Try using the play protect from the Google play store. Open play store > Profile (top right corner) > Play protect. Then do a scan from there. It will find and report any apps with security risks and harmful behavior
Does your girlfriend have your Samsung, Google and/or email passwords? Look in your accounts and see if any devices that aren't yours are logged in. If there are log them out. Then change all your passwords download Malwarebytes, run a scan, and break up with your girlfriend. Turn on the built in app protection in the security settings. The time to lock the barn door is not after the horse is already gone.
