Is Candy AI Safe and Legit? What We Checked

Candy.ai is a legitimate paid service run by a registered company, EverAI Limited in Malta, and the bigger risks sit around it rather than on it. Prices, cancellation and refund rules are published, and charges show up on statements as “EverAI”. Fake apps, “leaked episode” pages and phishing messages that borrow Candy’s name are where the real danger lies.

Sources: Candy’s subscription page, help center and terms, plus the public Shorts catalog read logged out on Nov 4, 2026. We have not audited Candy’s security or data handling, so this guide does not rate them; it covers what you can check and control.

Who runs Candy.ai

Candy.ai is operated by EverAI Limited, a company registered in Malta under number C107181.

The company name is also what appears on your card statement, which makes a charge easy to match to the service. Candy AI Shorts, the AI-generated mini-series this site covers, is part of candy.ai and streams only there. Candy Series Porn is independent: we are not affiliated with Candy.ai or EverAI. Some of our links to Candy are affiliate links, and they never change a rating or a Heat level.

Is Candy AI legit or a scam?

Candy.ai is a real commercial product, not a scam: it publishes its prices, renewal terms, cancellation route and refund conditions.

• Prices before you pay. Premium plans and their billing terms are visible on candy.ai/subscriptions without logging in.
• A cancel option you can find. Unsubscribe sits in your profile settings, and Premium runs until the paid period is over.
• Written refund rules. Section 10.4 of the terms of service sets out when a refund is possible.
• A named company and descriptor. EverAI Limited, Malta, billing as “EverAI”.
• A free way to look first. Episode 1 of every public Shorts series plays with no account, so you can see the product before you hand over any details.

Legit does not mean cheap or flexible. Premium renews automatically, refunds are narrow, and paid episodes cost tokens. Read our pricing guide before you subscribe so none of that catches you out.

Why do some people call it a scam?

Mostly because of how it is sold. Every plan renews automatically, the refund window closes 24 hours after payment, and series pages show token prices on paid episodes next to an upgrade prompt that promises to “unlock all premium episodes”, which confuses buyers. The promo clips on TikTok, Instagram, YouTube or X are cut to those platforms’ rules, so the real episodes differ from the ads. Copycat sites and fake apps that borrow Candy’s name add to the confusion.

Billing and payments

You can pay Candy by card, crypto, Apple Pay, Google Pay or bank transfer, and the charge appears as “EverAI”.

The same methods work for Premium and for token top-ups; bank transfer runs through Volt or Pix. Two details are worth knowing before you choose. First, Candy’s refund rule covers card payments only, so the other methods give you no refund route under that rule. Second, Premium renews on its own: the 12-month plan renews for the same price and term, and the 1-month plan moves from its discounted first month to the full monthly price. Note the renewal date the day you subscribe.

The “EverAI” descriptor also helps with discretion, because the word “Candy” does not appear on the statement line. Anyone who reads your statement can still see that a charge exists, so think of it as discreet rather than invisible.

Cancelling and refunds

You can cancel whenever you like from your profile settings, but a refund is only possible within 24 hours of a payment and under strict conditions.

To cancel, log in, open My Profile, then Settings, find the subscription details at the bottom, click Unsubscribe and confirm. There is no pause option. Premium stays active until your paid period runs out, and any tokens left on the account stay there, hidden while you are on the Free tier.

A refund is a separate request. Under section 10.4 of Candy’s terms, you email support@candymail.ai within 24 hours of the payment and say plainly that you want a refund; you must have used no more than 20 tokens and paid by card. Cancelling does not count as asking for a refund. The full walkthrough is in Candy AI pricing.

Privacy: what you control

You cannot inspect Candy’s servers, so the practical way to protect yourself is to control what you hand over in the first place.

• Start without an account. Episode 1 of public series needs no sign-up, so you can decide whether you want an account at all before giving any details.
• Use a separate email address. An address used only for this account keeps Candy’s emails out of your main inbox and limits what is tied to your name.
• Use a unique password. A password manager makes this easy. Never reuse the password from your main email or your bank.
• Keep real details out of chats. Do not type your full name, address, workplace or other people’s details into AI chats, and do not share photos of yourself or anyone else.
• Know what your statement shows. Charges read “EverAI”, not “Candy”.
• Mind shared devices. On a shared computer or phone, use a private browsing window and sign out when you finish.

What to check in Candy’s privacy policy and terms

We have not reviewed Candy’s data practices in detail, and we do not state security certifications or data handling we have not seen. Before you pay, open Candy’s privacy policy and terms of service and look for:

• what personal data Candy collects, including chats, generated images and payment data;
• how long chats and generated content are kept;
• whether, and how, you can delete your account and your data;
• which third parties process payments or data, and where data is stored;
• how to contact Candy about privacy requests;
• the cancellation and refund sections, including section 10.4.

Creator twins and consent

According to Candy’s help center, each creator digital twin is made in direct partnership with the creator and with their full consent.

Some Shorts series star the licensed AI twin of an adult performer or creator: Riley Reid, Mia Malkova, Sophie Dee, Lexi Luna, Asa Akira, Bonnie Blue and Lena the Plug, and Candy lists more creators on its creators page. Examples include My Stepmom Sophie Dee Caught Me Changing, Lena The Plug Stole My Boyfriend, My Wife’s Best Friend with Riley Reid’s twin and Honeymoon With My Mother-in-Law with Lexi Luna’s.

We report what Candy states; we have not seen the agreements themselves. For viewers, two things follow. The twin is an AI character licensed by the real person, not footage of that person. And twin series cost more per paid episode: 30 tokens against 12 on standard series. Be wary of anything that claims to show a creator’s Candy series outside candy.ai: those series exist only on Candy.

All characters are adults and AI-generated

Every character in Candy AI Shorts is an adult, and every episode is AI-generated and scripted.

Episodes run under two minutes, follow a script with a beginning, middle and end, and are separate from Candy’s chat characters. Many series use step-family setups, as in our Stepsister and Stepmom & MILF themes; this site treats those as fictional relationships between adults and describes them that way. Our guide Is Candy Shorts porn? explains the Heat scale from Suggestive (1) to Full (5), which gives levels without scene descriptions. The episodes do contain nudity and sex scenes, mostly in the paid part, and the bodies are AI-generated: no one was filmed. Candy Shorts is an 18+ product; our nudity guide covers what is shown and when.

Scams around Candy AI

The real risks come from sites, apps and messages that use Candy’s name: leak pages, fake apps and phishing.

• “Leaked” and “free full episode” pages. Candy AI Shorts stream only on candy.ai. Pages offering full series elsewhere are re-uploads, bait pages, fake apps or traps for card details. Our page on Candy AI leaks shows how to spot them.
• Fake apps. A download that promises Candy Shorts, unlocked episodes or free tokens outside candy.ai is not a way into Candy’s catalog. Do not install it, and do not sign in through it.
• Phishing. Messages that ask you to confirm your Candy login or card through a link. Type candy.ai yourself instead of clicking, and check the address bar before you enter a password.
• Free token offers. Tokens come from Premium, top-ups on candy.ai and Candy’s referral program. A third-party generator or code giveaway that wants your login or card is a trap.
• Look-alike checkouts. Pay only on candy.ai. A page elsewhere that asks for card details to unlock episodes is not Candy.

If you have already typed card details into a page like this, contact your bank. If you entered your Candy password somewhere suspicious, change it on candy.ai straight away.

Safe vs risky: a quick comparison

The safe choice is nearly always the one that keeps you on candy.ai and limits what you share.

How to set up a safe Candy.ai account, step by step

Try Shorts without an account first, then sign up with a separate email and read the terms before you pay anything.

1. Open candy.ai directly. Type the address or use a bookmark, and check the address bar.
2. Watch Episode 1 logged out. Any public series works. If Shorts is not for you, you are done and have shared nothing.
3. Create a separate email address for this account only.
4. Choose a unique password and store it in a password manager.
5. Sign up for the Free tier. It opens Episode 2 of public series at 0 tokens, which is enough to judge whether you want more.
6. Read the privacy policy and terms before you pay, using the checklist above, including the refund rules in section 10.4.
7. If you subscribe, choose the payment method on purpose. Cards are the only method covered by the refund rule. Expect the charge to read “EverAI”, and note the renewal date.
8. Keep personal details out of chats and out of anything you generate.
9. Know your exit. My Profile, then Settings, then Unsubscribe. Cancel before the renewal date if you do not plan to continue.

Go to the official Candy.ai site →

What we could not verify

We cannot confirm anything about Candy’s security certifications, encryption or data retention, because none of it was part of what we could check.

If those points decide whether you sign up, Candy’s privacy policy and terms are the place to look, and support@candymail.ai is the address Candy gives for refund requests. To try Shorts without sharing anything, start with how to watch Candy AI Shorts free.

Series mentioned in this guide

FAQ

More guides