Is Candy AI a real company?
Yes, on paper. The terms of service say Candy AI is owned and operated by EverAI Limited, registered in Malta under company number C107181 at 56 Central Business Centre, Triq Is-Soll, Santa Venera SVR 1833. Maltese law governs the terms.
That is the strongest point in Candy’s favour. A named, registered operator with a postal address and a legal information page can be contacted and held to its own rules.
There is also a help center at everai.zendesk.com and a separate Trust and Safety contact at helloeverai.zendesk.com.
Registration does not tell you about product quality, support speed or billing behaviour. It only tells you that a company stands behind the site. For the wider picture, read the full Candy AI review.
Is Candy AI legit, or a scam?
I found nothing in the documents or in my own three months of paid use that suggests a scam. That view combines my experience with what the company publishes. I have not tested support response times, so I cannot vouch for how a dispute would go.
What supports “legit”:
- A registered operator with a company number.
- Published terms, privacy policy, blocked content policy and refund rules.
- A stated 18+ requirement.
- A written refund process and a stated cancel route.
What to be careful about:
- The exact price shows at checkout, not on a public page.
- The refund window is only 24 hours.
- Chats are licensed for AI training.
These are disclosed terms, not hidden ones. The risk is mostly that people do not read them before paying.
Is Candy AI safe to pay for?
Candy AI is reasonably safe to pay for if you pay by card, read the checkout total and keep your receipts. The terms list credit card, Pay by Bank and other alternative methods, and refunds apply only to card purchases within a short window.
A backup payment method can be charged if a renewal fails. Crypto is not stated as a payment method.
| Rule | What the terms say |
|---|---|
| Refund window | Request within 24 hours of payment |
| Token use | Subscription refund denied if you used more than 20 tokens |
| Eligible payments | Card purchases only |
| EU and UK | Withdrawal right, refund less a prorated amount for services used, within 14 days of notice |
| Chargeback | Immediately cancels the subscription and revokes tokens |
| Auto-renewal | Subscriptions renew monthly, quarterly or annually |
Two of these matter most. The 20-token rule means that generating a few images in the first hours can end your refund right. The chargeback rule means disputing with your bank is not a free option: the account is cancelled at once and tokens disappear.
Pricing detail is on the Candy AI pricing page.
What does the refund timeline look like?
Hour 0 is payment. Between hour 0 and hour 24 you can ask for a refund, if you have used no more than 20 tokens. After hour 24 the window has closed. At my account’s rate of 3 tokens a minute for voice calls, 20 tokens is about 6 and a half minutes, which is arithmetic, not a Candy claim.
If you are in the EU or UK, a separate withdrawal right applies, with a refund less a prorated amount for services used, within 14 days of notice. I have not made a refund request myself, so this is what the terms say, not what I experienced.
What did my billing look like over three months?
I paid $13.99 a month on the monthly plan. The card statement descriptor was EverAI, which matches the operator named in the terms. The subscription renews automatically, so I watched the renewal date and kept my receipts and confirmation emails.
Intro and renewal pricing can differ, so compare each charge with what you expected. Candy does not publish why the statement shows the parent company name. Billing under a parent company is common, but that is my inference. Adult sellers also face extra card-network rules: Mastercard requires banks to certify consent and age checks, as reported by Fox Business (Fox Business). I could not confirm Visa’s rules.
Is Candy AI private? Can staff read my chats?
Candy describes chats as generally private, but the terms say flagged content may be manually reviewed by staff or partners. So private here does not mean nobody can ever read it. If moderation flags a conversation, a person may look at it.
The privacy notice adds human review of de-identified interactions as part of preparing training datasets. De-identified means identifying details are removed, but I cannot tell you how thoroughly Candy does that.
What triggers a flag is not published. The blocked content policy lists the categories Candy bans, such as child sexual abuse material, content resembling minors, illegal content and content promoting violence or self-harm. Moderation also interrupted some of my prompts, depending on how I worded them.
Does Candy AI train on your chats?
Yes. The terms license your input for training and improving AI models and for moderation, and the privacy policy says data is used to train and develop AI models and moderation technologies and to prepare datasets.
In plain terms, a licence means Candy has your permission to use what you type to improve its systems. It does not mean Candy owns your chats, and I did not see wording that says it does.
Assume anything you type can feed that process. If you would be uncomfortable with that, do not type it. That includes real names, your address, workplace details or anything you would not want attached to an account.
OurDream’s privacy policy also lists training AI models among its purposes, so this is not unique to Candy. It is still worth knowing before you decide. See the OurDream AI review for how it handles this.
Does Candy AI sell your data?
No, according to its own policy. The privacy policy says Candy will not disclose, sell, trade or otherwise transfer personal data to third parties without consent. The exception is a merger or acquisition.
That is a clear commitment, and the difference is worth holding onto. Selling data is ruled out. Using it internally for training is permitted. A merger exception means data could move to a new owner, under whatever terms that owner sets.
For comparison, Mozilla’s 2024 review of 11 romantic chatbots found that 90% sold data, shared it for targeted ads or had policies too vague to rule that out, per Infosecurity Magazine (Infosecurity Magazine). A clear no-sale statement is better than a vague one, though a policy is a promise, not an audit.
How long does Candy AI keep your data?
Candy typically keeps data for three years after your last account activity. The policy says this may shorten to one year after last activity or the end of a subscription. Deletion happens on request.
In practice, walking away from the app does not remove your data. A chat history you stop using can sit on a server for up to three years. If that bothers you, send an erasure request instead of waiting.
How to cancel and request erasure, step by step
Cancelling and deleting are separate steps. Cancelling stops billing, and erasure removes data.
- In your account, go to Settings, then Unsubscribe, and confirm. Access continues to the end of the paid period.
- Keep the confirmation email, and check your card statement at the next renewal date.
- Request erasure of your personal data. I saw no in-app deletion steps, and the privacy notice says data is deleted without undue delay once you request it.
- As advice, not something I tested: send the request through the help center listed on the legal information page, from the email address on the account, and keep a copy of what you sent.
- Do not use a chargeback to force the issue, because it cancels the account at once and revokes tokens.
OurDream is simpler here: its help center describes in-profile deletion that is permanent and takes 24 to 48 hours (OurDream help center).
What happened to other AI companion apps, and why does it matter?
Other companion apps have leaked private chats, and that is the main reason to use a separate email and keep identifying details out of messages. I found no report of a breach at Candy, and that is the absence of evidence, not a guarantee.
- Muah.ai: a 2024 breach exposed 1.9 million email addresses alongside prompts to generate AI images, according to Have I Been Pwned. The data classes included AI prompts and email addresses.
- Chattee Chat and GiMe Chat: an unprotected server leaked 43 million messages and more than 600,000 images and videos from over 400,000 users of two apps by Imagime Interactive, found by Cybernews and reported in 2025 (Malwarebytes). Names and emails were not exposed, but IP addresses and device IDs were.
- Mozilla’s review: all 11 romantic chatbots it examined got the warning label, and 54% blocked data deletion, per Infosecurity Magazine.
Why the Muah case matters most: the exposed data linked email addresses to prompts. If your Candy account email contains your real name, a leak would connect your name to what you wrote. A throwaway address breaks that link.
What are the age rules and banned content?
Candy requires users to be at least 18, or the age of majority where they live, per its privacy policy. The blocked content policy states zero tolerance for child sexual abuse material, content resembling minors, illegal content and content promoting violence or self-harm.
Separate Community Guidelines and Underage policies also exist. If you are under 18, or share a device with someone who is, this is not a service for you or them.
Do AI companion laws apply to Candy AI?
Some new laws target companion chatbots, but my research cannot say how they apply to Candy, because Candy’s pages I read do not appear to discuss them. Here is what the laws require, so you know what to look for.
- California SB 243: effective 2026, it requires a clear notice that users are talking to AI where a reasonable person could think otherwise, published suicide and self-harm protocols, and extra steps for minors (Skadden).
- New York: effective 2025, it requires operators to detect suicidal ideation and refer to crisis services, and to tell users they are talking to AI at session start and every three hours (NY Governor’s Office).
- FTC: in 2025 it opened a 6(b) study of companion chatbots and children, sending orders to Alphabet, Character Technologies, Instagram, Meta, OpenAI, Snap and X.AI (FTC). A 6(b) study is not an enforcement action, and Candy was not among the named companies.
Whether these laws reach adult NSFW companions beyond their minor-specific duties is not settled in my sources and needs a statute or counsel check. I do not claim Candy is or is not compliant.
Why is there no Candy AI Trustpilot page?
The official trustpilot.com/review/candy.ai profile is currently removed, with a notice that it goes against the platform’s guidelines. Third-party snapshots of the old score conflict with each other, so I do not quote one.
That means you cannot use Trustpilot as an independent check on this brand right now. It is not proof of fraud either. Profiles can be removed for several reasons, and I do not know which applies here.
Rely on the written terms, which you can check yourself, over a review score from a source you cannot verify.
Is the Candy AI app safe to use?
Third parties describe Candy as a web app that can be installed as a PWA, and the site ships PWA icons. I found no official store listing from EverAI. Be careful with any store app using a similar name, because I cannot confirm it is run by the operator.
Using the website directly also keeps billing with Candy, which makes the cancel and refund steps in the terms the ones that apply.
How can you use Candy AI more safely?
Use a separate email, pay by card, keep personal details out of chats and cancel before renewal. These steps follow from the rules above and cost nothing.
- Use a separate email address that does not include your real name.
- Pay by card, since refunds are only for card purchases, and check which name appears on your statement. Mine showed EverAI.
- Do not type personal details you would not want stored or reviewed.
- Decide inside 24 hours whether to keep the plan, and avoid spending tokens before then if you might want a refund.
- Set a reminder before the renewal date, because subscriptions renew automatically.
- Cancel from Settings, then Unsubscribe.
- If you leave, request erasure of your data.
- Contact support before any chargeback.
Companionship apps can also shape habits. A Harvard Gazette report on research across companion apps found bots used at least one manipulation tactic in more than 37% of goodbye conversations (Harvard Gazette). That study did not cover Candy specifically, so I mention it only as a reason to set your own time and spending limits.
How does Candy AI compare with OurDream on safety?
Both are adult services with 18+ rules and published policies, and they differ in the details. OurDream offers a longer refund window and in-profile deletion, while Candy states more plainly that chats are licensed for training.
| Area | Candy AI | OurDream AI |
|---|---|---|
| Operator | EverAI Limited, Malta | Dream Studio USA, Inc., Delaware |
| Refund rule | 24 hours, 20-token cap, card only | 14-day quality guarantee, case by case; no refund past 25% used |
| Crypto | Not stated | Accepted, final and non-refundable |
| Account deletion | Request erasure | In profile, permanent, 24 to 48 hours |
| Training on data | Yes, per terms and privacy notice | Listed in privacy policy |
| Data sale | Says it will not sell | Says it will not sell chats |
Read the OurDream AI review for the full picture, or the direct Candy AI vs OurDream AI comparison.
Our verdict on Candy AI safety
Candy AI looks like a legitimate, registered service that publishes its rules. The risks are in those rules: a 24-hour refund window, a 20-token cap, chat training, possible manual review of flagged chats and a typical three-year retention period.
If you are comfortable with that, take the precautions above and try it. You can start at Candy AI. I may earn a commission, see the affiliate disclosure. The how we review page explains how I check these things.
Back to the Candy AI review or the reviews index.