Quick Verdict
Candy AI is a legitimate commercial AI companion service operated by EverAI Limited, but users should understand its privacy model before treating chats as completely private personal diaries.
Candy AI publishes current Terms of Service, a Privacy Notice, an Underage Policy, Community Guidelines and a Blocked Content Policy. EverAI Limited is identified as a Malta-registered company, and Candy AI's current checkout says charges appear as EverAI on bank statements.
The more important privacy detail is in Candy AI's Privacy Notice, revised 30 July 2026. It explains that the service can process prompts, messages, voice calls, generated outputs, companion preferences, IP information and account data. It also says interactions may be aggregated, anonymised or de-identified for service improvement, research, model training and quality assurance. Third-party AI model or hosting providers may receive message content when needed to provide the service.
Candy AI describes conversations as generally confidential, but flagged content can be manually reviewed for moderation. In practical terms, Candy AI should not be treated as a zero-access encrypted vault for secrets.
Legitimate service, reasonable published controls, but use normal privacy discipline and avoid entering highly sensitive personal data that the companion does not need.
Is Candy AI Legit?
Yes, Candy AI is a real service rather than an anonymous one-page website with no visible operator.
Candy AI's Terms of Service identify the owner and operator as EverAI Limited. The company is listed as incorporated in Malta, with registration number C107181.
Candy AI also publishes company contact and policy information through its official website.
"Legit" means there is a functioning service with an identifiable company, published terms, payment processing and support structure. It does not mean every customer will be satisfied with the product, and it does not mean you should ignore subscription conditions, privacy rules or token costs.
Who owns Candy AI?
Company and operator
- Operator
- EverAI Limited
- Registration
- Malta, company number C107181
- Registered address
- 56 Central Business Centre, Triq Is-Soll, Santa Venera SVR 1833, Malta
- Data controller
- EverAI, per the July 2026 Privacy Notice
- Privacy contact
- Includes a Data Protection Officer contact
The July 2026 Privacy Notice identifies EverAI as the controller responsible for personal-data processing through Candy.ai and affiliated services. The company provides privacy and support contact routes, including a Data Protection Officer contact in its privacy documentation.
What Data Does Candy AI Collect?
Candy AI's current Privacy Notice is much more useful than relying on marketing language. The policy says account and service data can include categories such as:
Account data
- Email address
- Encrypted password
- Screen name
- User gender if provided
- Account creation information
- Sign-in information
Technical data
- IP address
- Country or city inferred from IP
- Device and browser information in relevant contexts
Interaction data
- AI companion preferences
- Prompts
- Chat messages
- Voice calls
- Generated outputs
Commercial data
- Token balance
- Payment-related information
- Support messages
Not every user provides every data point, and the exact information depends on features and payment methods used. Still, this is a meaningful amount of data for an intimate companion service.
What Candy AI knows about companion preferences
Candy AI's Privacy Notice specifically discusses user preferences relating to AI companions. Examples include preferences around:
- Ethnicity
- Age
- Eye colour
- Hair type
- Body type
- Personality
- Voice
- Occupation
- Type of relationship
Candy AI notes that these preferences concern fictional AI companions rather than living natural persons.
Candy AI also acknowledges that some combinations of user information and preferences can potentially constitute sensitive personal data under applicable law. That is a good reminder that intimate AI use can reveal things about the user even when the character itself is fictional.
Are Candy AI Chats Private?
Candy AI describes conversations as generally confidential in its moderation policies.
That is not the same as saying no system, provider or authorised reviewer can ever access message content.
The July 2026 Privacy Notice says third-party service providers can be used to operate Candy AI, including moderation tools and third-party LLM providers or hosters.
The policy specifically notes that such AI-related providers may receive the content of messages exchanged with the chatbot when required for the service.
Candy AI also says flagged content may be manually reviewed for policy enforcement.
Your chats are not publicly visible to random users, but you should not treat them as inaccessible to all service systems and authorised processing.
Does Candy AI Use Chats to Train AI?
Candy AI's current Privacy Notice says information associated with platform interactions, including exchanges with AI characters, may be aggregated, anonymised or de-identified for purposes including:
- Improving and developing services
- Internal research
- Quality assurance
- Data analysis
- Training and developing AI models
- Improving moderation technologies
- Preparing datasets for further training
The notice also says preparation of datasets can include human review of de-identified or anonymised interactions.
If you are uncomfortable with any possibility that de-identified interaction data contributes to product development, read the current privacy terms carefully before using Candy AI for personal conversations.
Does Candy AI sell personal data?
Candy AI's Privacy Notice says it does not disclose, sell, trade or otherwise transfer personal data to third parties without consent where required, except as otherwise described in the policy.
The important phrase is that the policy still permits disclosures needed to provide the service, satisfy legitimate interests, comply with legal obligations and work with service providers. That includes payment providers, hosting, email tools, moderation systems and AI-related service providers.
So "not sold" should not be interpreted as "never shared with any processor for any operational reason".
Does Candy AI Have End-to-End Encryption?
Candy AI's marketing FAQ currently uses strong language about encrypted conversations and security.
However, its detailed Privacy Notice says third-party LLM providers or hosters may receive message content and that flagged material may be reviewed for moderation.
Those operational disclosures are important when interpreting broad marketing claims.
A classic zero-access end-to-end encrypted messaging system is designed so the service provider cannot read message contents in the ordinary course of providing the service. Candy AI's published privacy and moderation processes clearly involve situations where content can be processed or reviewed.
For that reason, I would describe Candy AI as using published security measures and confidential account-based conversations rather than promising users that no authorised system can ever access the content.
Candy AI security measures
Candy AI's Privacy Notice says EverAI has implemented appropriate security measures intended to prevent personal data from being accidentally lost, used, accessed without authorisation, altered or disclosed.
The public policy does not give a complete technical architecture or security audit report. That is normal for a consumer product, but it means outsiders cannot independently prove every implementation detail from the privacy page alone.
Good user-side security still matters.
How to Secure Your Candy AI Account
- Use a unique password. Never reuse your email, banking or work password. If another site is breached, reused credentials can expose unrelated accounts.
- Use a dedicated email if privacy matters. You do not necessarily need to use your main professional address for an adult companion account.
- Verify the domain. The official service is candy.ai. Check the address before entering credentials.
- Avoid random app-store listings. There are current mobile apps using "Candy AI" in their names that are published by developers other than EverAI Limited. Do not assume a matching name means the same company.
- Keep personal information minimal. The AI does not need your passport number, bank details, home security code or work credentials to roleplay a fictional scenario.
- Review renewal settings. Security also means financial control. Know when the subscription renews.
Is the Candy AI App Safe?
The official Candy AI service is currently accessible through the Candy.ai website and provides Add to Home Screen installation instructions for mobile users. This is safer to verify than simply searching an app store for the brand name.
A current Google Play result titled "Candy AI: AI Companion App" is published by SkyLabs Digital rather than EverAI Limited. Other similarly named products are also available. They may be legitimate products in their own right, but they should not be mistaken for the EverAI-operated Candy.ai service.
To use the official Candy AI covered here:
- Open your browser.
- Type candy.ai directly.
- Verify the domain.
- Sign in.
- Use Candy AI's own Add to Home Screen option if you want an app-like icon.
Is Candy AI Safe for Payment?
Candy AI uses third-party payment providers and explains payment processing in its Privacy Notice. Depending on the method, information processed can include:
- Name
- Card brand
- Last four card digits
- Transaction date and time
- Amount
- Currency
- IP address
- Recurring billing type
Candy AI names payment-related providers including Emerchantpay, TrustPay, Volt, Coingate and UpGate in the current privacy document, depending on the relevant payment route.
That is normal for an international subscription service. Users should still check that the checkout is loaded from the official Candy AI flow before entering payment information.
What appears on the Candy AI bank statement?
Billing descriptor
Candy AI's current subscription pages say:
Charge shown as 'EverAI' on your bank statement.
This provides more discretion than using "Candy AI" as the descriptor. EverAI is not a fake shell label for the transaction — it is the company operating the service.
Keep in mind that your bank still sees a payment transaction. Discreet billing means the product name is less obvious, not that the transaction becomes invisible.
Does Candy AI auto-renew?
Yes. Candy AI's current pricing pages state that subscriptions renew automatically for the same price and term unless cancelled.
This matters because the annual plan is billed for an entire year at once. If you purchase the $47.88 annual offer, set a reminder before the renewal date if you are not sure you want another year.
A legitimate subscription can still create an unwanted charge when a user forgets about auto-renewal.
Is Candy AI a Scam?
Calling Candy AI a scam would not be supported by the evidence I found. It has:
- A named corporate operator
- Working subscription pages
- A functional AI companion platform
- Current legal policies
- Privacy documentation
- Support channels
- Payment processing
- Character creation, chat, images, video, phone calls
The more reasonable criticisms relate to things such as:
- Token costs
- Automatic renewal
- The difference between marketing privacy language and detailed policy disclosures
- The need to distinguish official Candy AI from unrelated apps with similar names
Those are important issues, but they are not evidence that the service itself is fake.
Age Rules and Blocked Content
Is Candy AI safe for minors?
Its Community Guidelines say users must be at least 18 years old or the legal age required in their jurisdiction. Its Underage Policy describes an age gate and says Candy AI may implement additional age verification or age-estimation measures where required. The service is an adult AI companion platform. Parents should not treat it as a general chatbot intended for children or teenagers.
What content does Candy AI block?
Candy AI's Blocked Content Policy, revised July 2026, prohibits categories including:
- Illegal content
- Hate speech and discrimination
- Violence and harm
- Child exploitation
- AI content resembling minors
- Privacy and copyright infringement
- Deceptive or harmful impersonation
- Celebrity impersonation used deceptively
- Non-consensual intimate imagery
- Images intended to resemble actual persons as harmful deepfakes
The exact policy contains more detail and should be read directly if your use case is close to a restricted area.
Does Candy AI moderate private chats?
Yes, Candy AI says moderation controls apply even though conversations are generally confidential.
Its Blocked Content Policy says proprietary LLM-based moderation can detect prohibited content. If something is flagged, Candy AI may manually review the flagged material or other content associated with the account and take action.
Possible actions include:
- Removing content
- Suspending access
- Terminating an account
- Reporting certain illegal material to relevant authorities
"Private chat" does not mean "no moderation".
Candy AI and real-person deepfakes
Candy AI's current policies prohibit harmful or non-consensual real-person deepfakes and misleading impersonation. Its Community Guidelines also prohibit creating or sharing images that resemble real persons in prohibited contexts.
This matters because users sometimes assume an adult AI image platform permits any celebrity or private-person generation. Candy AI's current policy direction is centred on fictional adult characters rather than unauthorised real-person sexual imagery.
Data Retention and Your Rights
Candy AI data retention
Candy AI's July 2026 Privacy Notice describes several retention periods.
General account data
Up to 3 years
After the last account activity, where no other legally required retention period applies, with possible operationally shorter periods in some circumstances.
Financial records
10 years
Financial and transactional information can be retained where required for tax and accounting obligations.
Debug log files
30 days
The notice says debugging log files containing user interactions, user IDs and timestamps are automatically deleted after 30 days.
The policy also says account-related personal data can be deleted without undue delay when a valid deletion request applies, subject to legal exceptions. Marketing data has separate retention logic.
Different data categories have different retention rules. The 30-day log deletion should not be confused with the retention period for every other category of data on the service.
Can you delete Candy AI data?
Candy AI's Privacy Notice describes data-subject rights under GDPR and other applicable laws. Depending on where you live, rights can include:
- Access
- Rectification
- Erasure
- Restriction of processing
- Data portability
- Withdrawal of consent
- Objection to certain processing
- Objection to direct marketing
Legal exceptions can apply. Candy AI lists privacy contact information in the policy for users who want to exercise those rights.
Privacy Risks You Should Understand
Intimate conversations reveal preferences
Even when you never type your real name, the content can reveal personal interests and preferences.
AI providers may process messages
Candy AI's privacy notice allows third-party AI model or hosting providers to receive chatbot message content as part of delivering the service.
Flagged content can be reviewed
Moderation can involve human review.
De-identified data can be used for development
Candy AI says de-identified or anonymised interactions may contribute to research, quality assurance and model improvement.
Lookalike apps exist
Entering your real Candy AI password into an unrelated mobile app creates an avoidable security risk.
Subscription renewal is automatic
Financial privacy and safety include knowing what will be charged and when.
How to Use Candy AI More Privately
- Keep fiction fictional. There is rarely a need to give the character your exact home address, employer or legal identity.
- Separate your online identity. Use a screen name and a dedicated email where appropriate.
- Do not upload or enter secrets. Avoid passwords, recovery codes, card details and confidential work information.
- Use the official website. Bookmark candy.ai rather than searching app stores every time.
- Check generated content before sharing it. Once you export or publish content elsewhere, Candy AI's account privacy controls no longer control where that file travels.
- Read the current privacy policy. Policies can change. The current version is dated July 30, 2026.
- Cancel before renewal if needed. Do not wait until after a long-term renewal and assume cancellation automatically means a refund.
Candy AI vs a Private Messaging App
Do not apply expectations from Signal or another secure person-to-person messenger to an AI companion service.
An AI companion has to process what you type in order to generate responses. It may also use:
- LLM providers
- Moderation systems
- Quality controls
- Personalisation systems
- Content-generation models
That creates a different privacy model from a messenger whose main job is simply transporting encrypted messages between two humans.
Candy AI can be private enough for ordinary fictional companion use without being the right place for your most sensitive real-world secrets.
Candy AI Safety Checklist
Before using Candy AI regularly, check these ten things:
- You are on candy.ai.
- You meet the adult age requirement.
- Your password is unique.
- You understand the subscription renews automatically.
- You know the bank descriptor is EverAI.
- You understand Premium includes token-based extras rather than unlimited media.
- You have read the current privacy notice.
- You are not entering unnecessary sensitive personal information.
- You understand moderation can review flagged content.
- You avoid unrelated app-store products using similar branding.
If all ten are clear, you understand the biggest practical risks.
Candy AI Safety FAQ
Yes. Candy AI is operated by EverAI Limited, a Malta-registered company identified in the platform's Terms of Service and Privacy Notice.
I found no basis to describe the official Candy.ai service as a scam. It is a functioning paid AI companion platform with published policies and a named operator.
Conversations are described as generally confidential, but Candy AI's privacy and moderation policies allow message processing, third-party AI providers and review of flagged content.
Candy AI uses automated processing to provide the service, and flagged content may be manually reviewed. The privacy notice also says third-party LLM providers or hosters may receive message content.
Its current Privacy Notice says aggregated, anonymised or de-identified interactions may be used to train and develop AI models and moderation technologies.
Candy AI uses third-party payment processors and publishes information about payment data processing. Always make sure you are using the official Candy.ai checkout.
Current Candy AI pricing pages say the charge appears as EverAI.
The official service currently runs through Candy.ai and provides a home-screen installation flow. App stores also contain similarly named products from unrelated developers.
Yes. Candy AI requires users to be at least 18 or the applicable legal age in their jurisdiction.
Candy AI's current policies prohibit harmful, deceptive and non-consensual real-person deepfake content and content resembling minors.
The Privacy Notice describes rights to request erasure in applicable circumstances, subject to legal and contractual exceptions.
Yes. Current Premium pages state that subscriptions automatically renew for the same price and term unless cancelled.
Final Verdict: Is Candy AI Safe?
Candy AI is legitimate, but the right question is not simply whether the website is real.
The better question is: Do you understand what happens to your data, money and content when you use it?
Candy AI is transparent enough to publish detailed policies explaining account data, AI interactions, moderation, payment processing and retention.
Those same policies show why users should keep realistic expectations.
Your chats are not public social-media posts, but they are processed by an AI service. Third-party providers can be involved. Flagged material can be reviewed. De-identified interactions can be used for product improvement and model development.
For ordinary fictional AI companion use, that may be an acceptable trade-off.
For highly sensitive secrets, identifying information or confidential business data, it is not a place I would recommend using as a private vault.
Use the official candy.ai site, avoid lookalike mobile apps, keep unnecessary personal information out of chat, understand the token and renewal system, and review the privacy controls that apply in your region. With those precautions, Candy AI is a legitimate adult AI companion platform that can be used with a sensible level of privacy awareness.
Now that you have the full picture
Visit Candy AI
If the privacy trade-offs above are acceptable to you, Candy AI is a legitimate adult AI companion platform. Always start from the official domain. Adults 18+ only.
Affiliate link. We may earn a commission at no extra cost to you. This does not change what we report about privacy or security.
More Candy AI Guides
Official Sources Used for Verification
- https://candy.ai/terms-of-service
- https://candy.ai/privacy-policy
- https://candy.ai/community-guidelines
- https://candy.ai/blocked-content-policy
- https://candy.ai/underage-policy
- https://candy.ai/subscriptions
- https://candy.ai/