The chat should be encrypted, even if only lightly, to make it non-trivial to view. Also delete lines older than a month or when the log becomes more than 300 lines or so, then if the database and decryption key is ever compromised, their privacy will be somewhat protected. The user may want to save the chat though (I would), so best is to give them an option to store it for a longer period, and download anything that would be deleted from the server.
I'm not sure if it's any use to encrypt it with the user's password. It may even make it easier for the attacker, with an SQL-injection he may be able to view the user's passwords. A hardcoded decryption key would offer a second factor; the compromised database is not enough. However a decryption key is always possible to find when the server is compromised (which may be easier to do when the database is breached, especially when an attacker can write to the database), so this can't be fully relied on.
The only way to really protect the user's chats is to generate a private and public keypair, and make the user download the private key without keeping a copy. The chat can be decrypted with the private key (would need to be entered upon loading any chat from the database), and with the public key you can encrypt and store the chat. This is probably impractical and too much work though.