Is Candy.ai legit?

What is Candy.ai?

Candy.ai is a paid AI companion app launched in September 2023. It offers text chat, in-chat image generation, short videos, voice messages and voice calls (in beta), with images, video and voice paid for from a monthly token allowance. It competes with DreamGF and Muah.ai in the all-rounder tier, where chat, images, and voice are all expected to work. We review it in depth in our full Candy.ai review.

The product itself is not the question here. The questions are practical ones. If you put a card down, does the charge show up from a company you can find? Is the data handled by people who have avoided a public breach? Are other users getting what they paid for? Those are the three tests we apply.

Who owns it?

Candy.ai is operated by EverAI Limited. The company holds the CANDY.AI trademark (USPTO registration #7756820, filed September 2023, registered April 2025). Public records and Bellingcat's reporting list the registered address as 56 Central Business Centre, Triq Is-Soll, SVR 1833 Santa Venera, Malta, though some sources describe the entity as Cyprus-based. This kind of jurisdictional ambiguity is normal for EU-registered adult-tech operators. What matters is that the entity is real, named, and findable in official business registries.

There is also a separate UK entity called "CANDY AI LIMITED" in Companies House (number 14926471). Whether this is directly related to Candy.ai's operations or a brand-protection shell is unclear, but it does mean the name is registered in more than one jurisdiction. Users in the EU are covered by GDPR and can submit a data-deletion request that the company is legally obligated to process.

Track record

Candy.ai launched in September 2023. By late 2025, press reports and the company's own figures put registered users at 50 million+, with roughly 22 million monthly visits (December 2025 figure). That scale alone says something. Companies processing card payments at that volume attract regulator and card-network scrutiny, which is its own kind of legitimacy filter. Scam operators usually don't survive that long at that scale without getting cut off by Stripe, Visa, or Mastercard.

We are not aware of any public data breach affecting Candy.ai. Have I Been Pwned does not list the site. That's a clear contrast with Muah.ai, which competes for the same users and was breached in 2024. See our Muah.ai data breach explainer for what that looks like when it goes wrong.

User reviews and sentiment

On Trustpilot, Candy.ai's review mix runs roughly 58% five-star and 16% one-to-two-star, with 80% rating it four stars or higher, a decent distribution for a paid adult-category product. Users who like it tend to cite chat quality, image generation inside the conversation flow, and responsive customer support. Users who don't like it cluster around a consistent set of complaints:

• Token costs. Images and videos consume tokens beyond the base subscription. The monthly allocation runs out fast if you generate a lot of content. At least one Trustpilot reviewer reported spending close to $300 in a single month on tokens.
• Image quality variance. Complex prompts often don't produce what the user described. Chat quality is generally praised; image output is the more common complaint.
• Memory loops. Conversations occasionally get stuck repeating themselves until the chat is reset (an issue Candy shares with most of its rivals).
• Cancellation friction. A minority of reviewers report difficulty cancelling without losing account access on the spot.

None of these are legitimacy concerns. They are product concerns, and the difference matters. A product you didn't love is not the same as a company that stole your money.

Red flags and concerns

The one flag to know about, which is not about Candy.ai specifically but about parent EverAI, is Bellingcat's 2025 reporting that EverAI's affiliate network had placed links on MrDeepFakes, the deepfake pornography site that shut down in 2025. When questioned, EverAI said the site was part of its affiliate program. This is not a breach or a crime (affiliate networks are leaky, and brands of every kind end up on sites like that), but factor it in when deciding how comfortable you are with the brand.

Pricing is a minor concern too. At $13.99/mo monthly it's high unless you commit annually (where it works out to $3.99/mo, $47.88 billed upfront) or quarterly ($8.99/mo effective). Token economics mean heavy users pay well beyond the base subscription. Neither is a scam pattern, though both are reasons to go in with eyes open.

Billing and payment safety

Charges appear on bank statements as "EverAI", a discreet descriptor with no mention of "Candy," "AI Girlfriend," or any adult keyword. This is documented in Candy.ai's own help center. For users sharing a bank statement with a partner or family member, this matters more than the price.

Checkout runs on a payment page at checkout.upgate.com, and the help center lists credit and debit cards, Apple Pay, Google Pay, crypto and bank transfer. Your full card number goes to that payment page. Candy's privacy notice says it keeps the card's first digits (the BIN), the last four digits, the expiry date and your name. For comparison, Muah's 2024 breach leaked emails and chat prompts, not card numbers.

Privacy posture

No public breach. EU jurisdiction means GDPR rights apply, from deletion requests to access requests and the rest of the toolkit. The privacy policy is explicit about training. It lists "train and develop our AI models" as a purpose, says preparing training data may include human review of de-identified conversations, and keeps your data for up to three years after your last activity. We found no way to opt out of training, and conversations are not end-to-end encrypted. OurDream and Secrets AI advertise end-to-end encryption on their homepages, but both apps' own privacy policies describe ordinary encryption at rest and in transit instead. If you want the Muah.ai-tier uncensored depth, Candy's filter will feel tighter.

For any app in this category, our working assumption is that the company can read your chats if it wants to. Candy.ai is not worse than its peers on this. It's just not meaningfully better either.

The verdict in detail

Candy.ai is legitimate. The company is real, the billing is discreet, the payment rails are standard, and there is no public incident history we can point to. At 50M+ registered users in about three years, it ranks among the largest AI companion apps by volume, which is a signal that the card networks haven't found reason to shut it down.

"Mostly legit" rather than "legit" comes down to three things. The affiliate-distribution sprawl (see the MrDeepFakes link) is a taste-level concern, the token economy can surprise users on first use, and the category as a whole has a higher-than-average rate of customer-service friction. If you're a new buyer, try the $9.99 first month and move to the annual plan if you stay, read the token mechanics before generating images, and don't assume anything you type is private.

FAQ

Will the charge be obvious on my statement?

No. It shows as "EverAI", which is a company name, not an adult-category descriptor.

Has Candy.ai been hacked?

Not that we can find. When we checked on 6 November 2026, Have I Been Pwned listed no Candy.ai breach. Compare with Muah.ai, whose 2024 breach exposed 1.9M email addresses along with users' prompts.

Is it a subscription trap?

No, but read the renewal terms. You cancel with an Unsubscribe button in Settings and keep access until the paid period ends. The monthly plan renews at $13.99 after a $9.99 first month, and if you've saved a backup card, the terms let Candy charge it when a renewal on your main card fails. So unsubscribe in Settings rather than relying on a blocked card.

Can I get a refund?

Only within 24 hours of a payment, if you've used 20 tokens or fewer and paid by card, and you have to email [email protected] to ask. EU and UK users also have a 14-day right to withdraw from a first purchase, minus what they've used. A chargeback cancels the subscription and removes your premium access and remaining tokens as soon as it's filed, according to Candy's terms.

Is it safe to use a real email?

Candy.ai has no public breach history so the risk is lower than with Muah.ai, but the category as a whole has breach precedent. A dedicated email with a password manager is the prudent default for any adult-tech app.

Is it legit outside the US?

Yes. EU jurisdiction (Malta/Cyprus) means GDPR applies automatically for European users. Availability may vary in conservative jurisdictions (UAE, Saudi Arabia, some Asian markets).