Is Candy AI Safe?
Yes, Candy AI is a legitimate, registered business, not a scam. EverAI Limited in Malta runs it, card charges show as "EverAI" and you can cancel any time in Settings. The real trade-off is privacy: Candy moderates chats, can have people review flagged content and keeps account data after you leave.
"Safe" means three different things for Candy AI. Is the company real, and will billing behave? Is your data handled in a way you can live with? And is the content itself adult-only and legal? We read Candy's own legal pages and help center for this page and quote them where it matters. Where nobody outside Candy can check something, we say so.
Candy AI safety checklist
| Question | Short answer | Source |
|---|---|---|
| Who runs it? | EverAI Limited, registered in Malta | Terms of service |
| What shows on my card? | "EverAI" | Help center |
| Can I cancel? | Yes, any time, in Settings | Terms, section 10.1 |
| Refunds? | Only on request, in narrow cases | Terms, section 10.4 |
| Adults only? | Yes, 18+, behind an age gate | Underage policy |
| Are chats private? | Generally, but moderated and reviewable | Terms, section 5.4 |
| Real people filmed? | No. AI only, plus licensed digital twins | 2257 page |
Who is behind Candy AI
Candy's terms of service name the company outright: the services "are owned and operated by EverAI Limited, duly incorporated in the Republic of Malta". The same page gives the address (56 Central Business Centre, Triq Is-Soll, Santa Venera, Malta) and the Malta Business Registry number C107181. The privacy notice repeats those details, and so does the footer of the subscriptions page. An anonymous storefront would not publish this much.
Two consequences matter for a US user. First, Candy's terms are governed by Maltese law, and disputes go to "the courts of the Republic of Malta". Second, the business can be reached: support, refund and privacy requests all go to support@candymail.ai, and the privacy notice names a Data Protection Officer at DPO@everai.ai.
Billing: what you will see on your statement
Discretion is the first thing most people ask about. Candy's help center says the charge "will be displayed as "EverAI"" on your credit card statement. Premium renews on its own: the terms say "Subscriptions are set to renew automatically at the end of each subscription period", and any price increase "will be communicated to you in advance of any autorenewal at the increased price".
The billing lines Candy showed an anonymous US visitor on candy.ai/subscriptions on Oct 19, 2026:
- Annual payment billed as $47.88
- Quarterly payment billed as $26.97
- First month billed as $9.99.
- Then renews monthly at $13.99.
- Payment every 2 weeks billed as $9.79
- Weekly payment billed as $5.6
The same page says "Cancel any time." According to the help center, Candy takes credit and debit cards, crypto, Apple Pay, Google Pay and bank transfer, depending on your country. One detail to know: if a renewal charge fails, the terms let Candy "charge your designated backup payment method" if you saved one.
Cancelling and refunds
Cancelling is self-serve: My Profile, then Settings, then Unsubscribe. Premium stays on until the end of the period you paid for. A refund is a separate request with tight conditions. Candy's terms say "You have 24 hours after your payment to request a refund", and a subscription refund is refused "if you have used more than 20 tokens". The full steps, and the open question of what happens to your tokens, are in our Candy AI cancel guide.
Privacy: what Candy's own documents say
Your chats are moderated
The terms say "conversations between users and AI Characters are generally private", then add that moderation controls run on them. If something is flagged, "we or authorized partners may access and manually review the flagged content and/or other content associated with the account". Treat the chat as private-ish, not as a diary.
Your inputs can train Candy's AI
The terms give EverAI a license to what you type and what the AI returns, including for "training, developing, enhancing, evolving and improving" its AI models. The privacy notice adds that third-party AI model providers "may receive the content of your messages exchanged with our chatbot".
Data stays after you leave
The privacy notice says account data is generally kept "For three years after your last Account activity", unless you ask for deletion, and that financial and transactional data is kept "ten years from their date of issuance" for tax and accounting. Cancelling Premium does not delete your account; deleting the account is a separate step in Settings.
How to use it with less exposure
- Sign up with an email address you do not use for work or banking.
- Keep your real name, address and workplace out of chats. Candy's own terms say users "should not disclose sensitive personal information".
- When you are done, cancel, then delete the account, then ask support@candymail.ai to confirm deletion if you want it in writing.
Age rules
Candy is adults only. Its underage policy says users "must affirm that they are above 18" at an age gate, and "We may also implement further measures to verify that users are adults, in accordance with local requirements." The privacy notice lists results of third-party age estimation or age and identity verification "as applicable based on your location", so depending on where you are you may be asked for more than a click. We have not tested which US states trigger an extra check. The same policy states zero tolerance for child sexual abuse material and says Candy reports known material to the National Center for Missing and Exploited Children.
Are real people in the videos?
No one films Candy Shorts. Candy's 18 U.S.C. 2257 page says "Any visual depictions that may be sexual are not performed by real human beings". The one exception is licensed likeness: Candy's content removal policy says any similarity to real people is coincidental "except in cases where a known person has given us their explicit consent and usage rights to maintain a digital version of themselves." In Candy Shorts that covers 6 real adult performers (Riley Reid, Mia Malkova, Lexi Luna, Asa Akira, Bonnie Blue, Sophie Dee). They licensed digital twins and did not film these scenes. Every other character is an AI-generated fictional adult.
Is Candy Shorts safe to watch?
Watching the free episodes is the lowest-risk way to try Candy. Episode 1 of every public series plays free with no account, episode 2 is free with a free account, and later episodes cost 12 tokens each (or 30 in 14 series). One exception: Simona Rossi: Wrong But Right gives more free episodes with an account. On this site, episode 1 plays from our own server, with no Candy account, no cookies and no third-party trackers (see our privacy page).
The real danger is the sites promising "leaked" full episodes. Paid episodes unlock per account and we found no public copy in the results we checked; treat "leak" downloads as risky (what actually circulates). The same goes for apps: Candy's help center says "Candy.ai does not offer a native mobile app for iOS or Android" and offers a home-screen web app instead, so treat any app-store download calling itself Candy AI with suspicion.
What we did not verify
Outside our checks
- We have not bought Premium or tokens, so we have not tested checkout, the Unsubscribe button or a refund ourselves.
- Token pack prices: Candy shows them only after login.
- Whether a Premium member still pays tokens per Shorts episode or gets paid episodes included.
- How Candy stores and secures data in practice. We can only quote its policies.
- Which US states trigger extra age verification.
How we check the catalogue itself is on How we verify.
FAQ
Is Candy AI legit or a scam?
Legit. Candy AI is run by EverAI Limited, a company registered in Malta, which its terms of service name with address and registry number. It bills openly, says you can cancel any time, and publishes refund, privacy and age policies. The trade-offs are auto-renewal, a narrow refund window and how much data it keeps.
What does Candy AI show on a bank statement?
Candy's help center says the charge on your credit card statement is displayed as "EverAI".
Can Candy AI staff read my chats?
Candy's terms say chats are generally private but moderated. If its controls flag something, Candy "or authorized partners may access and manually review the flagged content". The privacy notice also says third-party AI model providers may receive message content.
Does Candy AI sell your data?
Its privacy notice says it will not "disclose, sell, trade, or otherwise transfer" your personal data to third parties without consent (where required) or unless the notice says otherwise. It does share data with service providers such as payment processors, hosting and AI model providers, and asks for opt-in consent before third-party marketing.
Is Candy AI safe for minors?
No. Candy AI is for adults only. Its underage policy puts an age gate in front of the site, requires users to affirm they are over 18 and says Candy may add further age verification depending on local rules.
Does Candy AI have an iPhone app?
No native one. Candy's help center says it does not offer a native iOS or Android app; you can add the website to your home screen as a web app instead. Be wary of app-store downloads claiming to be Candy AI.
Can I get a refund from Candy AI?
Only in narrow cases. Candy's terms say you have 24 hours after payment to ask, and a subscription refund is refused if more than 20 tokens were used. Cancelling does not trigger a refund on its own. How to cancel and ask for a refund.