Companion CompassAI girlfriend APK searches: how to spot misleading apps
Check the app's identity, publisher, billing and permissions before you install. A Canadian guide to misleading companion listings and suspicious downloads.
In this article
18+ only. This guide covers software used for ordinary conversations with fictional adult characters.
Search for an ai girlfriend apk and the results will mix real product names, unrelated apps and download pages that promise paid features for free. A familiar icon or a matching character picture doesn't tell you what the software is. Janitor's Canadian iPhone listing, for example, is called Janitor: Interactive Stories and names JanitorAI, INC as the publisher. It requires iOS 15.5 or later. Details like these tell you far more than a page that simply says a file is the official app.
Start with who the developer is and which platforms the product officially supports, then read the store listing and the purchase terms. An app installed from a store, a website saved to the home screen and a downloaded Android package are three different formats. This guide doesn't provide files or installation shortcuts. It explains how to reject a misleading listing before you hand over an account, a private conversation or a payment.
The decision is small and you can check it: does this listing belong to the service you meant to use, and does it ask only for information that service would need? Currency, province and recurring billing are separate questions, covered in the Canadian companion-app guide.
Compare allowances as well as identity. Candy.ai's documented preview has 5 messages in total, so an unrelated listing promising a different free package would need an explanation from the real provider.
Check identity, format, claims, permissions and billing
Look at the publisher's name first, not the search headline. Janitor: Interactive Stories lists JanitorAI, INC as its publisher, and Replika is run by Luka. An unrelated developer can use a similar product title. Check the publisher, the linked privacy notice and the support details together. If they point to different businesses, stop and sort out the mismatch before you sign in. A polished screenshot doesn't prove who owns the service.
Write down the listing identifier along with the name. Titles and artwork can change, but a note of the exact listing helps if you later have a purchase or support problem. Read recent update notes for what they are: they tell you what the developer says it changed. They don't show that anyone tested the app independently or that every advertised feature is in the free tier.
Next, work out the actual format. OurDream's help pages describe a browser app and say there is no native app. Candy.ai documents a home-screen web-app option. So a home-screen icon may be a website, not a separately distributed native program. If a listing uses one of those brands and promises a different format, check who is behind it; the icon by itself doesn't connect it to the documented product.
SpicyChat's platform guide separates its web experience from a former iOS app, which was removed, and from PixelChat, which is a different app. This shows how an old review or installation tutorial can send you to the wrong product today. Don't assume that a new listing with a familiar name is the replacement. Confirm the relationship with current developer information before you enter any credentials.
Treat bundled promises as separate claims. Replika's Pro, Ultra and Platinum offerings come with different feature sets. One Canadian store entry labelled Monthly is priced at CA$18.99, and other entries have different names and prices. None of that means every package sold under the Replika name is a Pro subscription. Match the exact purchase label and term to the feature you want, and don't take a download page's word that everything is already unlocked.
Free allowances are specific too. Candy.ai documents 5 free messages in total, not per day. Secrets describes 20 messages per day plus a separate limit of 100 messages in total for custom characters. A file page that borrows either brand to advertise unlimited access is making a claim of its own. Don't treat that as a normal plan benefit, and don't give it the password to an account you already have.
Then look at each permission request against the thing you were trying to do. A voice feature can explain a microphone request while you're using it. It doesn't explain why an unrelated screen wants wider access to your device. Read the operating system's description of the permission, decide whether the feature is worth it, and leave optional features off if you're uncomfortable. If a download page tells you to turn off device protections so its file will run, don't.
Google says Play Protect checks apps before you download them from Google Play and also checks potentially harmful apps from other sources. It can warn you about harmful software, disable it or remove it. Leave it on and take its warnings seriously. A clean scan is one security signal. It doesn't show that the publisher owns the brand it uses, that a subscription is good value or that a companion app's privacy policy suits you.
Read the privacy notice before you add anything personal. The privacy declarations on Janitor's App Store listing come from the developer, and Apple does not verify them. Read the data categories as information, not as an independent guarantee of confidentiality. Replika's policy, for example, says some profile and message data can be kept for up to 60 days after the contract ends, with different periods for other categories. Deleting the icon from your phone does nothing to those server records.
Last, match the purchase to the merchant. Candy.ai names EverAI as its statement descriptor, so a different name on your statement can have a documented explanation. Still, check it against your own receipt, date and amount. An unfamiliar charge with no matching purchase should be raised with the billing provider. An unfamiliar descriptor isn't automatically fraud, and a recognisable brand doesn't prove you authorised a charge.
When you leave, handle the account and the subscription separately. Replika requires you to cancel through the route you originally paid through; deleting the account doesn't stop billing. OurDream says account deletion takes 24 to 48 hours and automatically cancels an active subscription. Because the rules differ, uninstalling suspicious software is only part of reviewing an account. Check the real subscription record and ask for the action that gets you the result you want.
Once you've confirmed who you're dealing with, use the documented companion-app comparison to compare features. You can compare prices, message allowances and memory settings without a modified download, a borrowed logo or a promise of special access. Stick to the ordinary conversation features and account controls you'd actually use.
Before you install or sign in
Note the exact listing, the publisher and the purchase label. Janitor's iOS 15.5 requirement and its publisher, JanitorAI, INC, are the kind of concrete details you can compare between a store page and the developer's own information.
Think about how you got to the listing. An ad, a social media message and a search result can all use a product name without the owner's involvement. If the publisher or privacy notice differs between the product's own information and the store, sort that out first. Don't sign in just to test whether an unfamiliar app is genuine.
Read what's free and what renews. Candy.ai's 5-message total is a preview, not a daily allowance. In a store, tell apart a named monthly purchase, a credit top-up and an entry with no stated duration. Keep the receipt for any purchase you authorise, including the currency, billing period and merchant.
Review each permission when you use the feature it belongs to. Decline optional access you don't need, and keep device security protections switched on. If a page asks for a password, security code or payment outside the normal account flow, stop and contact the company yourself instead of replying to the message that asked.
Plan your exit before you share a long conversation. Find the real subscription record, the account-removal option and the privacy contact. Removing Replika from a device doesn't cancel the subscription. A browser shortcut and a native app can also leave different information on the device, so treat cleaning up the device and making requests to the service as separate jobs.
Check the documented message and feature allowances before you believe a download page that says a familiar brand comes with extra benefits.
If you already shared credentials or paid
Apple's scam guidance says to change your Apple Account password immediately if you entered it on a fraudulent website, and to make sure two-factor authentication is turned on. Do this through the real account settings or a support channel you found yourself. Don't let someone in an unsolicited message walk you through giving up a security code or making a payment they say will fix the account.
If a subscription appears that you didn't expect, use the receipt and billing account to identify the merchant before you discuss cancellation or an unauthorised charge. Candy.ai's documented EverAI descriptor is an example of why this matters. If you remove a Replika account, remember that billing has to be cancelled separately. Keep the purchase confirmation and any relevant messages, but avoid making extra copies of private chats or identity documents.
The generative-AI principles published by Canadian privacy authorities favour collecting as little personal information as possible and warn about malicious impersonation. Be just as cautious with someone claiming to be a support agent as with the chatbot. Report the incident to the right account provider with the listing name, the dates and the type of information involved. Don't share passwords or security codes with anyone, including people who offer to recover the account for a fee.
OurDream's documented account-deletion window is 24 to 48 hours, and deletion also cancels an active subscription. Keep that confirmation separate from your decision about removing software from the device.
Frequently asked questions
Is every companion APK a fake?
An Android package is a way of distributing software. It doesn't prove fraud or legitimacy either way. What matters is who published the exact file or app and whether it matches the platforms the service currently documents. This guide points readers to official store identity checks and doesn't offer package downloads. Janitor's named publisher and its iOS 15.5 requirement are the kind of concrete information to compare.
Does a home-screen icon prove that I installed a native app?
No. A website can also show up as an icon. OurDream documents a browser app and says it has no native app, and Candy.ai offers a home-screen option. Check the format before you expect store-managed purchases or features that only native apps have. What an icon looks like can't tell you who published the software or how a subscription was bought.
What if a download promises unlimited free messages?
Compare the promise with the real allowance. Candy.ai offers 5 messages in total; Secrets allows 20 a day and a separate total of 100 for custom characters. A download page that claims something different needs confirming with the service directly. Don't give your existing account password to a stranger who offers to add those supposed benefits.
Are app-store privacy labels an independent audit?
No. Janitor's listing states that its privacy information comes from the developer and that Apple does not verify it. Read the categories together with the linked policy and the permission requests. A label can help you ask better questions, but it can't show that no staff member, processor or other system will ever access your conversation. Share only what the feature you want actually needs.
Will deleting the app stop an unexpected payment?
Not necessarily. Replika requires cancellation through the original billing route, and deleting the account doesn't cancel the subscription. OurDream has a different rule: account deletion includes cancellation. Work out the actual product and merchant, find the subscription record and save the cancellation confirmation. Removing an icon on its own won't reliably sort out a recurring payment.
Can I trust a charge because the brand looks familiar?
Match the charge to a purchase you made. EverAI is Candy.ai's documented statement descriptor, so a statement can show a different name from the product. That doesn't account for every charge under that name. Check your receipt, the amount and the date, and if the purchase still doesn't match, contact the billing provider through a channel you already know.