Is Candy AI safe? The company, your data and your card

Who runs Candy AI

EverAI Limited gives its address as 56 Central Business Centre, Santa Venera, Malta, and its terms are governed by Maltese law. Support is by email at support@candymail.ai and through a help center that answers billing, refund and deletion questions in detail. A registration number you can look up is more than most apps in this category publish.

Billing and what shows on your statement

The pricing page says the charge appears as "EverAI" on your bank statement, not as Candy AI. You can pay by card, crypto, Apple Pay, Google Pay or bank transfer. Plans renew automatically at the same price and term, and price rises are announced before renewal.

One pattern worth knowing: the help center has an article titled "I've deleted my account. Why do you keep on charging me?", which tells you people do get caught out. Deleting the account is meant to cancel an active plan, but check that the subscription shows as canceled before you delete. Our page on discreet billing compares statement names across apps.

Privacy: what happens to your chats

The privacy notice lists training and developing its AI models and moderation tools, including preparing training datasets that may involve human review of de-identified or anonymized chats. The terms also give Candy a license to use your content to train and improve its models.

Your messages also leave Candy's own servers: the notice names "third-party LLM providers and/or hosters" that "may receive the content of your messages". Chats are described as "generally confidential", but they are scanned by its own moderation model, and flagged content can be reviewed by a person. Candy says it does not sell personal data or share it for outside marketing without your opt-in. Our guide on whether AI girlfriend apps read your chats puts this in context.

How long Candy AI keeps your data

You can delete your account under My Profile, Settings, Danger Zone, Delete Account. Without a request, account data is kept for up to three years after your last activity (the notice says this may be shortened to one year after last activity or the end of a subscription), financial records for ten years, marketing data until you withdraw consent or two years after your last interaction, and log files for 30 days.

After a deletion request, data is removed "without undue delay", apart from what the law makes it keep. Our guide on deleting an AI girlfriend account covers the same steps for other apps.

Age checks and content rules

Candy AI is for adults only (18, or the local age of majority). The terms let it ask you to verify or re-verify your age, and the privacy notice records the results of third-party age estimation or ID checks "as applicable based on your location", so some countries see a check and others only a confirmation.

The blocked content policy bans anything involving or resembling minors (flagged, reviewed, removed and reported to NCMEC), non-consensual intimate imagery, deepfakes and impersonation of real people or celebrities, and content promoting hate, violence or self-harm. Our guide to AI girlfriend age verification compares checks across apps.

APKs, fake apps and reported incidents

Candy AI has no iPhone or Android app, according to its help center; you add the website to your home screen. So every "Candy AI APK", "premium APK" or "mod APK" is an unofficial file. Installing one means giving an unknown developer your login, and possibly your card, which is the main real-world risk around this brand. Our AI girlfriend app page lists which apps have genuine store apps.

A news search in September 2026 found no reported data breach, regulator fine or lawsuit naming Candy AI or EverAI Limited.

How to use Candy AI safely

• Use the website or a home-screen shortcut, never an APK.
• Keep your real name, address, workplace and photos of real people out of chats, since chats can feed training and pass to outside AI providers.
• Sign up with an email you keep for apps like this.
• Pay for one month first: refunds end 24 hours after payment.
• Cancel before deleting, and check the confirmation.

Our AI girlfriend safety guide has the full checklist, and our Candy AI review covers the features.