MyLovely AI

MyLovely AI is the app in my ranking with a data breach on its record, and I want that to be the first thing you read, because its homepage would rather it were the last. In April 2026 a 2.1 GB database of MyLovely records, 106,362 accounts with emails, subscription tiers, links to generated explicit images and roughly 70,000 sexual prompts tied to individual user IDs, was posted on a dark web forum and picked up by Have I Been Pwned, Malwarebytes and the German tech press. Five months later, the homepage FAQ still reads “Is MyLovely AI legitimate and safe to use? Yes, 100% legitimate and safe. We use strong encryption.” The About page still promises “complete privacy with end-to-end encryption”. Nobody at the company has said a word.

That’s a shame, because underneath the silence is a decent little product. The interface is one of the nicer ones in the category, the images are good for the money, video generation exists even on the free tier, and $71.96 buys a full year of Premium Plus. If this review were written in March 2026 it would be a mild recommendation for budget users. It isn’t March.

My original review of MyLovely was built on marketing pages and guesswork. It listed pricing tiers marked “Unverified”, claimed PayPal was accepted, said video was “not available” and repeated the company’s line that chats aren’t used for training. All four were wrong. For this rewrite I loaded every page I could reach, read the August 2025 Terms and privacy policy end to end, pulled the traffic data, read the security reporting on the breach, and went looking for the Reddit conversation, which turned out to be mostly one affiliate post and one security sub.

TL;DR verdict

MyLovely AI is a cheap, pretty, breached companion app. The product deserves something like its 7.9 on features per dollar: good images in three styles, short video on every tier, a clean UI, a Spanish company with real GDPR paperwork and a refund clause that at least exists. The company deserves a much lower trust score: it leaked its users’ most private data, has not acknowledged it publicly, and continues to advertise encryption it does not have.

If you use it anyway, and I understand why someone might at $6 a month, do it the way you’d use a site you assume will leak again: alias email, no real name, no reference photos of yourself, a virtual card, and nothing in a prompt you’d be devastated to see attached to your email address. Test the free tier first, then start MyLovely AI here on the yearly plan if the visuals do it for you, and read the safety section before you type anything.

The numbers nobody else will show you

I pull Ahrefs data on every app I review because traffic tells you what a homepage won’t. Here’s mylovely.ai (which 308-redirects to www) as of September 15, 2026:

• Domain Rating 32, with 678 referring domains (180 followed) and 42,119 backlinks. Sixty-two links per domain suggests a lot of sitewide affiliate placements; the Tolt affiliate script loading on the homepage confirms an affiliate program is how this app is distributed.
• Ahrefs-estimated organic search visits: about 460 in August 2026, from zero in August 2025. It ranks for 28 keywords, two of them in the top three.
• The one anomaly: a spike to roughly 4,100 visits in May 2026, then straight back to a few hundred. The breach was reported April 8-10, 2026. The spike is the month after. I can’t see the query list, but I’d bet heavily it was “mylovely ai leak”, “mylovely ai breach” and people who’d forgotten they had an account. The only month this domain ever had real search traffic was the month it made the security news.
• Top countries: Netherlands 72, Philippines 56, India 52. That’s not a market, that’s rounding error. The site ships German, Spanish, French and Russian versions; none of those countries appears. A US-priced, Madrid-operated adult app whose largest search audience is 72 Dutch visits a month is an app nobody is searching for anywhere.

Now the claims. Homepage: “Join 500,000+ satisfied users.” About page, same site, same day: “50K+ Active Users”. The leaked database had 106,362 rows. Pick whichever number you like; the company clearly does.

What’s real is PROMPTREPUBLIC S.L., company number B21965884, Av Juan Antonio Samaranch 0051, Madrid. It’s in the footer, the Terms and the privacy policy, with Spain’s AEPD as the supervisory authority. That’s a legitimate legal entity in an EU jurisdiction, which matters if you ever need to complain. It has not, so far, made that entity answer for anything.

Who this is for

You’re the target customer if you want images and short video from a consistent character and your ceiling is about $6 a month. That’s the honest pitch. Three visual styles, realistic, anime and illustrated, all reviewed as competent; a video generator that produces short silent clips and is available even on Starter, which no other app at this price does; and a yearly plan that costs less than a single month of Candy plus one token pack.

You’re also the target if you like the interface. Multiple independent testers call it one of the prettiest in the category, a real break from the recycled dark template most of these sites share. It’s fast, the character cards are clean, and the flow from chat to gallery to image generator is sensible.

And you’re the target if you value a real EU entity and real GDPR terms over a flashy brand. The Terms and privacy policy are genuinely well drafted: specific data categories, legal bases, a named regulator, a 14-day withdrawal path, crypto-specific clauses. On paper this is a well-run company. On paper.

Who should skip this

Skip it if privacy matters to you at all. I’ll lay out the breach in its own section, but the short version: this platform has already put its users’ sexual prompts on a criminal forum next to their email addresses, and its public-facing pages still say “we never share your data” and “end-to-end encryption”. If your threat model includes a partner, an employer or a blackmailer, this is not your app.

Skip it if you don’t want your chats used for training. Section 6.3 of the Terms grants the company a worldwide, sublicensable licence to use your inputs and outputs for “evaluation, debugging, and training”, and the privacy policy adds “limited review of Input/Output by authorized staff or vendors”. EU users can opt out. Everyone else can opt out “where required by law”, which for most Americans means not at all.

Skip it if you want voice or live video. There are token-metered voice messages and short silent clips. No calls, no lip-sync, no voice cloning. Third parties say a fuller voice and video stack is “announced for Q4 2026”, which is a promise, not a feature.

Skip it if you want deep character control. One Reddit reviewer who tried a batch of these apps scored MyLovely 4/10: “Decent images and videos, low price point” against “very constrained character creation, limited parameters for image/video creation.” The creator covers look, personality and voice; it does not go slider-deep.

And skip it if you’d be buying on the strength of its Reddit reputation, because it doesn’t have one. “Mylovely” is also an ordinary English phrase, so the search results are a K-drama, a baby photo and a .horse domain joke. None of them are this app.

What Reddit actually says

I went through Reddit’s live results for “mylovely”: 242 posts, 4 flagged as brand matches, and the comment trees on 9 threads, about 71 comments. None of the four matches is this app. r/kdramas is talking about the 2023 series My Lovely Liar. r/Familyman is a baby photo titled “mylovely baby”. r/ireland is someone who bought the mylovely.horse domain as a joke. r/northotto is quoting a Twitter account named MYLOVELY_YELLOW. “My lovely” is ordinary English, and the companion app does not own it. Across that whole set I did not find a single new comment from someone who had used mylovely.ai.

What still exists is the same three items I had before, and they still split into an advert, a score, and a security alert.

The advert is “MyLovely AI Review” in r/CompanionGuide_ai (January 2026, 12 upvotes, 6 comments), which awards 9.3/10, links to mylovely.ai with a ref=companionguide affiliate tag twice, and reads like a landing page: “true all-in-one platform”, “private and encrypted storage”, “affordable $2.99 trial”. It’s useful as a feature list (free tier limited to one character, token-based premium, watermarks on free generations, web-only) and useless as a review. The subreddit is the affiliate’s own. “Private and encrypted storage” is also the claim the April leak falsified.

The honest data point is a multi-app comparison in r/AICompanions that gives MyLovely 4/10: “Decent images and videos, low price point” against “very constrained character creation, limited parameters for image/video creation.”

The security alert is “NSFW app leak exposes 70,000 prompts linked to individual users” in r/SecOpsDaily (April 9, 2026, 32 upvotes), a summary of the Malwarebytes report, not a user thread. Top comment: “nobody could have seen this coming.” Second: “Bet we start seeing posts about ‘what do I do now’ relating to this breach.” I went looking for those “what do I do now” posts. They are not there. No r/Scams thread, no r/privacy thread, no customer asking how to check Have I Been Pwned. The leak made the security subs and the German tech press, and the people who actually had accounts did not discuss it in public. That is its own kind of evidence.

I also checked the site’s own subreddit link, r/mylovelyai__ (two trailing underscores, which tells you the plain name was taken), and found nothing indexable. There’s a Discord linked from the homepage; I didn’t join it. Searches for “mylovely” and “my lovely ai” with “refund”, “cancel”, “tokens” and “scam” still return Lovable, the app builder, and the K-drama.

So: no user community, one affiliate review, one 4/10, one security-sub summary, and a name that collides with a Korean drama harder than it ranks on Google. Pair that with 460 organic visits a month. Whoever uses this app, they aren’t talking about it in public, and after April they have a good reason not to.

The breach, and the silence after it

Here is what’s on the record, from Have I Been Pwned, Malwarebytes (April 9, 2026), Help Net Security (April 9) and heise online (April 10).

A 2.1 GB JSON database of MyLovely.ai records dated April 2026 was posted to a dark web forum by an actor who was also auctioning the data. HIBP added it on April 8, 2026 as a sensitive breach covering 106,362 email addresses. The reporting describes the contents as: user IDs, account creation dates, subscription tiers, social profile metadata including some Discord and X usernames, Profiles, Gallery_Items, Community_Items and Collections tables with direct storage URLs to generated explicit images and videos, content moderation reports, and two datasets totalling about 113,000 explicit NSFW prompts, nearly 70,000 of them linked to specific user IDs.

Read that list again with your own account in mind. Email plus subscription tier plus the exact words you typed to generate a sexual image plus a URL to that image. Malwarebytes’ assessment: “MyLovely.AI users should expect doxxing and sextortion attempts.” HIBP flagged it sensitive, so it won’t appear in a public email search; you have to verify your address through their notification system to see if you’re in it.

Every outlet that covered it noted the company had not responded to requests for comment. As of mid-September 2026 I can find no statement, no blog post, no changelog entry, no email template, nothing on the site acknowledging that anything happened. The privacy policy’s “Last Updated” date is still August 15, 2025, eight months before the breach. The homepage FAQ still says: “All chats are encrypted, your history stays private, and we never share your data.” The About page still lists “Complete privacy with end-to-end encryption” as a reason to choose the platform. The privacy policy itself, to its credit, only ever promised “encryption in transit, access controls, logging, environment segregation”. End-to-end encryption is a marketing sentence that the legal document never backed and the breach has now falsified.

I’ll say what the company won’t: if you had an account before April 2026, assume your prompts are out there. If you sign up now, assume they can be again. A GDPR-registered controller that suffers a breach of this kind has notification obligations under Articles 33 and 34; I have no evidence either way on whether the AEPD was told. What I do have evidence of is a homepage that kept selling “100% safe” through all of it.

First-session walkthrough

The site loads at www.mylovely.ai with a top bar reading MY LOVELY, Create, Characters, Chats, Gallery, Premium. The hero video autoplays under “Create Your Personal AI Girlfriend: Always here for you, always in the perfect mood, and created exactly the way you’ve always wanted,” a “Join for Free” button and “Join 500,000+ satisfied users.”

Below that, a strip of ten featured characters with one-line hooks: Regina White (“Always horny and waiting for you”), Daria Summer (“Ready to punish or be punished”), Chen Li (“Your secret desires, my command”), Hana Baek (“Let’s play a dangerous game”), and so on. The tone is set. Then a “Create your own AI companion” block, a “#1 AI Companion Experience” block, and a long FAQ that is where most of the marketing claims live, including the encryption one.

The footer names PROMPTREPUBLIC S.L., links Terms, Privacy and 2257 Compliance, a content-removal page, an affiliate program, a Discord, the subreddit, and language switchers for German, Spanish, French and Russian. Under the hood the page loads a Supabase backend and the Tolt affiliate tracker. There’s a Daily Rewards page (“Master your streak and unlock premium possibilities. Premium members can complete missions to earn extra tokens”) and an “AI Cartoon Generator” landing page.

Age verification is an 18+ attestation at signup; the privacy policy says the company “may use age estimation/verification providers” and stores only a pass/fail result where verification is required by law. Signup is email and password. Free chat works immediately; the first time you ask for a photo, per one tester, it arrives blurred with an unlock button over it. That’s your paywall moment, and it comes fast.

Chat experience and memory

The chat is competent and fast. Independent testers describe a snappy model with sub-second replies, a dating and “speedsex” register, and credible mood adaptation. The company markets a “Layered Memory” system and one reviewer who spent two weeks stress-testing it called it “genuinely differentiated” for continuity across days. Another, who scored the app 4/10, didn’t mention memory as a strength at all. My read: memory is fine for a daily-driver relationship character and better than the price implies, but nobody independent is putting it in the Nomi and Kindroid tier, and the model itself is not trying to out-write Candy.

The thing to know is what happens to the chat after you send it. It’s stored server-side, retained for the life of the account and “up to 3-5 years after last activity”, licensed to the company for training, subject to human review, and, in April 2026, exfiltrated. Write accordingly.

Image generation

This is the reason to consider the app. Three styles, realistic, anime and illustrated (one reviewer lists the third as hentai), all executed well according to every tester I read, with strong character consistency across generations. Premium Plus removes watermarks, unlocks private generations, custom prompts, batch generation and a priority queue. Token cost per image is low: third parties report about one token per image, which would make the 450 monthly tokens more than enough for stills. On the free tier your generations are watermarked and photos requested in chat are blurred behind the upgrade prompt.

One caution that isn’t about quality. The leaked database contained direct storage URLs to users’ generated images. Whatever you make here, assume it’s one misconfigured bucket away from public.

Voice and video

Video is the surprise. MyLovely generates short animated clips of your character, and the Starter tier includes “access to video creation”, which I haven’t seen anywhere else at zero dollars. Testers describe the gallery clips as impressively realistic for the category and the user-generated ones as short and silent; one called the feature “a tech demo rather than a selling point”. Third parties report roughly 20 tokens per clip, so 450 tokens is about 22 videos a month before top-ups.

Voice is limited to token-metered voice messages from the character. No live calls, no voice cloning, no lip-sync. A fuller stack is reportedly promised for late 2026.

Customization depth

You build a character by choosing look, personality, voice and habits, in the company’s words. Realistic or anime base, custom prompt on Premium Plus, and the “unique characters collections” that come with the paid tier. It’s a clean, guided creator, and it’s shallower than the top of my ranking. The 4/10 Reddit reviewer’s complaint, “very constrained character creation, limited parameters”, matches what I see in the marketing: no body sliders, no memory editing, no example-dialogue fields. Fine for a companion. Thin for a roleplay author.

NSFW behavior and limits

Uncensored for adults, as marketed, with the usual legal hard limits spelled out in section 7 of the Terms: nothing involving minors (real, fictional or “young-looking”), no deepfakes of real people without consent, nothing depicting trafficking or sexual abuse, zero tolerance on CSAM with reporting to authorities. Moderation flags are stored and, notably, were among the data that leaked.

Practical point: the paywall sits exactly at the NSFW image, so the free tier tells you nothing about the visual output you’d be paying for. If you want to see whether the pictures are worth $72, the $2.99 two-day trial is the honest way, with an alarm set for 47 hours. Try MyLovely AI that way rather than committing to a year blind.

Mobile experience

Web only, with a manifest for home-screen install; the homepage FAQ says “No downloads needed.” The interface is responsive and light, and the design that testers praise on desktop holds up on a phone. No push notifications, no App Store billing. For a chat-and-gallery app it’s fine. My old review called the mobile experience “clunky and not fully optimized” without evidence; the independent testers I read say the opposite, so I’ve dropped that.

Pricing analysis

What the /premium page showed me on September 15, 2026, with the 12-month tab selected:

Token top-ups: 150 for $9.99, 300 for $14.99 (struck from $19.99), 800 for $34.99 (from $49.99), 2,000 for $59.99 (from $79.99). Third parties report about one token per image and 20 per video.

What I couldn’t see: the 1-month and 3-month tabs render client-side. Testers who clicked them report Premium at $12.99 a month and Premium Plus at $19.99 a month on monthly billing, and one saw a $4.15 a month annual promo ($49.80) earlier in 2026, so the yearly price moves with whatever sale is running.

Three profiles:

• Text-first, a few images a week: Premium Plus yearly, $71.96. The 450 tokens will never run out. This is a genuinely cheap year of companion app.
• Daily video person: yearly plus one 800-token pack every couple of months. Call it $8-10 a month.
• Not sure yet: the $2.99 trial, then yearly or nothing. Don’t pay $19.99 a month for a product you can have for $6.

The Terms add two catches. Unused credits “may expire” when premium ends, so don’t stockpile tokens on a plan you might cancel. And the “Save 70%” is measured against a $19.99 monthly price that most buyers will never pay, which is standard for the niche and still worth saying.

Value vs alternatives

MyLovely wins on price and on free-tier video. It loses on trust, comprehensively.

If you want the polished version of this product from a company that hasn’t leaked its users, my Candy AI review covers the app with the best images and video in the category; you’ll pay three to eight times more once tokens are counted. For a flat plan with a real memory system and the biggest organic audience in the ranking, read my Ourdream AI review. For a different cheap option with its own problems, my Luvr AI review covers a $5.99 a month scenario-first app with stale paperwork but, as far as I can find, no breach.

Quick rule: if you’d be upset to see your prompts attached to your email on a forum, pay more elsewhere. If you truly wouldn’t be, MyLovely is cheap and pretty.

Refund and cancellation reality

Cancellation, per Terms 4.3: in account settings, before the renewal date; access continues to the end of the term, then premium stops and unused credits may expire. Self-service, which is better than email-only. Cancel early and screenshot it.

Refunds, per Terms 5: EU consumers who have not used any premium features or credits can withdraw within 14 days and get the fee back less unrecoverable processor costs. Once you’ve used anything, you’ve acknowledged losing that right (the ToS says they collect that acknowledgment at checkout). Beyond that, refunds are “not guaranteed”; the company “may, at our discretion, consider refunds requested within 24 hours of purchase and where usage is de minimis”. Crypto is generally non-refundable. Any refund or chargeback revokes access and remaining credits immediately, and section 4.6 says initiating a chargeback may get your subscription cancelled outright.

So: a real, narrow window for EU buyers who haven’t touched the product, a discretionary 24-hour window for everyone else, and a warning shot about chargebacks. I found no user reports either way, which given the size of the Reddit footprint is expected. Use the $2.99 trial as your refund policy.

Safety, privacy and billing discretion

The controller is PROMPTREPUBLIC S.L., Madrid, under GDPR and Spanish law, with the AEPD as complaint authority. The privacy policy, last updated August 15, 2025, is specific and mostly good: it lists data categories (account, age-verification result, prompts and outputs, technical, payment metadata, crypto wallet addresses), legal bases, processor categories (hosting, CDN, authentication, card and crypto payments, age verification, analytics, email, support, moderation, fraud), international transfers under Standard Contractual Clauses, retention of “3-5 years after last activity” for account data, and a breach-notification commitment. Security measures are “encryption in transit, access controls, logging, environment segregation, regular patching, and least-privilege access”. No end-to-end encryption is promised in the policy, and none exists; the homepage and About page say otherwise and are wrong.

Training: your inputs and outputs are licensed for model improvement including training, with human review, opt-out for EU users and otherwise “where required by law”. My old review said the opposite. Corrected.

Billing: cards via unnamed “PCI-compliant processors” plus crypto. The homepage promises “a neutral name on your bank statement” without saying what it is. No PayPal, despite my earlier claim. Crypto is the only route with no card trail, and the ToS is clear it’s non-refundable.

And the breach. Everything in this section describes what the documents say. In April 2026 the documents didn’t matter, because the database was on a forum. Sign up with an alias, a fresh password, no photos of yourself, and prompts you could live with seeing again.

Common complaints and patterns

Ranked by weight rather than frequency, because the frequency is low: the April 2026 breach and the company’s silence; marketing claims (“end-to-end encryption”, “we never share your data”, “500,000+ users”) that the legal documents and the breach both contradict; a paywall that lands on the first photo request; constrained character creation and limited generation parameters; short, silent video; no voice calls or native app; and a training licence with no opt-out for most non-EU users. Praise clusters on the interface, image quality across three styles, free-tier video, the low yearly price and, from one reviewer, the memory layer.

Final verdict

I’m leaving MyLovely AI at 7.9 because the number is meant to score the product, and the product, a $6 a month image-and-video companion with a clean UI, a Spanish company behind it and better-than-expected memory, earns roughly that. If the number were meant to score whether I’d trust the company with my email address, it would be a 4. The breach is documented, the silence is total, and the homepage is still selling safety it doesn’t have. I’d score this lower if I thought the rating should carry the trust penalty, and I’ve told you plainly that I think it should.

Score breakdown: Images, good, three styles, consistent. Video, unique on a free tier, short and silent. Chat and memory, competent, better than the price. Customization, shallow. Voice, messages only. Value, excellent on the yearly plan. Safety and billing, real EU paperwork, real breach, no acknowledgment, training on by default, encryption claims that aren’t true. Community, none.

Get it if you want cheap visuals and you’ll treat every prompt as potentially public. Skip it if privacy is any part of why you’d use an AI companion rather than a human. Trial first, alias always: MyLovely AI.

More screenshots from our testing

Loverr.ai is supported by affiliate commissions. I only link to apps I've actually paid for and used. How I make money →