Before an app gets your email or your card, you want to know who stands behind it. Here is the paperwork behind Candy AI, laid out the way you would check an unknown app before installing it. I opened the Shorts catalog on October 28, 2026 and all 190 series loaded, so the service is live. The questions that matter are about the company, the money, your data and the copycats.
Who owns Candy AI?
The Terms of Service, revised September 22, 2026, name EverAI Limited as the owner and operator. It is a company incorporated in the Republic of Malta. The Privacy Notice, revised July 30, 2026, names the same company as data controller. Your bank statement shows the charge as EverAI, which is the name to look for.
Candy Shorts is one section of that platform: short AI-generated series built from its characters, watched without chatting. So when you ask whether Candy Shorts is legit, you are asking about EverAI Limited, not about a separate studio. A named company with a full set of published policies is a good first sign. Whether the product suits you is the next question.
Is Candy AI safe? How payments and refunds work
The terms say subscriptions are payable by credit card, Pay by Bank or other methods offered in your country. The privacy notice also lists Apple Pay and Google Pay. Outside payment providers handle the transaction. The card data the notice names is the brand and the last four digits.
Subscriptions renew automatically for the term and price shown at checkout. To cancel, go to Settings and choose Unsubscribe, and you keep access through the period you already paid for. The pricing guide has the dollar amounts and the full cancel steps.
The Candy AI refund rule is strict. Outside the EU and UK, you have 24 hours after paying to ask. The request is denied if you used more than 20 tokens. Only card purchases qualify. EU and UK users get 14 days to withdraw from a first purchase, minus the part already used. Renewals are excluded.
Safety call: the billing side is transparent, but the 24-hour window is short. Decide on a plan after you have watched the free episodes, not before. Then set a reminder for the renewal date, so the next charge does not catch you off guard.
What Candy AI does with your data
The privacy notice lists what an account collects. That means your email, an encrypted password, an optional nickname and a country detected from your IP address. A Google sign-in brings that provider's own rules. Log files are deleted after 30 days.
Two points deserve attention. First, outside moderation and language-model providers can receive the text of your chats. The notice adds that de-identified interactions may be used to train models. Second, the terms warn users not to share financial details, addresses, contact information or passwords in chats.
On retention, account data is generally kept for three years after your last activity, unless you ask for deletion. Financial and transaction records are kept for ten years under tax and accounting rules. The notice also says personal data is not sold or passed on without consent where consent is required. Verdict: reasonable for a mainstream app. Keep real names and addresses out of the chat box.
The 18+ gate and the content rules
The platform shows an age gate at the entrance, and users must confirm that they are over 18. Giving a false age breaks the terms. Depending on where you live, a third-party age check may follow. The underage policy, revised October 10, 2025, describes automated moderation. It also says known CSAM is forwarded to the US National Center for Missing and Exploited Children.
The platform describes its content as AI-generated, with no real performers. The blocked-content policy bans anything resembling a minor. It also bans deepfakes, private images posted without permission, and tricking people with a fake identity. The licensed creator twins are the exception: each is made with the creator's direct consent.
If something looks wrong, there are two routes. A person who thinks content resembles them can request removal through support or the Contact Us area. For general complaints, Candy AI promises to acknowledge within 24 hours and to resolve within 7 calendar days.
Is Candy Shorts safe to open? Staying on the official site
The real Shorts live inside the official Candy AI site, in a vertical player built for a phone. The Get App option on the plan page explains how to add it to your Home Screen from the browser. It is a shortcut, not a file to download.
The community guidelines, revised March 6, 2026, ban framing, embedding or mirroring the platform's content without written consent. A site that streams full episodes is therefore not an authorized copy. The official social accounts all carry the handle trycandyai on X, Facebook, YouTube, TikTok and Instagram. For leaks and downloads, read the leaked guide. For full uploads on video platforms, see the Dailymotion guide.
Is this site legit, too?
Candy Shorts: NSFW Guide is an independent site. EverAI does not run it and it does not speak for the company. The buttons are affiliate links, so a subscription started through one may earn this site a commission. The about page says who writes here, and the disclaimer spells out the 18+ rule.
Fine to Join If, Hold Off If
Fine to join if you are an adult and accept a plan that renews until you cancel it in Settings. You also keep personal details out of chats. Then the platform behaves like a mainstream subscription app with clear terms, and a free account is a low-risk start.
Hold off if you expect a refund after the first day or after 20 tokens. Also hold off if you need assurance that no tool reads your chats. The privacy notice says otherwise. Also skip any link that does not lead to the official site.