Bot & Bae

Is Candy AI safe and legit? Company, payments, privacy and age checks

Candy AI is a legitimate service run by EverAI Limited, a registered company in Malta, with published terms, an 18+ age gate and human-reviewed moderation. It is not private, though. Its privacy policy says chats are stored, shared with service providers including AI model hosts, and may be used in de-identified form to train its AI.

By the Bot & Bae editorial team · Last updated · Research-based, not hands-on tested

How we put this together: We read Candy AI's terms of service, privacy policy, underage policy, community guidelines and eight help-center articles on October 18, 2026, plus Trustpilot's current and archived listings, app-store search results and two published safety reviews. We did not create an account or test the app.

Is Candy AI legit?

Yes. Candy AI is an operating subscription service owned by EverAI Limited, which is registered with the Malta Business Registry as company C107181, according to its terms of service.

CheckWhat the official pages say
OperatorEverAI Limited, Malta, company no. C107181
Address56 Central Business Centre, Triq Is-Soll, Santa Venera, Malta
Governing lawMaltese law and Maltese courts
Privacy contactsA GDPR data protection officer and a UK representative (Shoosmiths Privacy Services)
SupportHelp center and email (support@candymail.ai)
Sister siteYumeAI, run under the same trust and safety policies

Is Candy AI safe to pay for?

Payments run through standard card processors and wallets, and the charge appears on your statement as “EverAI” rather than Candy AI. Accepted methods include credit and debit cards, Apple Pay, Google Pay, several cryptocurrencies and bank transfer, depending on where you live.

Three billing terms are worth knowing before you subscribe:

  • Plans renew automatically at the same price and term until you cancel.
  • If a renewal charge fails, the terms allow EverAI to charge another payment method you have on file.
  • Refunds are narrow. Outside the EU and UK you must ask within 24 hours of paying, with 20 or fewer tokens used, and only card payments qualify. EU and UK users get a 14-day withdrawal right, reduced for what they’ve used.

What happens to your chats and data?

Candy AI stores your chats and can reuse them. Its privacy policy, revised October 16, 2026, says:

TopicWhat the policy says
What’s collectedEmail, login method, age-check results where applicable, prompts and messages, voice call content, payment details from processors, cookies and logs
AI trainingChats, prompts and outputs may be aggregated or de-identified and used to train EverAI’s models and moderation tools, which can involve human review. Opt-out: Couldn’t confirm
SharingPayment, hosting, email, affiliate and moderation providers, and third-party AI model providers, which may receive message content
SellingNot sold or traded without consent where required, except as the policy describes
RetentionGenerally up to 3 years after last activity, or 1 year after a subscription ends. Financial records 10 years
EncryptionData encrypted in transit (TLS 1.2 or higher, per the home page FAQ). End-to-end encryption: Couldn’t confirm

Two published safety reviews, AIGirlsRated and Shiftspawn, raise the same point: treat Candy AI chats as stored data, not private conversation.

How does Candy AI check your age?

Candy AI uses an 18+ age gate where you confirm you’re an adult, and its terms say it may ask you to verify or re-verify your age. The privacy policy lists third-party age estimation or ID results as data it may hold “based on your location”. We couldn’t confirm which method applies to US users.

On content, the platform allows adult roleplay and 18+ images for adult users on paid plans. EverAI says it bans any content that sexualizes or resembles minors, reports such material to NCMEC, and uses LLM-based tools plus human reviewers, with account terminations decided by people. It also says it shows local crisis resources, through Throughline, when a user expresses thoughts of self-harm.

What does Trustpilot say about Candy AI?

There is currently no Trustpilot score. On October 18, 2026, the candy.ai profile showed a notice that it had been removed for going against Trustpilot’s guidelines. Archived copies show the score before removal:

Snapshot dateScoreReviews
November 19, 20252.952
February 16, 20263.6167
March 18, 20263.7250

We found no reported data breach, lawsuit or regulatory action involving Candy AI or EverAI Limited as of October 18, 2026.

How do you avoid fake Candy AI apps and sites?

Use candy.ai in a browser and nothing else. Candy AI’s help center says it has no native iOS or Android app, so every store app with “Candy” in its name comes from a different developer.

  1. Type candy.ai into your browser rather than following ads or search results for “Candy AI app”.
  2. Ignore App Store and Google Play listings that use the name; none are published by EverAI.
  3. Check the footer for EverAI Limited’s Malta address before paying.
  4. Save the site to your home screen if you want app-style access.

How do you delete your Candy AI account?

You delete your account from My Profile, then Settings, then the “Danger Zone” section. Deleting the account also cancels an active subscription, and deleted conversations can’t be recovered. Some data is kept for legally required periods. For other privacy requests, such as a copy of your data, email support@candymail.ai; EverAI aims to reply within one month.

For prices and token costs, see Candy AI pricing. For the full picture, read our Candy AI review.

Frequently asked questions

Is Candy AI trustworthy?
Candy AI is a real business with a named operator, EverAI Limited in Malta, a data protection officer and published policies. Trust signals are mixed: Trustpilot removed its profile for breaching guidelines, after an archived score of 3.7 from 250 reviews in March 2026. No breaches, lawsuits or regulatory actions turned up as of October 2026.
Does Candy AI save my chats?
Yes. Candy AI stores your messages, prompts and voice call content on its servers, which is how the memory feature works. Its privacy policy says account data is generally kept for up to 3 years after your last activity, and deleted sooner if you ask. Deleted conversations can't be recovered.
Is Candy AI a safe site?
The official site, candy.ai, uses encryption in transit (TLS 1.2 or higher, per its FAQ) and is run by a registered company. The bigger risk is lookalikes: several App Store and Google Play apps and some brand-style domains use the Candy name but are not run by EverAI. Use candy.ai directly.

Sources

  1. OfficialTerms of service (revised Sep 22, 2026), Candy AI. Read October 18, 2026.
  2. OfficialPrivacy policy (revised Oct 16, 2026), Candy AI. Read October 18, 2026.
  3. OfficialUnderage policy (revised Oct 10, 2025), Candy AI. Read October 18, 2026.
  4. OfficialCommunity guidelines (revised Mar 6, 2026), Candy AI. Read October 18, 2026.
  5. OfficialCandy AI home page and FAQ, Candy AI. Read October 18, 2026.
  6. OfficialScaling with Safety, EverAI help center. Read October 18, 2026.
  7. OfficialWhat are the accepted payment methods?, Candy AI help center. Read October 18, 2026.
  8. OfficialWhat's the charge in the billing statement?, Candy AI help center. Read October 18, 2026.
  9. OfficialAm I eligible for a refund?, Candy AI help center. Read October 18, 2026.
  10. OfficialHow can I delete my account with you?, Candy AI help center. Read October 18, 2026.
  11. OfficialDoes Candy.ai have an app for iPhone or Android?, Candy AI help center. Read October 18, 2026.
  12. RatingsCandy AI on Trustpilot (profile removed), Trustpilot. Read October 18, 2026.
  13. RatingsCandy AI on Trustpilot, archived Mar 18, 2026, Internet Archive. Read October 18, 2026.
  14. App storeCandy: Ai Video Generator (unrelated developer), Apple App Store. Read October 18, 2026.
  15. ReviewIs Candy AI safe? (verified Jul 17, 2026), AIGirlsRated. Read October 18, 2026.
  16. ReviewIs Candy AI worth it? (Sep 27, 2026), Shiftspawn. Read October 18, 2026.