Candy AI Safety Review: Is It Legit or a Scam?

The short answer on Candy AI safety

Can you use Candy AI safely? For the most part, yes: the product exists, the company behind it can be identified, and the official checkout provides what it advertises. Candy.ai and its video side, Candy Shorts, are owned by a registered company in Europe, one that spells out refund rules in writing and maintains a lengthy privacy policy. Risk is not zero, though. The content is adult, chats are stored on servers you do not control, and imitation pages around the brand are truly dangerous.

We run Candy AI Shorts Review independently of Candy.ai, CandyShorts and EverAI Ltd., and some of our links to the platform may earn a commission. Every fact below is dated September 2026 and draws on the help center and the operator’s terms and privacy policy.

Who is behind Candy AI?

Company number C107181 in the Malta Business Registry belongs to EverAI Ltd. (the same company name appears as EverAI Limited), the operator of candy.ai and candyshorts.com, headquartered in Santa Venera, Malta. Maltese law governs the terms, which subjects the operator to consumer and data-protection rules of the EU. To learn about the product itself, our explainer on Candy AI Shorts is the place to start.

Prior to paying I ran my usual subscription check and confirmed the terms name an actual registered company. It is a low bar, yet many AI companion apps still trip over it, which continues to surprise me.

Legit or scam: where we land

Legit. A named company bills for something that exists, and cancelling works from the account settings. The grumbles on Reddit concern value rather than fraud: token costs in the app, AI quality, and teasers that make the two free episodes sound bigger than they are.

Why does the scam label stick?

Searches around the name for “leaked”, “free” and “uncensored” are heavy, so plenty of unrelated pages borrow it for bogus video players, “age checks” that harvest cards, and malware downloads. The scam is those pages, not the operator; how they operate is cataloged in our leak-claims breakdown.

Paying for Candy AI: processors, refunds, renewals

According to the privacy policy, the payment processors are UpGate, Coingate, Volt, TrustPay and Emerchantpay, and the payment data kept is the four final card digits along with transaction information. Candy Shorts sits under the very same Premium plan as Candy.ai. On card statements the charge shows as “EverAI”, according to the help center, so check for that name before you dispute any line item. As of September 2026 the money rules are as follows:

• Cancel anytime through My Profile and then Settings. Access continues through the end of what you paid for, after which the account falls back to free.
• 24-hour refund window after a card payment, denied when the user has spent more than 20 tokens. Consumers in the EU and UK also hold a 14-day right to withdraw from the first purchase.
• Leftover tokens are ambiguous. By the terms they lapse when a subscription ends, yet the help center claims the balance stays. The safe move is to use them up before cancelling.

Premium prices spanned $3.99 a month on the yearly plan to $13.99 on a monthly one; details are in the Candy AI pricing guide.

Privacy: what the policy discloses

The policy says it gathers your chats and prompts, your email and an encrypted password, gender and screen name, location inferred from your IP address, device and browser details, the results of age checks, and partial payment data. Humans can review flagged content, and interactions stripped of identifying details may feed model training.

Data stays for a long time: account information is kept for three years from the date you were last active (one year in some cases), financial records for ten years, and marketing data for up to two. Providers of hosting, moderation, payments and third-party language models all receive data, message content included. Deleting your account is possible via the Danger Zone section of Settings, or you can write to the privacy team using the address in the policy.

Watching leaves a viewing history, chatting leaves a transcript, and the transcript is the part that makes me hesitate. So I assume chats are semi-public and treat video as a normal streaming account.

Bans and the missing app

Candy AI has no recorded ban in the European Union or the United States. The one restriction is self-imposed: the operator’s terms exclude users in China and Singapore. Apple’s App Store and Google Play keep it out through their adult-content rules, which is why it works in a browser, can be added to a home screen as a progressive web app, and keeps a Discord community besides. Any “Candy AI app” or APK offered as a download is unofficial; handle it as malware.

Spotting the real site: official versus imitation

Before you sign up: a short checklist

1. Type the address yourself and pick a password you use nowhere else; a recycled one is the easiest way in for a stranger.
2. If the series are what you want, watch on candyshorts.com; inside the Candy.ai app some episodes also cost tokens.
3. Check the refund clause before buying. It allows a single day, applies to card payments only, and ends once more than 20 tokens are used.
4. Jot down the renewal date and cancel through Settings rather than a bank dispute, since per the terms a chargeback ends the plan and revokes leftover tokens.
5. Keep in mind that paid episodes are adult, AI-made content; what they contain is stated plainly in our content rating guide.

Review verdict

Among adult subscription services, Candy AI sits near the safe end: a registered operator in the EU, mainstream payment processors, refund and cancellation terms in writing, and no download needed. Two weak spots stand out. Data retention is lengthy for something this personal, and tokens make the in-app cost hard to forecast. Neither amounts to a scam, though both merit careful thought before you subscribe.

My advice to a friend would be to register on the Shorts site, start with a monthly plan, avoid the chat if privacy bothers you, and disregard anything using the brand name outside the two official domains. Following that, my own experience has stayed uneventful.