Is Candy AI Safe? Privacy, Billing and the Scam Signals That Aren't

The short answer

Yes, Candy.ai is a real product from a registered company. It is not a fly-by-night operation that takes your money and vanishes. But "legit" and "safe" are two different questions, and the second one has caveats that most signup pages won't spell out.

The short version: your card is probably fine, your conversations are not private in the way you might assume, and the refund policy is tight enough to sting. Here's the breakdown.

Safety quick answers

Question	Answer
Real company?	EverAI Limited, Malta, registration C107181
Scam?	No, but refunds are strict
End-to-end encrypted?	No; encryption in transit only
Do chats train models?	Yes, de-identified, with no opt-out we could find
How long is data kept?	Up to 3 years after last activity
What shows on your statement?	EverAI

Who actually runs Candy AI

Candy AI is operated by EverAI Limited, a company registered in Malta under number C107181, with an office in Santa Venera. Maltese law governs the contract. That matters more than it sounds: Malta sits inside the EU, which means GDPR applies to how your data is handled, and EverAI is named as the data controller.

The privacy notice cites both GDPR and CCPA as applicable frameworks. That's a company telling you which rulebooks it plays by. What we haven't seen is a published regulator audit of its data handling — nobody external has stamped this. So the promises are documented, not independently verified.

One practical detail: charges hit your statement as EverAI, not Candy AI. Plenty of people who file chargebacks or complain online never made the connection. If you see an unfamiliar EverAI line, check your subscriptions before you call your bank.

Privacy: what happens to what you type

This is where the honest answer gets uncomfortable. Candy AI runs over HTTPS — a check of the site in October 2026 showed TLS 1.3 — so traffic between you and the server is encrypted. Third-party reviews often claim AES-256 encryption at rest. The privacy notice itself only says "appropriate security measures." Those are not the same statement, and only one of them comes from the company.

What's clear from the policy:

• There is no end-to-end encryption. Chats are stored server-side, which means the operator can access them in principle.
• Prompts and outputs may be de-identified and used to train AI models and moderation systems. Training datasets can involve human review.
• Flagged messages may be manually reviewed by authorized partners.
• Outside LLM providers, hosting companies and moderation vendors may receive message content to make the service work.
• We found no opt-out from the training use.

The company does say it won't sell, trade or transfer your personal data without consent, which is the right line to draw. But "we don't sell it" and "nobody reads it" are different claims. Treat your chats as server-side records with a human review possibility, not a private diary.

Our advice is boring and effective: use a pseudonym, skip real names, addresses, employers and anything medical. If a detail would embarrass you in a screenshot, don't type it.

How long your data sticks around

Data is kept up to three years after your last activity — the policy allows one to three. Financial records are kept for 10 years for legal reasons, and log files for 30 days.

Inside the app, Reset Chat clears a single conversation along with its history and memory. To remove the account itself, go to Settings and use the Danger Zone option. Under GDPR you also have rights to access, rectify, erase, port and object, with consent, contract, legal obligation and legitimate interest as the stated legal bases.

For an erasure request, email [email protected] — and keep a copy of the email. Deleting chats does not guarantee immediate full erasure, and payment records stay put regardless. Crypto payments can't be refunded at all, which is worth knowing before you pay that way.

Billing, tokens and the refund window

Subscriptions auto-renew until you cancel in settings, and premium access continues until the paid period ends. The sticker price is not the real cost. Each subscription includes only 100 tokens a month, and image and video generation spend tokens fast. That gap between the advertised monthly fee and the actual bill is the single most common complaint about the platform.

The refund rule is narrow: within 24 hours and with 20 tokens or fewer used. Refunds go to the card only. You won't get one for technical problems on your end or for content that got moderated. EU and UK users have a 14-day withdrawal right, minus usage. Our full Candy.ai review breaks down where the token math bites.

Age rules and content limits

The platform is 18+ with a self-declared age gate; third-party age estimation may apply depending on where you are. Explicit chat and fictional adult character images are allowed. Using a real person's likeness is not. There's zero tolerance for underage content, and CSAM is reported to NCMEC.

An automated filter can flag your messages. That's the mechanism behind the manual review possibility above, and it's also why some users see content moderated without warning.

Scam signals, decoded

Search around and you'll find accusations of scamming. Most trace back to one of five things, and only one of them is an actual scam.

Looks like a scam	What's really happening
Unknown EverAI charge on your card	That's the legal billing name
Charged again after subscribing	Media generation costs tokens
Refund denied	The 24-hour, 20-token rule
An APK or app download link	Not official — the platform is web only
Support asks for gift cards	That one is a real scam

On the last row: no legitimate support team asks for gift cards, ever. Official channels are the help center, Discord, X, Instagram, TikTok and YouTube. There is no official app or APK — anyone offering one is impersonating the service, and lookalike sites are a known problem.

Two more data points. Its Trustpilot profile was removed for guideline violations; it sat around 3.8 out of 5 before that, with refund and token complaints dominating. And as of October 2026 there were no publicly reported data breaches. That's a clean record, not a guarantee.

How it compares on privacy

Secrets AI promises AES-256 encryption at rest and immediate chat deletion when you delete your account. OurDream AI advertises end-to-end encryption, though its own policy describes server-side encryption instead. Candy AI makes the weakest encryption claims of the three and is the most explicit about training on your messages. If privacy is your deciding factor, read Secrets AI vs Candy.ai before you pay anyone.

Where Candy AI genuinely earns its place is image generation and character customization. It's a media platform with a chat feature attached, not the other way round. If pictures are the point, that trade-off may be fine. If memory and discretion are the point, look at alternatives by complaint instead.

Emotional safety is part of the question too

An AI companion is built to keep you engaged, and the lines can blur. Set limits before you start: a spending cap on tokens, a time boundary, and a rule about what you won't share. If the conversations start replacing human contact rather than supplementing it, that's worth noticing. No privacy policy covers that part.

Safety checklist before you sign up

1. Use a pseudonym and a dedicated email address.
2. Pay by card or PayPal, never crypto — crypto payments can't be refunded.
3. Set a calendar reminder to cancel before renewal.
4. Assume every message could be read by a moderator or a training reviewer.
5. Keep a copy of any erasure request you send to support.
6. Check your bank statement for the EverAI name.
7. Never install an APK, and never send gift cards to anyone claiming to be support.

Bottom line

Candy AI is a real, registered platform with written terms, a Maltese company behind it and a clean breach record so far. Used with a pseudonym and modest expectations, it's reasonably safe for adults.

The weak spots are privacy and money. No end-to-end encryption, training on your messages with no opt-out, outside providers handling content, retention up to three years, a 24-hour refund window, 100 tokens a month and auto-renewal that shows up as EverAI. We rate Candy.ai 9.8 out of 10 — strong on pictures, thin on privacy. Go in knowing that and it won't surprise you.