Is Candy AI legit? Who runs it
A scam hides who takes the money. Candy AI names it, in its terms and on its subscription page.
| What | What we read | Where |
|---|---|---|
| Operator | EverAI Limited | Terms of service |
| Registration | Malta, company number C107181 | Terms of service |
| Law and courts | Maltese law, courts of Malta | Terms of service |
| Support address | support@candymail.ai | Terms of service |
| Bank statement | The charge shows as EverAI | Subscription page |
We paid for Premium on 22 September 2026. The paid features unlocked, and the cancellation went through from Settings the same day, with access kept until the end of the period. Nothing in that path behaved like a trap. The one thing to know in advance is the statement line: it says EverAI, not Candy AI, so a charge you do not recognise may be this one.
Whether it is worth paying for is a different question, and our Candy AI review answers it: 8.8 out of 10 on our six criteria.
The trackers Candy AI loads in your browser
We recorded every network request on a clean browser profile, on the home page and on the subscription page. Both loaded the same trackers. This is a measurement, not a reading of the privacy policy.
| Loaded on the page | What it does |
|---|---|
| Google Tag Manager, Google Ads | Advertising and conversion tracking |
| Advertising pixel | |
| TikTok | Advertising pixel |
| Snapchat | Advertising pixel |
| Tapad | Cross-device identity matching |
| Hotjar | Session recording and heatmaps |
None of this means your conversations are shared. It means that visiting an adult platform is reported to three social advertisers and to a service that links your devices together. That is heavier than the category should carry, and it is why privacy scores 7 in our review while most other criteria score higher.
One point goes the other way. Generated images are served from a separate private delivery domain, not the public one. Your images do not sit next to the site's public assets.
Two limits on our own measurement. We recorded the public pages, not the logged-in application, which may load a different set. And a tracker blocker removes most of this list, so your exposure depends on your browser as much as on Candy AI.
What the Candy AI terms allow with your chats
The browser cannot show what happens on the server. The Candy AI terms of service can, and we read them in the revision of 22 September 2026.
| Article | What it says |
|---|---|
| 4 | A perpetual, transferable licence to what you write and upload, including to train its AI models |
| 5.4 | When moderation flags something, staff or authorised partners may manually review the flagged content and other content on the account |
| 9 | A free account is capped at 5 messages in total |
Read together, articles 4 and 5.4 mean your chats are not a diary only you can open. The terms describe conversations as "generally private", and that word generally is the honest part. Write nothing there you would not accept a moderator reading.
Article 9 is not a safety risk, but it answers the other half of "is it legit": the free tier is a five message sample, with no images and no voice. Nothing is hidden about it once you read the terms, and it is the reason we send people who want to stay free to our ranking of free AI girlfriends.
Candy AI billing, cancelling and refunds
Most "is it a scam" searches start with money. Here is what our cancellation showed, and what the terms say about getting it back.
| What | What we found |
|---|---|
| Cancelling | 7 clicks from any page, through Settings, past 3 windows asking you to stay. No discount offered. Tested 22 September 2026. |
| Confirmation email | None received. The confirmation window is the only record. |
| After cancelling | Access runs to the end of the period already paid |
| Unused tokens | Lost at the end of the period, neither carried over nor refunded (art. 10.2) |
| Refund on a subscription | Within 24 hours of payment, refused past 20 tokens used (art. 10.4.1) |
| EU and UK withdrawal | 14 days, first purchase only, pro rata to what you used (art. 10.4.3) |
| Refund or chargeback | Ends Premium and your tokens at once (art. 10.2) |
So the money risk is narrow and written down. Outside the EU and UK, a refund window closes a day after you pay. Past it, the practical move is to unsubscribe, keep a capture of the confirmation, and use what is left. Every screen of the path is in our guide to cancelling Candy AI.
Modified Candy AI apps
Search for Candy AI and you will find "mod" and "premium unlocked" downloads. Your plan, your tokens and your chats live on Candy AI's servers, not on your phone. A modified app cannot change what the server grants you. What it can do is take the login to an account that has a card attached.
We have not installed any of them and will not link to one. The official product is the site at candy.ai, and nothing else carries its name legitimately.
Who should think twice about Candy AI
Fine for you if you accept that an ad-funded consumer site tracks visits, you browse with a tracker blocker, and you treat your chats as readable by a moderator.
Think twice if a Facebook, TikTok or Snapchat pixel knowing you visited is a problem in itself, if you want a written guarantee that no person will ever read a conversation, or if you expect to ask for a refund more than a day after paying.
For the same questions asked of every platform, including the one that leaked its users' prompts, read are AI girlfriends safe.
Frequently asked questions about Candy AI safety
Are Candy AI conversations encrypted?
We cannot tell you. Pages load over HTTPS like any modern site, but how conversations are stored on Candy AI's servers is not something a visitor can observe, and we do not repeat a claim we could not check. The terms themselves call conversations only generally private.
Does deleting my Candy AI account stop the subscription?
We did not test it, so we will not say it does. Unsubscribe from Settings first, capture the confirmation window, and only then decide about the account.
Where do I complain about a Candy AI charge?
Write to support@candymail.ai with the date and a capture of your cancellation. If you are in the EU or UK and it was your first purchase, name article 10.4.3 of the terms. Our forum keeps a thread for charges after cancelling, across every platform.
Charged after cancelling, on Candy AI or anywhere else? Our forum thread Charged after you cancelled? Start here collects what worked for other readers.
Back to the ranking
Best AI girlfriend apps
17 platforms tested and ranked on 6 criteria
