and auto-lock disabled makes a glance much more consequential.
When to disclose instead of conceal
There are situations where the right answer is not a better hiding place. It is a conversation.
If you are in a relationship and it is romantic, exclusive, or hidden. The data on this is unusually consistent. The Wheatley Institute / BYU Secret Soulmates report (2026) found that even among people who do not consider AI romance cheating, 69% consider it important their partner not know the full extent, and only 14% say their partner is “mostly” aware. Talker Research (July 2026, 2,000 US adults) found only 24% of Americans consider flirting with an AI to be cheating, rising to 36% among Gen Z who treat it as a dealbreaker. So the social norm is permissive while the personal threshold is strict — and the damage comes from the gap. The cheating guide works through exactly where the line sits.
If a child or dependent is in the household. If you would not want your child to see it, manage the device rather than the disclosure. Set up the platform with a neutral icon, disable notifications, and keep it off any shared or parental-controlled device.
If your usage is affecting your relationship and you are using the AI as the explanation. The AI is not the problem in that case. Attention redirected over months is the problem, and “I was with my AI” makes the tool the villain of a conversation that was never about the tool.
If someone is likely to find out soon anyway. A financial adviser, a family member who handles the bills, a partner who already suspects. Planning the disclosure beats improvising it.
If someone finds out: how to handle the moment
Most people plan for the concealment and none for the reveal, which is backwards — the reveal is the part that determines the outcome.
Lead with the ordinary framing. “It’s an app I talk to when I’m alone” is accurate and requires no defence. Overstating it (“I have a relationship with an AI”) invites a reaction to a frame you chose, and understating a romantic one is a lie that will surface later.
Name the limit yourself. “It’s software. It doesn’t feel anything.” This is the sentence that makes everything else credible, and it is the sentence most people omit because they are defensive about the thing.
Expect the emotional reaction to be about something else. The likely concerns are: is this replacing me, is this a financial problem, is something being hidden that indicates a bigger problem, and is this the tip of a larger pattern of secrecy. Address the actual concern rather than defending the app.
Do not litigate the AI’s nature. Arguing about whether it is “really a relationship” is a debate you will lose and do not need to win. Answer the question that was asked.
Give a straight answer about the practical side. Yes, it costs about this much. Yes, it is private. Yes, I am not going to stop, and here is why I think it is fine. People who are straight about the details get treated more reasonably than people who hedge.
If it was a genuine mistake to hide it, own that without collapsing into apology. “I should have told you, and I am sorry” is a complete statement. Do not add “but you would not have understood.”
Verdict by use case
| Persona | The realistic risk | Platform that best avoids it | The one rule to set on day one |
|---|---|---|---|
| In a relationship, romantic use, decided to disclose | The conversation, not the app | Candy AI — generic billing descriptor and PWA install reduce incidental exposure | Tell the people affected before you are deep in, in a calm moment |
| Living with family, private non-romantic use | Glances, statements, shared devices | Candy AI or Nomi.ai — web-first, generic descriptor, no native app icon | Neutral icon plus notifications off. That covers 90% of realistic exposure |
| Shared finances with a partner or family member | The statement is genuinely read | Character.AI free tier — no recurring charge at all | Use a separate card for anything recurring so it never lands in the shared account |
| Parent worried about a child finding it | The family tablet, a shared phone | Candy AI PWA installed on a personal device only | Keep it off shared and parental-controlled devices entirely; manage the device, not the story |
| Already caught once, wants a better setup | The pattern of exposure, not any single leak | Candy AI or Kindroid — web, no labelled icon | Write down your disclosure rule before you set up again |
| Wanting discretion but not secrecy, and feeling the anxiety of hiding | The concealment itself | Any platform | Decide consciously: if it does not affect anyone, you do not need to hide it at all |
FAQ
Is it illegal to use an AI companion app secretly?
No. There is no general legal prohibition on adults using these platforms, and privacy of your own device and accounts is generally protected. Two practical caveats: do not use a platform on a device or account you do not own without permission, and do not misrepresent the terms of a financial arrangement by routing charges through a shared account in a way that constitutes fraud. Outside those, secrecy is a relationship and privacy question, not a legal one.
How do I hide the app on my phone?
Add it to the home screen as a progressive web app and give it a neutral name and icon — a folder, a weather app, a music app. This works because Candy AI, Kindroid, Nomi.ai and Crushon AI are web-first and install like apps without being native apps with self-describing labels. Then disable notifications and use a private browsing window on shared machines.
Will the charge on my statement show it is an AI app?
On Candy AI, DreamGF, Crushon and Janitor it will not: the descriptor is generic, showing something like “CANDYAI.COM” rather than a product name. On Replika and Character.AI the product name is visible. For maximum cover, use a platform paid through the web with a generic descriptor, and route it through a separate card you control.
Should I tell my family if they would not understand?
If your usage is private, non-romantic and affects nobody else, there is no obligation to brief anyone, and an elaborate explanation often creates a problem that did not exist. If it is romantic, exclusive, or affects someone who would want to know, then the lack of understanding is not a reason to keep concealing — it is the reason to have the conversation carefully and at a good time.
What if my partner finds out on their own?
The damage in that case is the surprise, not the fact. If you find out that disclosure is likely to be forced, do it yourself first, in a calm moment, with the ordinary framing: what it is, what it costs, that it is private, and that nothing about it is a secret that affects them. Volunteering the information converts a discovery into a disclosure, which is a materially easier thing for the other person to absorb.
Is the AI app itself secure?
Treat the platform as readable. Do not share passwords, financial details, government ID numbers or medical records. Use a separate email address and a separate card, verify that permanent account deletion is available in settings, and review the platform’s actual privacy policy rather than assuming — the security and privacy audit compares what each platform commits to.
Related Articles
- Candy AI Security and Privacy — the full audit: encryption, data handling, billing discretion.
- Is Talking to AI Cheating? — where the line sits, and the data on concealment.
- What I Wish I Knew Before Using an AI Companion — including regret #5, hiding it for months.
- Is It Weird to Use an AI Companion? — how to explain it without feeling ashamed.
- AI Girlfriend Safety Checklist — the checks to complete before you subscribe.
- Candy AI Mobile Guide — install as a PWA, custom icon, mobile specifics.
- Candy AI APK Guide — why the official web app beats sideloaded APKs.
- AI Companion Addiction and Obsession — when the anxiety of hiding is itself the problem.
- Best AI Companion Apps 2026 — the six platforms compared on more axes.
- Is Candy AI Safe? — the direct question, answered.