Is Candy AI safe? A privacy, billing and safety review for adults (2026)

Candy AI is a real company running a real product, not a scam. It is operated by EverAI Limited, registered in Malta, it has been running since 2023, and there is no publicly reported breach of it as of August 2026. For an adult who reads the billing terms before subscribing, it is reasonably safe to use. The risks that matter are not fraud. They are what the company is allowed to do with your chats, how the age check works, and a refund policy that is far narrower than most people expect.

Below is what we could verify from Candy.ai's own legal documents rather than from review sites, plus the parts we could not verify and have marked as such.

Who actually runs Candy AI

This is the first thing to establish about any adult platform, because it tells you which laws apply and who you would be dealing with in a dispute. Candy.ai's terms of service name the operator directly: EverAI Limited, incorporated in the Republic of Malta, at 56 Central Business Centre, Triq Is-Soll, Santa Venera SVR 1833, and registered with the Malta Business Registry under number C107181.

That matters in two practical ways. It is a named, registered European company rather than an anonymous operator, which is a point in its favor. But it also means a US customer is dealing with a Maltese entity under EU rules, and the terms carve out separate refund handling for EU and UK residents that US customers do not get. If you are in the United States, you are on the narrower track.

What happens to your chats

The section people should read and almost nobody does is the content license. Candy.ai's terms grant the company permission to "use, modify, exploit, create derivative works of, commercialize, and otherwise use and aggregate your Content," for purposes that explicitly include improving their products and services, training and improving their AI models and content moderation tools, and "marketing and promotional purposes." You also give permission to use your username and other identifying account information.

That is broad, and it is not unusual. Most companion platforms hold a similar license. What it means in plain terms: your conversations are business inputs, not private correspondence. They are stored on the company's servers so your companion stays consistent, and independent reporting on the privacy notice indicates that message content can be passed to third-party model providers, that AI training is among the stated processing purposes, and that human review of de-identified interactions can happen. Those last points come from reporting rather than from a document we could pull directly, so treat them as well-supported rather than quoted.

One thing we did check ourselves: Candy.ai's own pages load Mixpanel analytics configured with ignore_dnt: true. That setting tells the analytics library to keep tracking even when a visitor's browser sends a Do Not Track signal. It is a common configuration and it is not illegal, but if you assumed a browser privacy setting was doing something here, it is not.

The billing terms are the real trap

Almost every complaint about Candy AI online is a billing complaint, and reading the terms explains why. Three clauses do the damage.

First, subscriptions renew automatically. By subscribing you authorize the company to charge your payment method unless you cancel autorenewal, and the payment processes on the first day of the renewed period. Second, prices can rise: the terms reserve the right to increase subscription prices at the company's sole discretion, with advance notice before renewal at the higher rate. Third, and this is the one that catches people, the refund window is 24 hours, and it closes early.

The refund policy states you have 24 hours after payment to request a refund, and that no refund will be issued after that. It then adds that regardless of how quickly you ask, the request will be denied if you have used more than 20 tokens. Token purchases are non-refundable once the tokens are used at all, and only card payments can be refunded. Practically, that means trying the product properly and then deciding you do not want it puts you outside the policy, because using it is what disqualifies you.

On the plus side for discretion, charges appear on statements under the operating company name rather than anything explicit. That is genuinely useful if you share a bank account. It is also why an unexpected renewal can sit unnoticed for months, so if you keep several subscriptions running it is worth having something that tells you before a recurring charge lands rather than finding it on a statement later.

Verified facts, at a glance

Is Candy AI safe for kids?

No, and it is not built to be. Candy AI is an adult platform that generates explicit text and images, and its age check is a declaration that you are 18 or over rather than a document or face check. A determined teenager clicks past it in one second. If you are a parent who arrived here after finding the site in a browser history, the useful answer is that the platform has no meaningful technical barrier for minors, so the control has to sit on the device or the network instead.

This is the gap regulators have started closing. California's SB 243 took effect on 1 January 2026 and imposes disclosure and safety duties on companion chatbot operators, and the FTC opened a 6(b) inquiry into companion AI companies in September 2025. Enforcement against offshore operators is slow, so do not wait for it to reach a Maltese company.

Questions people actually ask

Is Candy AI a scam?

No. Candy AI is operated by EverAI Limited, a company registered in Malta since 2023, it processes payments through standard providers, and it delivers the product it advertises. The complaints that circulate are about auto-renewals and refused refunds rather than fraud, and those trace back to a refund policy that is genuinely restrictive rather than to dishonesty.

Does Candy AI show up on your bank statement?

Charges appear under the operating company name rather than the Candy branding or anything explicit, which is deliberate discretion. It also means a renewal you forgot about is easy to miss on a statement. If discretion is why you are asking, that part works. If you are trying to find a charge you do not recognize, look for the operator name instead of the product name.

Can you delete your Candy AI data?

You can delete your account through account settings, and as a Maltese company EverAI is subject to GDPR, so you can also make a formal deletion request. Two caveats matter. Content already used to train or improve a model does not come back out of that model, and the terms let the company remove account content after periods of inactivity on its own schedule.

Is Candy AI private?

It is discreet, but it is not private in the sense most people mean. Traffic is encrypted in transit and there is no reported breach, yet your chats sit on company servers, the terms grant broad rights to use them, and the company has not publicly claimed end-to-end encryption. Treat anything you type as something the operator could read, and never put real financial or identifying details into a companion chat.

How do I cancel Candy AI?

Go to Settings and choose Unsubscribe inside your account, and do it before the renewal date. Cancelling stops the next charge but leaves your access running until the current billing period ends, and your account then reverts to the free version. Unused tokens do not convert to a refund, so spend or forget them rather than expecting money back.

How to use any companion app safely

The practical rules are the same whichever platform you pick, and they cost nothing. Use an email address that is not your main one. Pay with a card you can cancel, or a virtual card number, rather than a debit card tied to your primary account. Put a calendar reminder two days before any renewal date. Never share your real full name, address, employer, or anything financial, because none of it improves the conversation and all of it increases what a future breach would expose. And read the refund clause before you pay, not after, since that is where the money actually goes wrong.

It is also worth deciding what you want the product for before you choose one, because the safety tradeoffs differ. If explicit image generation is the point, Candy is built for it and you are accepting the data profile that comes with it. If you mostly want conversation with someone who remembers you, you are paying that privacy cost for a feature you barely use. We compare the options on both counts on our Candy AI alternative page, and the same credit-metering question comes up on the Nectar AI alternative page. There is a broader look at the category's data practices in our guide to AI companion app privacy.

The verdict

Candy AI is safe in the ways people usually mean when they ask: it is a legitimate company, it is not stealing card details, and it has no known breach. It is less safe in the ways people forget to ask. The content license over your chats is broad, the age gate is a checkbox, and the 24-hour refund window that voids after 20 tokens is the strictest we have read in this category. Go in with a spare email, a cancellable card, a calendar reminder, and no personal details in the chat, and the remaining risk is small.

If the tradeoff you actually want to avoid is the metering and the explicit-by-default posture, that is a product choice rather than a safety one. Aroused is adults only, never explicit by permanent policy, priced as a flat monthly allowance with memory included rather than tokens, and funded by subscriptions rather than engagement. You can try the demo in your browser before creating an account.