Candy AI Guide

Independent guide. Not operated by Candy AI.

Open Candy AI

Is Candy AI safe and legitimate?

By the Candy AI Guide editorial team Published · Last checked

By the checks a consumer can make from its own pages, Candy AI is a legitimate subscription service: it identifies its operator as EverAI Limited of Malta (company number C107181) and publishes its terms, refund rules and billing name. On safety, Candy AI states that it encrypts data in transit with TLS 1.2 or higher and follows GDPR-compliant privacy standards. Those are the company’s own statements, which we have not tested, so share little, check the billing terms before paying and know how to delete your data.

Key points

  • Operator: EverAI Limited, company number C107181, Santa Venera, Malta.
  • Card charges appear as “EverAI”, not as Candy AI.
  • Candy AI states TLS 1.2+ encryption in transit and GDPR-compliant privacy standards; we report these as its claims.
  • Automated moderation can flag messages, so a chat is not a sealed space.
  • You can delete chats, generated media and the whole account; some data is retained where the law requires it.

Who operates Candy AI

The footer of Candy AI’s plan page names the operator as EverAI Limited, company number C107181, at 56 Central Business Centre, Triq Is-Soll, Santa Venera SVR 1833, Malta. A company number can be checked in Malta’s public business register; we did not do so for this guide, and the details here are as Candy AI publishes them. Support is handled by email at support@candymail.ai and through a public help center.

Diagram linking the Candy AI brand to its operator EverAI Limited (company number C107181, Santa Venera, Malta), the name EverAI shown on card statements, and the support address support@candymail.ai.
The brand, the company behind it and the name that appears on a card statement.

Candy AI’s marketing says the service is “trusted by 50 million people worldwide”. That figure comes from the company and we cannot verify it. A named operator and published rules make a service accountable. They do not by themselves make it free of risk.

What Candy AI states about encryption and privacy

Candy AI’s privacy statements and how to read them
What Candy AI states What to keep in mind
Data is encrypted in transit with TLS 1.2 or higher. This covers the connection between your browser and Candy AI. It says nothing about how conversations are stored or who at the company can access them.
It follows GDPR-compliant privacy standards. This is the company’s description of its own practice. The detail is in its Privacy Notice.
Some data is kept after account deletion for legally required periods. Deleting an account does not erase everything at once. The Privacy Notice says what is kept.

We report these statements as Candy AI makes them. Do not read them as a promise that nobody but you can ever see a conversation: the service has to process your messages to answer them, and moderation systems check them. We did not read the Privacy Notice for this guide, so read it yourself before sharing anything sensitive.

How charges appear

A card payment for Candy AI shows on the statement as “EverAI”. Knowing that avoids two problems: disputing a charge you did in fact authorize, and missing a renewal you meant to stop.

Plans are priced in US dollars, local taxes may be added, and every plan renews automatically until canceled. The 1-month plan starts at $9.99 and renews at $13.99, as checked on 13 November 2026. While a subscription is active, one payment method has to stay on file, so you cannot stop billing by removing your card. The figures are on our Candy AI pricing page, and the exit route is on our page about canceling and refunds.

Moderation and flagged messages

Candy AI allows adult content for adult users within its Community Guidelines, and it runs automated moderation that can flag a message. The help center accepts that flags are sometimes wrong and points users to the report option.

This cuts both ways. Moderation exists, and a mistake can be contested. It also confirms that messages are checked by automated systems, one more reason to keep real names, addresses and financial details out of a chat.

Deleting chats, media and the account

  • Conversations. A deleted conversation cannot be recovered, and resetting or deleting a chat also clears that chat’s memory.
  • Images and videos. Open Collections, choose the character’s album, open the item and use the three-dot menu to delete it.
  • The account. Go to My Profile, then Settings, then the “Danger Zone”, and choose “Delete Account”. This also cancels any subscription.

Canceling a subscription, by contrast, deletes nothing: content stays for as long as the account exists.

An adults-only service

Candy AI is for people aged 18 and over, and the paid plans include adult image and video generation. Candy Cam presents a character as a live stream, but the help center says all stream messages are AI-generated. Candy Creators are digital twins of real content creators, made with their consent according to Candy AI. Characters in “Realistic” mode may send photos, voice notes or videos unprompted until you switch the toggles off. However it is presented, you are talking to software.

Practical precautions

  1. Type candy.ai into the address bar yourself, and check it before logging in or paying.
  2. Do not install anything. There is no native app, so do not trust a download that claims to be one. See how the Candy AI web app is installed.
  3. Choose a password for the account that you use nowhere else.
  4. Keep real names, addresses, workplaces and financial details out of chats and persona fields.
  5. Before paying, read the term and the renewal price on the payment screen.
  6. A refund request must reach support no later than 24 hours after the payment.
  7. Watch your statement for “EverAI”, and cancel in Settings before the renewal date if you are leaving.
  8. When you are done, delete what you no longer want kept, or the account itself.

Check the address bar: Candy AI itself is at candy.ai. Affiliate link to Candy AI.

Open Candy AI

Sources

Pages published by Candy AI and used for this article, each read on 13 November 2026.