Short answer
Candy AI can be a practical hosted adult companion, but do not treat it as a confidential vault. Its current policies allow automated moderation, human review of flagged account content, quality-assurance sampling, and disclosure of messages to third-party model or hosting providers. Use it for fictional roleplay you can tolerate being stored and processed—not for real-world secrets or identifying media.
Detailed retention comparison: AI chatbots and chat logs. Adult-policy status: Candy filter check.
Affiliate disclosure: Dating Auditors may earn a commission if you join Candy AI through links on this page. The limitations below come from Candy’s public documents and apply regardless of that relationship.
Evidence used
Evidence checked on August 17, 2026. Unless marked as editorial guidance, the product claims below are operator statements—not an independent inspection of Candy’s databases, encryption design, or vendors.
- Candy’s Privacy Notice, revised July 30, 2026.
- Candy’s Terms of Service, revised August 17, 2026.
- Candy’s Blocked Content Policy, revised July 30, 2026.
- Candy’s Cookies Notice, revised February 2, 2026.
- The official account deletion instructions.
- Candy’s companion overview, AI Girlfriend page, and uncensored-chat page for its encryption, training, retention, and privacy marketing claims.
What Candy’s policies permit
| Question | What the public documents say | Evidence label |
|---|---|---|
| Can Candy process chat content? | Prompts, messages, calls, and AI outputs are defined as Content and processed to provide the service. | Operator-stated |
| Can a person review chats? | Flagged content and other content associated with an account may be manually reviewed for moderation. De-identified interactions may also undergo human review when training datasets are prepared. | Operator-stated |
| Can outside providers receive messages? | The privacy notice allows third-party LLM providers, moderation tools, and hosters to receive chatbot messages. | Operator-stated |
| Are chats used for training or QA? | The privacy notice describes de-identified interactions for model development and random Content queries for QA. The Terms separately grant EverAI a broad, perpetual, transferable, and sublicensable Content license that includes model training, product development, and marketing, subject to the privacy notice. | Operator-stated |
| How long can data remain? | Account-related data is generally retained for three years after the last activity unless deletion is requested. Financial records have a separate ten-year schedule; technical interaction logs are stated to auto-delete after 30 days. | Operator-stated |
| Are tracking technologies used? | Candy discloses analytics and targeting cookies, including Google Analytics and Meta-related processing. The notice does not prove which trackers load inside an authenticated chat under each consent setting. | Operator-stated / Unknown |
Marketing claims and policy terms conflict
Candy’s marketing says messages are not used for training or shared, the AI Girlfriend page promises E2EE, and the uncensored-chat page says data is not stored long-term. The current Terms and Privacy Notice permit training uses, multi-year account-data retention, moderation, QA, and provider access.
The documents do not reconcile those statements. For this risk assessment, we rely on the more specific data-handling disclosures and mark end-to-end encryption, encryption at rest, deletion of derived training data, and vendor access controls as unknown. Ordinary HTTPS protects traffic in transit, but it does not by itself establish E2EE.
What account deletion does—and does not prove
Candy documents this path: My Profile → Settings → Danger Zone → Delete Account. Its help center says preferences, usage history, and associated personal information become permanently unavailable, while warning that legally required records can remain.
The privacy notice separately says account data is generally retained for years unless deletion is requested and that valid erasure requests are handled without undue delay, subject to exceptions. This supports a real deletion control; it does not prove an instant wipe of backups, derived datasets, or every legally retained record.
For the full retention analysis and a request checklist, use the no-log comparison and account deletion guide.
Who should choose Candy AI
Choose Candy AI if you want hosted adult roleplay, long-term memory, and web access—and you accept that chat content can be stored, moderated, sampled for QA, and handled by service providers. Adult roleplay remains subject to Candy’s Blocked Content Policy.
Do not choose it if your requirement is:
- no server-side chat storage;
- a publicly verifiable E2EE architecture;
- no possible human or vendor access;
- an instant, independently verified deletion guarantee.
For those requirements, our editorial inference is that a local/offline tool is the safer fit, although Dating Auditors does not currently have a reviewed partner offer for that route.
Practical privacy checklist
- Use a dedicated email and unique password; enable two-factor authentication if it is available in your account.
- Keep real names, workplace details, addresses, medical information, and identifying images out of chats.
- Treat crypto as a different payment trail, not anonymity: Candy’s policy says its crypto processor may receive an email address, wallet address, IP address, country, and transaction details.
- Review the cookie controls before accepting analytics or targeting cookies.
- If you leave, cancel billing, delete the account, and consider a separate erasure request. Keep confirmation records.
Editorial verdict
Our editorial verdict: Candy is a reasonable convenience-first hosted option, not a privacy-maximal service. Its documented deletion route is useful, but the current policies require a clear warning about retention, moderation, QA, and third-party processing.