You are about to type personal things to an AI girlfriend, or to give an adult site your card number, and you want to know who sits on the other side. Short answer: Candy AI is run by a registered company, EverAI Limited in Malta, the charge on your statement reads EverAI, and payment is an ordinary card checkout. The weak point is privacy, not fraud. Your chats are stored on the company's servers, and the privacy notice does not promise that nobody there can read them.
Below: who owns the service, what your bank and phone will show, what the privacy notice commits to and leaves open, the four toggles that control training and unasked messages, account security, and minors. Everything comes from our own paid Premium account (settings, subscriptions and tokens pages) and from the public privacy notice and terms on candy.ai. We are not Candy.ai, and none of this is legal advice.
In short
- The seller is EverAI Limited, company number C107181, Santa Venera, Malta. The address is printed on the subscriptions and tokens pages.
- Your statement shows EverAI, never Candy. Payment is a card form on candy.ai, with no app store in between.
- The privacy notice keeps data while the account exists and "for a period of time" after it closes. It gives no number of days and does not promise end-to-end encryption.
- 4 toggles in Profile Settings decide notifications, unprompted messages and pictures, and AI training use. The delete link sits right under them.
Yes, a registered company runs it: EverAI Limited in Malta
A safety question about an app like this starts with a simpler one: is there a real business behind it, with a name you can hold to account? There is. Candy AI is operated by EverAI Limited, registered under C107181 at 56 Central Business Centre, Triq Is-Soll, Santa Venera SVR 1833, Malta. That address is printed at the foot of the subscriptions page and of the tokens page, the two pages where you pay.
The same name follows you everywhere else: in the terms of service, the privacy notice, the support emails and the Help Center at everai.zendesk.com. If you want to check the company yourself, C107181 is the number to search in the Maltese company register. EverAI is the operator, not a reseller or a clone.
Who can read your chats, according to the privacy notice
Every reply a character writes is generated on the company's servers, so your messages travel there and stay there. That is how she picks up yesterday's conversation. The useful question is therefore not whether chats are stored, but who may look at them and for what purpose.
| Question | What the notice or the settings say | What stays open |
|---|---|---|
| Are chats kept? | Personal data is retained "for as long as your account is in existence" | No separate rule for chat text |
| Can staff see them? | The notice describes de-identified review for quality and safety | Who reviews, and how often |
| Are they used for training? | An AI & Moderation Training toggle sits in the settings | What happens to chats already sent |
| Are they sold? | Not "without your Consent (where required)", except service providers, legal duties and a sale of the company | The list of providers |
| Are they end-to-end encrypted? | Not stated | Everything |
Treat it like any cloud service: the operator can technically access what you send, so keep real names, addresses and workplace details out of the chat.
Encryption, retention, leaks: what we could and could not confirm
Several review sites quote a precise encryption standard, a fixed number of years of retention or a description of human reviewers. We did not find those statements in the privacy notice we read, and we cannot test a server from the outside, so we do not repeat them. When a page states them without a link to Candy's own documents, treat them as that site's guess.
What the notice does commit to is a set of principles rather than numbers:
- While the account exists, data is kept as long as it is needed for the purposes it was collected for.
- After you close the account, data is "still retained for a period of time" unless you ask for deletion, in which case account data goes "without undue delay".
- Retention periods can change "based on business or regulatory requirements", so the version on candy.ai on the day you read it is the one that counts.
On leaks: we have not verified any breach report about Candy AI, so this page neither confirms nor denies one. To see whether your own email appears in a known breach of any service, a breach-notification site such as Have I Been Pwned can tell you. If you need a firm answer on encryption or retention, ask the Help Center in writing and keep the reply.
What shows on your statement, your inbox and your phone
Discretion is the part Candy AI handles best, because it is written into the checkout. The subscriptions page says it under the plans: "Charge shown as 'EverAI' on your bank statement". The tokens page repeats it as "Privacy in bank statement". On our Belgian card the line reads EverAI and nothing else.
A normal month makes this concrete. Say you pay Premium monthly at 13.99, run out of tokens and buy the 100-token pack at 9.99. Your bank app shows two lines, both reading EverAI, for 23.98 in total. Someone glancing at the statement learns nothing about the service; you, though, need to recognise those lines, or a forgotten renewal looks like an unknown charge. Emails come from EverAI too, and on a phone Candy AI is a browser tab or a home-screen web app, never a store download.
Two items in that block deserve one look. A backup card, which earns 10 tokens when you add it, is charged if the first card fails. Auto Top-Up can buy tokens on its own when the balance runs out. If you share a card or watch a budget, decide on both. Refunds and the Unsubscribe link are covered in our cancel and refund guide.
Four toggles that control training use and unasked messages
These toggles matter for safety for one reason: three of them decide what reaches you without your asking, and one decides what may happen to what you write. They sit together on the Profile Settings page, below the language block, and none of them requires a support request.
| Toggle | What it controls | Why you might switch it |
|---|---|---|
| Automatic Notifications | Email and browser notifications from the site | Pop-ups on a shared computer |
| Proactive AI Messages | Characters writing to you first | Messages arriving when you did not open the chat |
| Proactive Media | Characters sending pictures on their own, paid in tokens | Pictures you did not ask for, at 4 tokens each |
| AI & Moderation Training | Whether your content may be used to train and moderate the AI | You prefer your chats kept out of training |
Under them sits the Danger Zone line with the delete link. What each media setting does inside a single chat is detailed in our NSFW settings guide.
Protecting the account itself: login, email, fake offers
Candy AI lets you sign in with an email and password, or with Google, Apple or Discord. In our checks the settings page has no two-factor option, so your account is exactly as strong as that password, or as the Google, Apple or Discord account behind it.
- Use an address only you read. The account email is printed at the top of the settings page and on every message the service sends.
- Prefer a sign-in you already protect. If your Google or Apple account has two-factor turned on, signing in through it extends that protection to Candy AI.
- Ignore "free Premium accounts" and APK files. Candy AI has no store app, so a download that claims to be it is not made by Candy, and a shared login lets a stranger read your chats.
Minors and shared devices: what the age check covers
Candy AI is an adult service. Sign-up asks you to confirm that you are 18 or over, the paid plans list 18+ images and videos among their benefits, and the age slider in the character creator starts at 18. What we cannot tell you is how far the age check goes beyond that confirmation, because we only ever saw it from an adult account.
For a parent, the signals are an EverAI line on a card statement, a candy.ai tab or icon, and emails from EverAI. On a shared computer, turn off Automatic Notifications and log out after each session. What opens without any card is listed in our free plan guide.
If the privacy terms do not suit you: delete, or compare
If something above is a deal-breaker, cancel the plan, then use the Delete account link and send an erasure request to the Help Center. Our delete account guide walks through that order.
Server-side storage with a review clause is the norm for companion apps, not a Candy AI exception. Our Candy AI vs Nomi comparison and the alternatives page show how other services handle it, and how we test explains what we checked on our own account.
FAQ
Is Candy AI legit or a scam?
Legit as a business. It is run by EverAI Limited, registered in Malta under C107181, with its address on the payment pages and a card checkout on candy.ai.
Can Candy AI staff read my chats?
Possibly: the privacy notice does not rule it out. It describes de-identified review for quality and safety, and it does not promise end-to-end encryption. Leave real identifying details out of the chat.
Has Candy AI had a data leak?
Not that we could verify. This page neither confirms nor denies a breach. A breach-notification service such as Have I Been Pwned can tell you whether your own email appears in a known leak.
What will appear on my bank statement?
EverAI. Subscriptions and token packs are both billed under that name, as the subscriptions and tokens pages state.
How long does Candy AI keep my data?
No fixed number of days is given. The notice keeps data while the account exists and "for a period of time" after it closes, and deletes account data "without undue delay" when you ask.
Can minors use Candy AI?
No. The site is for adults, sign-up asks for an 18+ confirmation and the paid plans include explicit content. We could not test how strictly the age check is enforced.
See also
