I read the legal pages Candy.ai publishes, starting with the Terms of Service revised on September 22, 2026. Then I reloaded the plans page on October 19, 2026 to see how a charge is labeled. The checks that matter take less time than one episode. Prices and cancellation steps stay in the Candy AI pricing breakdown.
Who owns Candy AI, and is it legit?
Who owns Candy AI? EverAI Limited, a company incorporated in Malta. The Terms of Service name it as owner and operator, and the Privacy Notice, revised July 30, 2026, names it as the party that controls your data. Candy Shorts is no separate company. It is a section of Candy.ai, so the same terms cover a free episode, a chat and a payment.
Is Candy AI legit? As a business, yes. On September 24, 2026 its legal page listed eleven documents. They include the Terms of Service, Privacy Notice, Cookies Notice, Underage Policy, Content Removal Policy, Blocked Content Policy, DMCA Policy, Complaint Policy, an 18 U.S.C. 2257 exemption, Community Guidelines and Affiliate Terms. Under its Complaint Policy, from February 14, 2025, a complaint gets an acknowledgment inside 24 hours and an outcome inside 7 calendar days. Those deadlines are on paper, and only a real ticket tests them.
This site sits outside all of that. It is an independent review site, earns a commission on affiliate links and does not speak for EverAI. The disclaimer spells out how the links work, so you can weigh this guide knowing who gets paid.
Is Candy Shorts a legit website? How to spot a fake
The real Candy Shorts lives inside Candy.ai, at candy.ai/candy-shorts, and its player runs in your browser. A site on another domain that asks for a card in the name of Candy Shorts is a copy. Your thumb moves faster than your judgment on a pop-up, so run four checks before you type a card number:
- The address bar reads candy.ai on the plans page, not a near match with extra words or a different ending.
- You started from candy.ai itself or from a link you chose, not from a pop-up promising full episodes.
- The charge label matches. The plans page says your bank statement shows EverAI, so a different name is a reason to stop.
- You are not asked to install a file. Get App on the plans page adds the site to your home screen from the browser, and the leaks guide covers the APK and Telegram traps.
So is Candy Shorts safe? It is legit because Candy.ai is, and its copies are another story. If a page wants a card and you did not start from the real site, close the tab and begin again from the address you trust.
Is Candy AI a scam? Billing, renewals and refunds
Not on what the plans page and the Terms show. On October 19, 2026 the plans page said the charge shows as EverAI on your bank statement. It also said each plan renews by itself and local taxes may apply. The first month of the monthly plan costs less than its renewals, and the card says so. The Terms add that a price rise must be announced before an automatic renewal at the new price. The practical risk is forgetting the date, so set a phone reminder for the day before.
Can you get a Candy AI refund?
Sometimes, and the window is short. Section 10.4 of the Terms, in the September 22, 2026 revision, splits it by region. Outside the EU and UK you can ask within 24 hours of paying. The request fails if you used more than 20 tokens or paid by a method other than a card. One 12-token episode fits under that line. A second one does not. A technical problem on your side does not qualify.
In the EU and UK you can withdraw within 14 days of the first purchase. You get the money back minus a prorated amount for what you used. Renewals are excluded. A refunded subscription is canceled at once, and no refund follows content removed or an account restricted after a policy violation.
Write to support before you open a chargeback. The Terms cancel a subscription the moment one is filed, and the Complaint Policy warns that wrongful chargebacks can land a customer on a blacklist. To cancel instead, follow the steps in the pricing guide.
Is Candy AI safe to use? Privacy and what you type
For your data, it depends on what you type. The Privacy Notice lists what an account holds. That means email, an encrypted password, a nickname, gender if you give it, a country and city detected from your IP address, your token balance and your sign-in history. Payments run through payment providers, and the records tied to them are kept for ten years under tax and accounting rules.
Chats are the sensitive part. The notice says conversations can be de-identified and used to train AI models and moderation tools. People may review de-identified samples, and outside providers running moderation or the language models may receive your messages. Logs are deleted after 30 days. Account data stays up to three years after your last activity unless you ask for deletion.
The Terms tell you not to share financial details, addresses, contact details or passwords in a chat. They also call a character's offer to meet in person fake. Watching Candy Shorts involves no typing: the help center says a short plays without a chat and leaves your chat history alone. The typing starts when the player offers a chat after an episode, as it does in Mona's Worst Enemy.
Is Candy AI banned? The 18+ gate and account rules
As a site, it was online on October 19, 2026: I loaded its plans page from a US server. I have no verified list of countries that block it, so I won't guess. The Underage Policy leaves compliance with local adult-content law to you. Accounts are a different matter. The Terms let EverAI suspend or end an account it believes broke the rules, and no refund follows a moderation action.
The 18+ gate is the first rule you meet. The Underage Policy, revised October 10, 2025, describes an entry screen where you confirm you are over 18. It adds that further checks may apply where local rules require them. The Privacy Notice mentions third-party age estimation and ID verification, applied by location.
The Blocked Content Policy, dated July 30, 2026, bans among other things anything resembling minors, deepfakes, non-consensual intimate images, impersonation of real people and illegal material. The Content Removal Policy of the same date treats a likeness to a real person as coincidental unless that person gave explicit consent and usage rights. That consent is the basis of the licensed twins on the creator pages, and Our Host Is Riley Reid is one example.
Is Candy AI trustworthy? My call
Trustworthy enough to swipe on, with three habits. Start from candy.ai and keep payments on the plans page you reached from there. Keep real names, addresses and passwords out of chats. Set a reminder before the renewal date, because that is the date that costs money.
Candy AI is legit, and the paperwork backs it up: an operator, public policies, complaint deadlines, an age gate and a refund window you can read in minutes. The part no document covers is the copycat layer, meaning clone sites and copied episodes. Whether Candy Shorts is worth it then becomes a price question, and the pricing guide does that math. To look before you pay, episodes 1 and 2 of Room 742 play on a free account.