Is Candy AI safe? Its age rules, content limits, privacy and the laws that may apply

The short answer

Candy.ai is built for adults. Its policies say users must be 18, or of legal age where they live, and that it blocks underage users. Its underage policy describes an age gate where users affirm they are adults, and its privacy notice says it uses third-party age and identity verification providers where it applies.

Its privacy notice says it uses chats to train its AI models, that flagged content is reviewed by people, and that third-party AI model providers may receive message content. Its terms say the characters are fictional and the service is for entertainment, not emotional support. We found no regulator or attorney general action naming it in official sources as of October 22, 2026.

Who runs it and who can use it

As of October 22, 2026, Candy.ai's terms (revised September 22, 2026) name EverAI Limited, a company registered in Malta, as the operator. The terms are governed by Maltese law and send disputes to the courts of Malta. They also bar access from China and Singapore.

The terms say users must be of legal age in their jurisdiction and that younger users may not use the service. Its underage policy (revised October 10, 2025) says users must be 18 or older, or of legal age where they live, and its privacy notice (revised October 19, 2026) says EverAI does not provide services to anyone under 18 and will block underage users and delete their data.

How age is checked

Candy.ai's underage policy says users affirm they are over 18 at an age gate when they enter the site, and that it may add further checks to meet local requirements. Its terms say it may ask users for information to verify or re-verify that they are adults.

Its privacy notice says it works with third-party age and identity verification providers and collects age-verification results where applicable. It does not name the providers or list where checks are required.

The underage policy says parents who believe a child has used the service can contact Candy.ai so it can block access.

Content rules

Candy.ai's website promotes what it calls uncensored fantasy experiences, and its policies limit the service to adults. Its community guidelines (revised March 6, 2026) and blocked content policy (revised July 30, 2026) list what users may not create or share, including:

• content involving or sexualizing minors, and content resembling minors;
• images that resemble real people, and harmful impersonation of real people, public figures or celebrities;
• non-consensual intimate imagery and deepfakes;
• material related to self-harm, and content that advocates extreme violence;
• illegal content, hate speech and attempts to get around its moderation.

The blocked content policy says automated moderation based on Candy.ai's own language model checks for violations, that flagged content can be reviewed by people, and that known child sexual abuse material is reported to the National Center for Missing and Exploited Children or other authorities. Violations can lead to content removal or account termination.

Crisis and emotional support

Candy.ai's terms say conversations are entirely fictional, that characters cannot keep real-world promises such as offers to meet, and that the service is for entertainment and not emotional support. They advise users in distress to contact a qualified professional.

We did not find a page from Candy.ai describing a suicide or self-harm protocol or listing crisis lines. Its content policies prohibit self-harm material.

Privacy: who sees your chats

As of October 22, 2026, Candy.ai's privacy notice says:

• It collects account details, the prompts users enter and the AI's replies, payment details handled by payment providers, and device and usage data.
• It uses chats to train and develop its AI models and moderation tools, and may de-identify or anonymize them first. People may review de-identified or anonymized chats while preparing training data.
• People review content and users flagged by its moderation controls, and content may be checked at random for quality.
• It shares data with service providers, including third-party AI model providers that may receive the content of messages, and with named payment processors.
• It says it will not sell personal data without consent where consent is required, and asks for opt-in consent before third-party marketing.

The notice does not describe a setting to keep chats out of training. It says training relies on EverAI's legitimate interests and that users can object to processing on that basis.

Keeping and deleting your data

Candy.ai's privacy notice says account data is kept for up to three years after the account's last activity, or until the user asks for deletion, financial records for ten years and server logs for 30 days. Users can ask for their personal data to be deleted by writing to support@candymail.ai or to EverAI's data protection officer at DPO@everai.ai.

The terms do not describe a self-service way to delete an account. They say content may be removed after periods of inactivity.

Subscriptions, tokens and refunds

Candy.ai's terms say free users get a limited number of messages, and paid plans renew monthly, quarterly or yearly with a monthly allowance of tokens, generally 100. Unused tokens expire at the end of each billing period.

The terms allow subscription refund requests within 24 hours of payment if no more than 20 tokens were used, and only for card payments. Used tokens are not refunded. Users in the EU and UK have a 14-day right to withdraw from the first purchase, not renewals. A chargeback cancels the subscription.

Government actions

We found no attorney general, FTC or other regulator action naming Candy.ai or EverAI in official sources as of October 22, 2026. It was not among the seven companies that received the FTC's companion chatbot orders in September 2025, or among the 13 companies named as recipients of the multistate attorney general letters announced on August 25 and December 10, 2025.

Which chatbot laws may be relevant

No law names Candy.ai. Whether a particular service counts as a companion chatbot under a given law is a legal question. These state laws set duties for companion chatbot operators:

• California SB 243, in effect since January 1, 2026: operators must give a clear notice that the chatbot is AI when a reasonable person would be misled, keep a protocol to prevent suicide and self-harm content that refers users to crisis services, publish details of that protocol on their website, and tell users companion chatbots may not suit some minors. Injured users can sue.
• New York's AI companion law, in effect since November 5, 2025: operators need a protocol that makes reasonable efforts to detect suicidal thoughts or self-harm and refer users to crisis services, and must tell users they are not talking to a human at the start of an interaction and at least every three hours.
• Washington HB 2225 and Oregon SB 1546, both effective January 1, 2027: operators must disclose that the chatbot is AI (in Oregon, when a reasonable person could think it is human), run and publish a suicide and self-harm protocol with crisis referrals, and add protections for users the operator knows are minors (in Washington, also where the chatbot is directed to minors; in Oregon, also where the operator has reason to believe a user is a minor).

We are not saying Candy.ai is covered by, or out of compliance with, any of these laws. It may have practices it has not published, and whether a law applies to it is a legal question this guide does not decide.