Short answer: Candy AI is run by a registered company with a detailed privacy notice, and we found no public data breach. Privacy is the weak point. Your chats can train its models, parts of them can go to outside AI providers, and your account data is kept for three years after you stop logging in. Its refund window is 24 hours.
Everything below comes from Candy AI’s own documents, read on 18 October 2026. We have not tested Candy AI hands-on, so this page covers what Candy AI says it does, not what we observed.
Who runs it
Candy AI is operated by EverAI Limited, registered in Malta under number C107181. The address is 56 Central Business Centre, Triq Is-Soll, Santa Venera, Malta. Both the privacy notice and the terms name the same company, and Maltese law governs disputes.
That is more than many apps in this market publish. You can look the company up, and EU data protection law applies to it.
What it collects
Per the privacy notice:
- Account details: email, password, nickname, gender and name.
- What you send and get back: your prompts and the generated replies, images, videos and voice notes.
- Payment details: name, email, card brand, the last four card digits, transaction details and IP address. The full card number is not on the list, because a payment provider handles it.
What it does with your chats
- Training: Candy AI uses data to “train and develop our AI models and moderation technologies”.
- Human review: building training datasets “may include human review of de-identified and/or anonymized interactions”.
- Outside AI providers: it shares data with “third-party LLM providers and/or hosters”, which “may receive the content of your messages”.
- No sale without consent: it says it will not “sell, trade, or otherwise transfer your Personal Data to any third parties without your Consent”, apart from the cases the notice lists.
- If the company is sold: your data can pass to the buyer or successor and stays covered by the same notice.
Data can also be moved outside the EU, “including but not limited to the United States”.
How long it keeps your data
| Data | Kept for |
|---|---|
| Account data | 3 years after your last account activity |
| Financial and transaction records | 10 years from issue |
| Marketing data | Up to 2 years after your last interaction |
| Log files | 30 days |
You can ask for earlier deletion. The notice says Candy AI deletes account data “without undue delay” on request and aims to answer within one month. The route it describes is an email to its privacy team at support@candymail.ai, not a button in the app. We will check during our test whether the app offers one.
Billing rules that catch people out
From the terms of service (revision dated 22 September 2026):
- Auto-renewal: subscriptions renew automatically. You cancel under Settings, and the plan runs to the end of the period you paid for.
- Refunds: you can request one within 24 hours of payment. It is refused if you have used more than 20 tokens. Used tokens are never refunded.
- EU and UK buyers: you can withdraw within 14 days of the first purchase. Renewals do not count.
- Tokens: a subscription includes a monthly allowance, “generally 100 per month”. Unused tokens expire when the subscription ends. They do not carry over and cannot be moved to another account.
Neither document says what the charge looks like on a bank statement. We will record that from our own test purchase.
Age rules
The privacy notice says the service is for adults “at least 18 years of age”, or older where the local age of majority is higher. The terms refer to a separate underage policy.
Our read
Candy AI is a real company with clear documents, and nothing in them points to a scam. The safety question is about privacy, not fraud. Expect your conversations to be stored, used for training and processed by outside AI providers, and expect your account data to stay around for three years unless you ask for deletion.
If that is fine with you, use a separate email address, keep real names and locations out of chats, and set a reminder to cancel before renewal. If you want an app that says it does not train on chats, compare the privacy policies of seven AI girlfriend apps.
A scored Candy AI review will appear only after a hands-on test, with the price at checkout, the line on the bank statement and a memory score after seven days.