Is Candy AI safe?

Behind "is it safe?" there are usually three worries: who takes your money, what happens to what you type, and whether the content stays within adult, legal limits. For this page we read Candy's own legal pages and help center and quote them where it counts. Anything that cannot be confirmed from outside is flagged as such.

The safety checklist

The company behind Candy AI

Candy's terms name the business plainly: the services "are owned and operated by EverAI Limited", a company incorporated in Malta, at 56 Central Business Centre, Triq Is-Soll, Santa Venera, registry number C107181. The privacy notice and the footer of the subscriptions page give the same details. A fly-by-night storefront would not publish that much about itself.

Two things follow for a US user. The terms are governed by Maltese law, so disputes go to the courts of Malta. And the company can be contacted: support, refunds and privacy requests all have published addresses on Candy's legal pages.

Billing: what your statement shows

Discretion is usually the first question. Candy's help center says the charge appears on your card statement as "EverAI", not as Candy. Premium renews by itself at the end of each period unless you cancel, and the terms say a price rise has to be announced before an automatic renewal at the new price.

The billing lines Candy showed a logged-out US visitor on candy.ai/subscriptions on Nov 4, 2026:

• Annual payment billed as $47.88
• Quarterly payment billed as $26.97
• First month billed as $9.99.
• Then renews monthly at $13.99.
• Payment every 2 weeks billed as $9.79
• Weekly payment billed as $5.6

According to the help center, the accepted methods vary by country and include cards, crypto, Apple Pay, Google Pay and bank transfer, and you need to keep at least one payment method on file while subscribed.

Canceling and refunds

Canceling is self-service: My Profile, then Settings, then Unsubscribe at the bottom. What you paid for keeps working until the period is over. Getting money back is a separate request, and the bar is high: the terms give you 24 hours after payment to ask, and a subscription refund is refused once more than 20 tokens have been used. The cancel guide has the steps and the unresolved token question.

Privacy: what Candy's own documents say

Chats are moderated

The terms describe conversations with AI characters as "generally private", and then explain that moderation runs on them and that flagged content can be reviewed by Candy or its partners. Treat the chat as semi-private, not as a diary.

What you type can train the AI

The terms give EverAI a license to your inputs and the AI's outputs, including for improving its AI models, and the privacy notice says outside AI model providers may receive the content of chat messages.

Data stays after you leave

The privacy notice keeps account data for a period after your last activity unless you ask for deletion, and keeps financial records much longer for tax and accounting. Canceling Premium does not delete the account; deleting it is a separate step in Settings, under Danger Zone.

Using it with less exposure

• Sign up with an email you do not use for work or banking.
• Leave out your full name, home address and employer when you chat.
• On your way out, unsubscribe first, then delete the account; support can confirm the deletion in writing if you ask.

Age rules

An age gate sits in front of Candy, where users have to confirm they are over 18, and the underage policy requires that no AI content "bear any resemblance to minors". Depending on where you live, extra age checks may apply; we have not tested which US states trigger them. The same policy says Candy has zero tolerance for child sexual abuse material and reports it to the authorities.

Are real people in the videos?

Nobody films Candy Shorts. The 2257 page says "Any visual depictions that may be sexual are not performed by real human beings, but are rather created via and a product of AI technology." The exception is a licensed likeness: Candy's content removal policy allows a digital version of a known person who has given explicit consent. In Candy Shorts that applies to 7 real adult performers (Lena the Plug, Sophie Dee, Riley Reid, Lexi Luna, Asa Akira, Mia Malkova, Bonnie Blue), who licensed AI twins and did not film anything. Every other character is AI-generated, and Candy's rules require users to be 18+ and say its AI content must not "bear any resemblance to minors".

Is Candy Shorts safe to watch?

The free episodes are the lowest-risk way to try Candy. In every public series, episode 1 is free without an account, episode 2 is free once you sign up, and from then on each episode costs 12 tokens (30 in 16 series). The exception: Simona Rossi: Wrong But Right opens extra free episodes with an account. Here the openers stream from our own server: no Candy login, no tracking cookies, no outside scripts (see the privacy page).

Pages offering "leaked" full episodes are where the risk lies. Nothing paid showed up in our searches, and downloads of that kind are best left alone; the nudity page covers what we found. Apps are a similar trap. Candy has no App Store or Play Store app of its own, only a website you can pin to the home screen, so a store listing with the Candy name is not from Candy.

What we could not check

How we check the catalog itself is on the method page.