Key takeaways
- The privacy notice describes account, device, payment and content data.
- Prompts and outputs may contain personal data if the user includes it.
- Flagged content may be reviewed under moderation and safety policies.
- The service is restricted to adults who meet local legal-age requirements.
Who operates the service
The provider’s privacy notice identifies EverAI Limited as the controller for the service. It describes Candy AI as an online chat application that creates virtual and fictional AI companions and may include images, videos and voice notes.
Operator details are useful for understanding which legal entity controls data, processes payments and responds to privacy requests. Always check the most recent version because company details and service providers can change.
Types of data involved
AI companion services can process registration details, device and connection data, payment information, preferences, prompts, conversations and generated outputs. If a user types personal information into a prompt, that information becomes part of the content processed by the service.
Minimize data from the beginning. Avoid full names, addresses, private photos, identity documents, financial details, workplace secrets and health information. A fictional character does not need real-world identifying data to produce a useful conversation.
How prompts and outputs may be used
The current terms and privacy materials should be reviewed for service delivery, safety, analytics, improvement and model-development purposes. These purposes can involve processing conversation content and generated outputs.
Users should not assume that “private” means no automated processing or no review under any circumstances. Privacy, confidentiality and moderation are different concepts.
Moderation and flagged content
The community and underage policies describe automated trust-and-safety controls. Conversations, requests or outputs that are flagged as potentially violating policy may be reviewed, and action can include content removal or account termination.
This is important when evaluating claims that every conversation is completely inaccessible to anyone else. Read the legal documents together and prefer precise explanations over absolute marketing language.
Age rules and responsible access
The provider states that users must be at least 18 or the legal age of majority where they are located. An age gate is part of the access process, and misrepresenting age can violate the terms.
An independent review site should display this rule clearly, avoid presenting the service as suitable for minors and never provide instructions for bypassing age checks or regional restrictions.
Payments, cookies and third parties
Payment processors, analytics, security tools and cookies can create additional data flows. Review the cookie notice and checkout disclosures, including merchant descriptors, taxes and recurring billing.
Third-party links or embedded services have their own policies. A privacy review should distinguish between data controlled by the independent review website and data controlled by the product provider.
Deletion and user controls
Check whether users can delete chat history, generated media, characters and the account, and whether deletion is immediate or subject to legal retention. Save cancellation confirmation before closing an account with an active subscription.
Privacy rights vary by location. Requests may include access, correction, deletion or objection, but exceptions can apply. Use the contact method listed in the current privacy notice.
Practical safety checklist
- Use a unique password and secure recovery email.
- Keep conversations fictional and avoid sensitive real-world details.
- Review microphone, notification and storage permissions.
- Monitor recurring charges and token spending.
- Do not treat AI output as professional advice.
- Use current legal and support channels for privacy requests.
Frequently asked questions
The service publishes privacy and moderation policies, but flagged content may be reviewed and content is processed to provide the service. Read the current legal documents rather than relying on an absolute slogan.
Avoid addresses, identity documents, payment credentials, private photos, workplace secrets, medical information and other sensitive data.
No. The provider states that users must be at least 18 or the legal age of majority where they live.