Is Candy AI Safe? What the Fine Print Actually Says

The short answer

Yes, Candy AI is safe enough for most adults who keep their real name out of it. It's run by a registered company, the terms are written down, and there's no public record of a data breach as of October 2026. But "safe" covers a lot of ground. Your chats aren't end-to-end encrypted, they can be used to train models, and the refund policy is tighter than a drum. If you're picturing a private diary, adjust that picture.

We rate Candy.ai 9.8 out of 10 overall. That score reflects the whole package — pictures, chat, billing, privacy — not just the safety question. For a deeper look at what you get for your money, see our Candy.ai review.

Who is behind Candy AI?

Candy AI is operated by EverAI Limited, a company registered in Malta under number C107181, with an office in Santa Venera. Maltese law governs the contract. EverAI is the data controller, which means it decides how your data is used and is the entity you'd chase for a GDPR request.

The privacy notice claims compliance with GDPR and CCPA. That's a company statement, not a regulator's stamp. No public audit of EverAI's data handling exists.

So it's not a nameless offshore shell. That matters when you're deciding whether to hand over a credit card.

Privacy and data handling: what actually happens to your chats

This is where the picture gets less comfortable.

Encryption in transit, not end-to-end

In an October 2026 test, the site used HTTPS over TLS 1.3. That means data between your browser and the server is encrypted. Reviews claim AES-256 encryption at rest, but the privacy notice is vague and we couldn't verify it.

More importantly, there is no end-to-end encryption. Your messages are readable on the server. That's not unusual for AI chat apps, but it means "private" has limits. If someone inside the company wanted to read a conversation, the architecture wouldn't stop them.

For comparison, Secrets AI promises AES-256 at rest and immediate chat deletion. OurDream AI advertises end-to-end encryption, but its own policy describes server-side access — a contradiction worth knowing about. We compare the three in Secrets AI vs Candy AI.

Training and human review

Your prompts and outputs may be de-identified and used to train models, including moderation models. The privacy notice describes no opt-out from this. That's a real difference from apps that let you flip a switch.

Flagged messages may be manually reviewed by authorized partners. De-identified chats may also be reviewed for training data. In plain terms: if the automated filter catches something, a human might read it.

Third parties

Outside LLM providers, hosting companies, and moderation vendors may receive message content. The company says it won't sell, trade, or transfer personal data without consent. That's a promise, not a technical guarantee.

The license you grant

Section 4 of the terms grants Candy AI a royalty-free, sub-licensable, worldwide, perpetual license to your input. The company says it never claims ownership of your content. Ownership and license are different things. You keep the copyright; they get broad rights to use what you type.

How long your data sticks around

According to the privacy notice, data is kept up to 3 years after your last activity — possibly 1 year. Financial records are kept for 10 years because tax law demands it. Log files last 30 days.

That 3-year window is long. It means deleting your account doesn't necessarily wipe everything immediately.

To reset a single conversation, use Reset Chat — it clears that chat's history and memory. To delete everything, go to Settings > Danger Zone and delete your account. Then email [email protected] to request erasure under GDPR. Keep a copy of that email. You have rights to access, rectification, erasure, portability, and objection, but you have to exercise them.

Billing, refunds, and the token trap

This is where most complaints start.

Subscriptions auto-renew until you cancel in settings. After cancellation, premium access continues until the period ends. Charges appear as "EverAI" on your statement — a name you won't recognize if you forgot you signed up.

Refunds are only available within 24 hours and only if you've used 20 tokens or fewer. Card payments only. No refund for user-side technical issues or moderated content. EU and UK users have a 14-day withdrawal right minus usage.

And the sticker price isn't the real price. Each subscription includes only 100 tokens a month. Image and video generation spends tokens beyond that. So a $12 plan can turn into a $30 month if you generate a lot of pictures. That's not a scam, but it is a surprise.

Age and content rules

Candy AI is 18+ only. The age gate is self-declared, though third-party age estimation may apply. The company has zero tolerance for underage content and reports known CSAM to NCMEC.

Explicit chat and fictional adult images are allowed. Real-person likeness is banned. An automated filter can flag messages, which ties back to the human review point above.

Scam signals vs reality

Some complaints about Candy AI are legitimate. Others are misunderstandings. Here's how to tell them apart.

Looks like a scam	Reality
Unknown "EverAI" charge on your card	Legal billing name for Candy AI
Charged again after subscribing	Media costs tokens beyond the monthly allowance
Refund denied	24-hour, 20-token rule
APK or app link	Not official; Candy AI is web only
Support asks for gift cards	Real scam — no legitimate support asks for gift cards

Note the last row. Gift card requests from "support" are a real scam. Candy AI has no official app or APK. If you see one, it's fake. Stick to the official help center, Discord, X, Instagram, TikTok, or YouTube.

The Trustpilot profile was removed for guideline violations; it sat around 3.8 of 5 before that. Refund and token complaints are common. That doesn't make the company a fraud, but it tells you where the friction is.

Safety at a glance

Question	Answer
Real company?	Yes — EverAI Limited, Malta, C107181
Scam?	No, but refunds are strict
End-to-end encrypted?	No — transit encryption only
Chats train models?	Yes, de-identified, no opt-out
Retention	Up to 3 years after last activity
Statement name	EverAI

How it compares to other AI companions

If privacy is your main concern, Candy AI isn't the strongest option. Secrets AI markets itself on memory and deletion, though it costs more. OurDream AI pushes media generation but has a fuzzy privacy story. Joi AI and Muah AI are other names in the mix.

We've compared Candy AI to most of them: Candy AI alternatives, Joi AI vs Candy AI, Muah AI vs Candy AI, and Candy AI vs OurDream AI. The short version: Candy AI wins on picture quality and loses on memory and privacy fine print.

Emotional safety is part of the equation

Nobody talks about this in the terms of service, but it belongs here. These apps are designed to keep you engaged. That can affect sleep, spending, and real relationships. If you find yourself spending more than you planned or feeling worse after chats, that's a signal to step back. Candy AI is a product, not a therapist.

Your safety checklist before you sign up

1. Use a pseudonym and a separate email. Don't type your real name, address, or workplace.
2. Pay with a card you can dispute, not crypto. Crypto payments can't be refunded.
3. Set a calendar reminder before the renewal date.
4. Keep an eye on token use — each plan includes only 100 tokens a month.
5. If you cancel, do it in settings and screenshot the confirmation.
6. If you want your data gone, delete the account in Danger Zone and email support for erasure. Keep a copy.
7. Ignore any APK, app store listing, or support message asking for gift cards. They're fake.

Bottom line

Candy AI is a real, regulated platform. It's reasonably safe if you protect your identity and watch your money. The weak spots are privacy and billing: no end-to-end encryption, training without opt-out, outside providers, long retention, and refunds that expire in 24 hours. Use a pseudonym, keep sensitive details out of chat, and mind the renewal. That's the whole game.