Is Candy AI Safe? Privacy, Data and Age Rules Explained (2026)

Adults only. Candy AI is an 18+ service. Its Privacy Notice says the services are intended only for adults aged at least 18, or the age of majority where they live. This page is written for adult readers and contains no explicit content.

How this page was made. This is a documentation-based safety review. We re-read Candy AI’s Privacy Notice, Terms of Service, Underage Policy and subscriptions page on 18 October 2026, building on the research in our Candy AI review. We have not used a paid Candy AI account and have not audited the company’s systems. A privacy policy is a written promise, not proof of practice.

The short answer

Candy AI is clearer than many companion apps about who runs it and how long it keeps data. The weaker points are where your chats go: the Privacy Notice says third-party AI providers may receive message content, de-identified chats may be used for training, and the age check is self-declared. If you use it, treat anything you type as something that may be stored and processed by more than one company.

Who is behind Candy AI

The Privacy Notice, Terms and homepage all name EverAI Limited, incorporated in Malta and registered with the Malta Business Registry under number C107181. A Data Protection Officer is listed at DPO@everai.ai, and general support is at support@candymail.ai.

A named, registered operator matters for safety. It tells you which privacy law applies (the EU GDPR and, for UK users, the UK Data Protection Act 2018 are referenced in the notice), who to complain to, and that charges appear as “EverAI” on your statement. It also helps you avoid look-alike sites; see our guide to spotting fake AI app clone sites.

What data Candy AI collects

The Privacy Notice, revised 16 October 2026, lists:

• Account details such as email address, nickname, gender and name.
• An encrypted password.
• Approximate location inferred from your IP address.
• Token balance and sign-in records.
• Payment details handled by payment providers (the notice names Emerchantpay and TrustPay).
• Your chat prompts and the AI’s outputs.
• Device, browser and cookie data.

Chat content is the sensitive part. Companion conversations often include feelings, relationships and health details that people would not post anywhere else.

Where your chats go

Third-party AI providers

The notice says data may be shared with moderation tool providers and “other tools or technologies that support our AI Services, including at our discretion third-party LLM providers and/or hosters”, and adds: “these third parties may receive the content of your messages exchanged with our chatbot”. The notice does not name those providers, so you cannot read their own policies.

International transfers

The notice says sharing may involve transferring data outside the European Economic Area, including to the United States.

Sale or merger

If EverAI merges, is acquired or sells assets, personal data “may be among the assets transferred”. This is a standard clause, but it is worth knowing given that a major competitor, Character.AI, entered a court-supervised sale in October 2026 (see our October 2026 news roundup).

Training and human review

The notice lists, among its purposes, to “train and develop our AI models and moderation technologies” and to “prepare datasets for further training, which preparation may include human review of de-identified and/or anonymized interactions with AI Companions”. It also describes random querying of content data for quality assurance, and human review of content and users flagged by moderation or reported by you.

The legal basis given for this processing is EverAI’s legitimate interest. Under GDPR-style rules, the notice says you can object to processing based on legitimate interests. We did not find a one-click training opt-out in settings described anywhere in the documents, so objecting appears to mean contacting the company. We could not confirm how such a request is handled.

Retention and deletion

To delete account data, email support@candymail.ai. The notice says account data is then deleted “without undue delay”, subject to exceptions. Note that deleting the app from your phone does not delete your account.

The notice also lists rights to access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority.

Age rules and their limits

The Underage Policy says users meet an age gate where they “must affirm that they are above 18”, that providing false age information breaks the Terms, and that the company “may also implement further measures to verify that users are adults, in accordance with local requirements”. A parent who believes a child has used the service can contact support@candymail.ai.

A self-declared gate is a weak control. Regulators have focused on exactly this: in September 2025 the FTC asked seven chatbot companies how they enforce age restrictions. Candy AI was not one of the seven, but the question applies to every companion app. If you share a device with a minor, keep the account signed out and protected.

Money safety: refunds and renewals

Financial risk is part of safety. The Terms say subscriptions renew automatically, refunds must be requested within 24 hours of payment, a subscription refund is denied if more than 20 tokens have been used, and only card payments are refundable. EU and UK users have a 14-day withdrawal right on the first purchase only.

Plans on the subscriptions page, checked 18 October 2026, ranged from $3.99 a month billed $47.88 a year, to $9.99 for the first month then $13.99 a month. See the full Candy AI review for details and our guide to cancelling an AI subscription before you pay.

Reporting and getting help

• Report content or users through the platform’s reporting tools; the notice says reported content may go to human moderators.
• Privacy questions: DPO@everai.ai.
• Account and deletion requests: support@candymail.ai.
• Complaints: the notice refers to the right to complain to a data protection supervisory authority. In Malta that is the Information and Data Protection Commissioner.

If a conversation leaves you distressed, step away and talk to someone you trust. If you are in crisis, contact local emergency services or find a free helpline at findahelpline.com.

Practical steps if you use Candy AI

1. Use a nickname and a separate email address.
2. Never share your address, workplace, financial details or anyone else’s private information.
3. Assume chats may be read by third-party AI providers.
4. Turn off app and browser permissions you do not need, as the FTC recommends.
5. Request deletion by email when you stop using the service, and keep the reply.

Run any app through our AI companion privacy checklist before sharing personal details. For comparison, see is Janitor AI safe and is Character.AI safe.

What we could not verify

• Which third-party LLM providers receive chat content.
• Whether an in-app training opt-out exists.
• How objection or deletion requests are handled in practice, and how fast.
• Whether any additional age verification is in use, and in which countries.

Bottom line

Candy AI’s documents are specific: a named Malta operator, listed data categories, fixed retention periods and a deletion contact. That transparency is a point in its favour. The risks sit in what the documents permit: chat content shared with unnamed AI providers, de-identified chats used for training with possible human review, and an age gate based on self-declaration. Adults who keep identifying details out of their chats and request deletion when they leave reduce most of that exposure.