Is Candy AI safe? Legit company, billing, privacy and age rules

Candy AI is a legitimate, registered business, not a scam: it is run by a named Maltese company, publishes full terms and a privacy notice, and bills under a disclosed merchant name. Whether it is safe for you depends on three things the documents make clear: auto-renewing billing with a narrow refund window, chats that can be reviewed when flagged and used in de-identified form for training, and age checks that rely mostly on self-declaration.

This guide answers the common questions (is Candy AI safe, is it legit, is it a scam, is it real) using only Candy AI's official pages, checked on October 23, 2026. We did not buy a subscription. For plans and features, see the Candy AI review.

According to the Terms of Service, Candy AI is owned and operated by EverAI Limited, incorporated in Malta, registration number C107181, at 56 Central Business Centre, Triq Is-Soll, Santa Venera, Malta. The same company name and address appear in the site footer and on the subscription page. Disputes fall under the courts of Malta.

Candy AI's own FAQ answers "Is Candy AI legitimate and safe to use?" with "Yes", citing encrypted transactions, GDPR-compliant privacy standards and discreet billing. That is the company's claim about itself. The verifiable parts are the registered operator, the published policies and the billing descriptor: the subscription page states the charge is shown as "EverAI" on your bank statement. Support is reachable through the in-app contact area and [email protected].

Most "is it a scam" worries about subscription apps come from billing rules people did not read. Candy AI's rules are published, but some are strict:

• Auto-renewal. Every plan renews automatically for the same term. The terms allow price increases, with notice before the renewal at the new price.
• Free tier. A free user can generally send a maximum of 5 messages; after that, a subscription is needed.
• Refund window. A subscription refund must be requested within 24 hours of payment, and is refused if more than 20 tokens were used. Only card payments are refundable. EU and UK users have a separate withdrawal right on the first purchase.
• Tokens expire. Paid plans include about 100 tokens a month. When a subscription ends, remaining tokens expire and do not carry over.
• Backup card. If a renewal charge fails, the terms authorize a charge to a saved backup payment method.
• Chargebacks. Filing a chargeback cancels the purchase immediately and revokes remaining tokens.

None of this is hidden, but it rewards checking before paying. Cancel auto-renewal in Settings if you only want one period. Our AI companion billing guide covers cancellation and statement descriptors across services.

The Community Guidelines require users to be at least 18 years old or of legal age where they live. The Underage Policy describes an age gate on entry where users affirm they are over 18, with a disclaimer that false age information breaks the terms. It adds that EverAI "may also implement further measures to verify that users are adults, in accordance with local requirements", and the privacy notice lists third-party age estimation or ID verification results "as applicable based on your location".

In practice, outside places where law requires stronger checks, access rests on self-declaration. Candy AI is an adult service and is not suitable for shared family devices.

Partly. The terms say conversations are "generally private", but they are not confidential from the operator:

• Human review when flagged. If moderation controls detect a possible violation, EverAI "or authorized partners may access and manually review the flagged content and/or other content associated with the account".
• Third-party AI providers. The Privacy Notice (revised October 19, 2026) says third-party LLM providers and hosts "may receive the content of your messages".
• Training. Interactions may be aggregated, anonymized or de-identified to "train and develop our AI models and moderation technologies"; preparing datasets may include human review of de-identified chats.
• Encryption. The FAQ promises TLS 1.2+ encryption in transit. End-to-end encryption is not claimed.
• Retention and deletion. Account data is generally kept for three years after your last activity, or deleted "without undue delay" when you ask for deletion. Data may be transferred outside the EU, including to the United States.

The terms themselves tell users not to share financial details, addresses, contact information or passwords in chats. Treat that as the baseline. The AI companion privacy guide explains these terms in more detail.

Candy AI does not let users upload photos. The Blocked Content Policy states that "users cannot upload or share content on the Services", and it has a "zero-tolerance policy for the creation or attempted creation of non-consensual intimate imagery and images intended to resemble actual persons". The Community Guidelines prohibit creating images that resemble real persons, and the Underage Policy says attempts to generate content resembling minors are flagged, reviewed and removed. EverAI states it reports known child abuse material to NCMEC.

For users, this means no one can upload your photo to Candy AI, and generated characters are meant to be fictional.

The characters are AI software, not people. The terms state that all exchanges "are entirely fictional" and that anything resembling reality, "such as offers of real-life meetings or promises of tangible outcomes, are entirely fake". The service is described as entertainment, "not intended as emotional or other forms of support"; the terms point users in distress to a qualified professional.

If a character asks for money, contact details or a meeting, that is generated text, not a person. Nothing in a chat should lead you to pay anyone outside the official checkout.

1. Confirm you are on the candy.ai domain before logging in or entering card details.
2. Read the plan's renewal term and price on the official subscription page, in your own currency.
3. Decide within 24 hours whether to keep the plan, and use fewer than 20 tokens if you might want a refund.
4. Turn off auto-renewal in Settings if you only want one period, and spend tokens before the period ends.
5. Keep identifying details and other people's information out of chats.
6. Request account deletion when you stop using the service.

If the billing or privacy rules do not suit you, compare Candy AI alternatives.

• Candy AI Terms of Service (revised September 22, 2026)
• Candy AI Privacy Notice (revised October 19, 2026)
• Candy AI subscription page
• Candy AI Community Guidelines
• Candy AI Blocked Content Policy (revised July 30, 2026)
• Candy AI Underage Policy
• Candy AI homepage and FAQ

All sources were checked on October 23, 2026. Policies change; check the revision date at the top of each document.