Verification

Is Dream Companion safe?

It has the best corporate disclosure of any app we have checked — a full German Impressum, register number, VAT ID, two named directors, German law, Berlin courts. Then it tells you there are no refunds, declines to publish what it charges, advertises 70% off a price it will not show you, and asks for your passport and a scan of your face. All four of those are also disclosure. They are just not the flattering kind.

1. Who are you actually trusting?

That is a real answer to the question most of this category refuses. Muah.AI discloses the words "California Based" and nothing else. Janitor AI names no company, no founder and no country. Dream Companion names the court, the file number and the individuals. A German UG is required to publish this, which is rather the point: the operator chose a jurisdiction that forces the disclosure, and complied with it.

2. What it costs

A percentage discount is not a price. "70% off" is information only if you know the original figure, and here you cannot without signing up first. We are not going to guess at it, and we have not printed the numbers other sites quote, because we could not confirm any of them from the operator.

The site describes its core features as VENDOR CLAIM "completely free to use". We have not tested what that free tier permits in practice, so we are recording it as the company's claim rather than a finding. Our free-tier comparison covers the apps where we have measured the limits ourselves.

Credit where it is due: this is disclosed clearly, in plain language, and it is easier to find than Candy.ai's 24-hour window that voids after 20 tokens. A flat "no refunds" that you can read before paying is more honest than a refund policy engineered to expire before you notice it. It is still a flat no refunds. If you are in the EU or UK, note that the statutory 14-day right of withdrawal for consumers is law and cannot be removed by terms; the interaction between that right and this clause is a question for a lawyer, not for us.

3. What happens to what you type — and to your face

There is a defensible reason for it. Age-verification law is tightening across US states and in the UK, and an operator in an EU jurisdiction with named directors has more to lose by ignoring it than an anonymous one does. This is, in a sense, what compliance looks like.

It is also the reason our own site is text and screenshots only. The risk is not the verification, it is the file it creates. An anonymous app that leaks gives up your email address and your prompts — which, as the Muah.AI breach demonstrated, is bad enough. An identity-verified app that leaks gives up your email address, your prompts, your legal name and a photograph of your face, joined together. The better-governed operator is holding the more dangerous file.

On its own security, the company states it uses "industry-standard security measures, including encryption, firewalls, secure access protocols, and regular vulnerability assessments", and that conversations are held with "strict confidentiality" under "robust encryption protocols". Those are VENDOR CLAIM — we have seen no published audit, penetration test or certification, and we did not test the platform ourselves.

Two further points from the policy. Retention is stated only as "as long as necessary", with no specific period given for chat messages or generated images. And the liability clause in the terms disclaims responsibility for "unauthorized access to or use of our servers or any personal data, content, or information stored within", capping total liability at the amount paid in the preceding six months. Read together: the company holds your ID, your face and your conversations, does not say for how long, and contractually limits what it owes you if that set is taken.

How it compares on the checks we can run

"None on record" is not "secure". It means no breach has been made public, which is the same thing we say about every app here that has not been caught.

So, is it safe?

On accountability: it is the best in this category, and it is not close. A named company, a register entry, a VAT number, two identifiable directors, an EU jurisdiction and a court. If something goes wrong there is a party to pursue and somewhere to pursue them. Almost nothing else we have reviewed offers that.

Financially: we would not subscribe without seeing the price first, and you cannot. No published pricing, a percentage discount on an unstated figure, and no refunds once you have paid. Those three together mean you commit before you know the number, and cannot undo it. That is the part we would not accept.

On privacy: the trade is sharper than it first looks. The strongest-governed operator in the category is also the one that wants your ID and your face, retains conversations for an unstated period, runs the largest set of advertising trackers we have catalogued on an adult site, and limits its own liability if that combination is stolen. Better governance is not the same as less exposure. Here they point in opposite directions.

Where we come out. We rank it above Muah.AI without hesitation — one has a documented leak and an anonymous operator, the other has neither. We rank it below Janitor AI for anyone whose priority is minimising what a breach could expose, because Janitor AI takes no card and no ID, and pays us nothing either. Against Candy.ai it is genuinely mixed: better disclosure, worse pricing transparency, and a heavier identity footprint. We are paid on Candy.ai and not on this, so treat that particular comparison with the suspicion it deserves and read both pages.

Every app's breach and disclosure record, side by side →