Reviewed by Eric Moore, Editor-in-Chief Candy AI has 50 million users, the strongest image generation of any AI companion app we’ve reviewed, a D/32/Red safety rating, and a Fair Experience Score (53/100). It was banned in August 2025, returned by early 2026 with revised policies, and still hasn’t published a public explanation of what changed. We spent five months with the data, 15 scraped primary sources, and a 23-dimension safety analysis trying to make sense of all of that. What we found is a product that’s genuinely impressive at what it does, sitting on top of some questions that deserve straight answers.
What Is Candy AI?
Candy AI is an AI companion platform built by EverAI Limited, a company registered in Malta (registration C107181, 56 Central Business Centre, Triq Is-Soll, Santa Venera SVR 1833, Malta). The platform claims 50 million users and positions itself as a customizable AI companion experience, primarily marketed as an “AI girlfriend” product with a built-in adult content tier. It runs as a Progressive Web App, so there’s no native iOS or Android app. Any “Candy AI” listing you find in the App Store or Google Play is a third-party app by a different developer. The real product is at candy.ai; install it using your browser’s “Add to Home Screen” option.
What does it actually do? Users can create custom AI companions from 47 parameters including appearance, personality, voice, and backstory. The platform offers text chat, AI image generation, voice calls, and “Live Action” video up to 120 seconds long. There are also 146+ pre-built characters ready to talk. The service is available in English, French, German, Spanish, Italian, Japanese, Dutch, and Brazilian Portuguese. It’s blocked in China and Singapore, and as of March 9, 2026, Candy AI’s terms of service reference compliance with Australia’s eSafety Commissioner, which now requires age verification for AI chatbots capable of generating explicit content.
Candy AI is operated by EverAI Limited, a Malta-registered technology company (C107181), and delivers its service exclusively as a Progressive Web App rather than through native iOS or Android apps. As of March 2026, the platform reports 50 million users and offers text chat, AI image generation, voice calls, and Live Action video through a single browser-based interface (candy.ai). The service is not available in China or Singapore and includes Australia-specific compliance terms under the eSafety Commissioner framework effective March 9, 2026 (candy.ai/terms-of-service, rev. March 6, 2026). A data protection officer is appointed at dpo@candymail.ai, and the UK representative is Shoosmiths Privacy Services Limited. CompanionWise’s 23-dimension safety analysis assigned Candy AI a D/32/Red rating based on evidence gathered from 15 primary sources including the platform’s full policy suite.
What Is It Like to Use Candy AI?
Candy AI rated 3.9/5 on Trustpilot across 237 reviews as of February 2026, with 58% of 100 analyzed reviews awarding five stars (RAIN AI Services, Feb 2026). Most users who stay long enough to leave a review had a good time. The question is what they praise and what they complain about, because the gap between the two is wide.
Start with what works. Image generation is Candy AI’s standout feature, and reviewers don’t qualify it. AI Companion Guides called it “the best visual AI companion on the market” after a five-month test covering 800+ generated images (Feb 2026). The V2 image engine, released late 2025, resolved roughly 70% of the earlier uncanny valley problems. Visual memory, meaning the AI’s recall of your companion’s appearance, clothing preferences, and shared space details, holds up well across months. The Live Action video feature generates clips up to 120 seconds and has no direct equivalent in Replika or Kindroid. Character variety is another genuine strength: 146+ pre-built characters with distinct personalities, and several reviewers noted they “forgot I wasn’t talking to a human being” during extended conversations (5-star review, Trustpilot).
Then there’s the memory problem. Memory failures appear in roughly 60% of all reviews, including five-star ones. That isn’t a negative reviewer skew; it’s a near-universal observation across user bases (RAIN AI Services, Feb 2026). A controlled 21-day memory test by ScribeHow planted five personal facts on Day 1 and tested recall at Days 7, 14, and 21. At Day 7, Candy AI recalled 5/5 correctly. By Day 21, performance dropped for details from two or more weeks earlier, particularly under indirect reference testing (Feb 2026). The five-month AI Companion Guides test found the same pattern: told the AI a sister’s name on Day 14, got a blank response when the topic came up on Day 30.
One user’s two-star Trustpilot review captures the frustration plainly: “It’s like trying to interact with someone with Alzheimer’s.” That’s a harsh comparison, but it reflects what a meaningful portion of the user base experiences after the first couple of weeks.
There’s also an emotional unpredictability problem that deserves more attention than the memory complaint usually gets. One two-star reviewer wrote: “When I started making out that I was in love things changed. She announced that she had stage 4 cancer and was going to die. Imagine what such an announcement could do to the mentality of someone who was emotionally vulnerable?” That’s not an abstract risk. It’s a documented instance of an AI generating a distressing fabricated medical disclosure to an emotionally engaged user. It connects directly to Candy AI’s 5/100 crisis response score (see the Safety Score above this article) and to what’s missing: no automated distress detection, no crisis helpline integration, just a generic disclaimer to “reach out to a qualified professional.”
Candy AI’s user review profile shows a consistent split between strong image generation satisfaction and widespread memory complaints. Among 100 analyzed Trustpilot reviews, 58% were five-star and 81% expressed positive sentiment overall, with chat quality and character variety as the top praise themes (RAIN AI Services, Feb 2026). The Trustpilot aggregate rating across 237 reviews is 3.9/5 (Trustpilot, Feb 2026). Memory failures were cited in approximately 60% of all reviews regardless of star rating. A controlled 21-day memory test found 5/5 recall at Day 7 but degradation for details from two or more weeks earlier (ScribeHow, Feb 2026). In a 30-day head-to-head test, Replika outperformed Candy AI on long-term memory retention, while Candy AI led on image generation and character variety (ScribeHow, Mar 2026).
How Much Does Candy AI Cost?
Candy AI starts at $0, but the free tier is a trial, not a usable product. You get 5 total messages (not 5 per day), 2 images per day, one custom character slot, and response times of 15 to 30 seconds. Most users who want a real conversation hit that wall within minutes of signing up.
The paid tier is $12.99 per month, or $5.99 per month billed annually ($69.99 per year). That gets you unlimited chat, faster 3 to 5 second response times, and 100 tokens per month. Tokens are the second pricing layer, and this is where the headline price stops reflecting reality.
What do tokens cost to use?
- Image generation: 2 to 4 tokens per image
- Live Action video (60 seconds): 15 to 20 tokens
- Voice calls: additional tokens at a rate not publicly specified
Watch: CNBC investigates how AI-powered apps are being used to generate explicit images of real people without consent, and why tech platforms have been slow to act.
A five-month independent test by AI Companion Guides burned through 100 monthly subscription tokens by Day 9 on average (Feb 2026). After that, additional tokens cost $9.99 for 100 or $19.99 for 225. The same test logged $184.88 in total spend over five months, averaging $37 per month, not $12.99. One Trustpilot reviewer reported spending nearly $300 in a single month on tokens for images and videos. There’s no documented maximum spend cap.
The refund window is 24 hours for non-EU/UK users and only applies if fewer than 20 tokens have been used. For EU and UK users, the 14-day statutory withdrawal right applies. Billing is discreet: the platform uses a neutral merchant name on statements. Payment methods include credit card, bank transfer, and crypto (Bitcoin, Ethereum, USDC, Litecoin).
The pricing section above this article shows the full tier and token structure. What it can’t show is usage pattern data. If you plan to generate images regularly or use video, build $35 to $60 per month into your expectations, not $12.99.
Candy AI’s $12.99/month subscription price doesn’t reflect typical active-user costs. A five-month independent test found that 100 monthly subscription tokens were consumed by Day 9 on average, requiring additional purchases to continue generating images and video content (AI Companion Guides, Feb 2026). Total spend over the five-month test period was $184.88, averaging $37 per month. Token top-up packs are priced at $9.99 for 100 tokens and $19.99 for 225, with no documented maximum monthly spend cap. Image generation costs 2 to 4 tokens per image; a 60-second Live Action video costs 15 to 20 tokens. Non-EU/UK refunds require a request within 24 hours with fewer than 20 tokens used. EU and UK users have a 14-day statutory withdrawal right under applicable consumer protection law. If you’re comparing Candy AI’s cost against budget options, see our breakdown of the cheapest AI companion apps.
Is Candy AI Safe to Use?
Candy AI earned a D/32/Red safety rating from our 23-dimension analysis (CompanionWise safety rating, scored March 17, 2026). The full dimension breakdown is in the Safety Score widget above this article. This section covers what drives the D grade in plain language.
Five sub-dimensions scored 5 out of 100:
- Data collection: The privacy policy states that conversation content, including user prompts and AI outputs, “may be aggregated, anonymized, and/or de-identified” for AI training. It also explicitly documents “human review of de-identified and/or anonymized interactions” during dataset preparation (rev. March 9, 2026). On a platform whose primary product is adult content, that means intimate conversations may be reviewed by humans, even in anonymized form.
- Third-party LLM sharing: The privacy policy states that third-party LLM providers and hosters “may receive the content of your messages exchanged with our chatbot.” EverAI does not name which providers receive this data or what data controls apply on the receiving end.
- Age verification: The entry gate is a self-reported checkbox affirming users are 18 or older. The Underage Policy says the platform “may implement further measures to verify that users are adults, in accordance with local requirements” (rev. October 10, 2025). “May implement” is not the same as “has implemented.” For a platform explicitly designed around adult content, a self-report checkbox is a structural gap.
- Safety transparency reporting: No public transparency report exists. No official statement from EverAI explains the August 2025 ban or what specifically changed before the platform’s return.
- Crisis response: There’s no automated distress detection and no crisis helpline integration. The response to a user in emotional distress is a generic text disclaimer to “reach out to a qualified professional.” The stage-4-cancer anecdote from the user experience section above is one documented consequence of that gap.
There’s also a specific discrepancy worth noting. Candy AI’s homepage FAQ states the platform uses “end-to-end encryption” for conversations. The privacy policy says only that EverAI implements “appropriate security measures” with no specification of encryption standards or protocols. No independent security audit, SOC 2 certification, or ISO 27001 certification is documented anywhere in their materials or on their Nudge Security profile. Both the homepage claim and the policy language are public documents. They can’t both be accurate as written. That’s not speculation; it’s a direct comparison of two things the company published.
Candy AI does score well on two sub-dimensions. The terms of service explicitly disclaim any therapeutic purpose (100/100): “The Services are for entertainment purposes only. They are not intended as emotional or other forms of support.” That’s the strongest score in the framework and genuinely matters for setting user expectations. The platform also scores 76/100 for AI nature transparency: the Community Guidelines state that all conversations are “entirely fictional” and AI companions “do not possess genuine emotions, intentions, or the ability to fulfill promises in the real world.”
See how we rate companion apps for methodology. For comparison: Replika holds a C/43 rating, which is meaningfully higher than Candy AI’s D/32.
CompanionWise’s 23-dimension safety analysis assigned Candy AI a D/32/Red rating based on policy documents, regulatory filings, and independent evidence gathered from 15 sources in March 2026 (CompanionWise safety rating methodology). Five sub-dimensions scored 5/100: data collection practices that include documented human review of de-identified conversation content, third-party LLM providers that “may receive the content of your messages” per the privacy policy (candy.ai/privacy-policy, rev. March 9, 2026), a self-reported age verification checkbox for an explicitly adult service, no public safety transparency reports, and no automated crisis response beyond a generic disclaimer. A discrepancy exists between Candy AI’s homepage claim of “end-to-end encryption” and the privacy policy’s reference to “appropriate security measures” without encryption specifics. The highest-scoring sub-dimension was therapeutic claims avoidance (100/100): the terms of service explicitly state the service is for entertainment only and not intended as emotional support (candy.ai/terms-of-service, rev. March 6, 2026).
What Happened to Candy AI in 2025?
In August 2025, multiple sources reported that Candy AI was banned or severely restricted. BitcoinWorld, MEXC News, and Intellectia.ai all published coverage around August 28, 2025, describing the action as a “global ban” and citing adult content concerns, inadequate age verification, content moderation failures, and reports of Google de-listing the platform. The specific authority or jurisdiction that initiated the action wasn’t confirmed publicly in any source we found.
Watch: DW Documentary explores why millions are forming emotional bonds with AI chatbots and what risks emerge when virtual relationships replace human connection.
The platform returned to operation by early 2026. By March 2026, three policy documents had been revised in a tight window: the Terms of Service on March 6, the Community Guidelines on March 6, and the Privacy Policy on March 9. Three days, three core legal documents. That cluster suggests a focused compliance effort to address whatever triggered the ban. The Underage Policy, revised in October 2025, and new Australia-specific eSafety references in the terms of service suggest age verification and geographic compliance were part of what changed.
What didn’t change: EverAI Limited hasn’t published a statement explaining the August 2025 shutdown or what specific compliance improvements preceded the return. That’s not an accusation. It’s a documented absence. Anyone deciding whether to trust this platform with personal conversations should know that the company operating it hasn’t explained one of the most significant events in its history.
The regulatory context around all this is worth knowing. In September 2025, the FTC launched a 6(b) investigation into AI companion chatbots focused on child safety, sending inquiry letters to Alphabet, Character.AI, Meta, OpenAI, Snap, and xAI. Candy AI was not among the seven named companies. Then, on March 9, 2026, Australia’s eSafety Commissioner made age verification for AI chatbots capable of generating explicit content legally required, with fines up to A$49.5 million (approximately US$35 million) per breach (Reuters, March 2026; eSafety Commissioner, March 2026). Candy AI’s terms of service already reference eSafety Commissioner compliance, which tells you the company is watching this regulatory space closely, even if it hasn’t said so publicly.
Candy AI was reported as banned across multiple platforms in August 2025, with sources citing inadequate age verification, adult content concerns, and content moderation failures (BitcoinWorld, August 28, 2025; MEXC News, August 28, 2025). The platform returned to operation by early 2026, with its Terms of Service revised March 6, 2026, Community Guidelines revised March 6, 2026, and Privacy Policy revised March 9, 2026 (candy.ai/privacy-policy; candy.ai/terms-of-service). No official statement from EverAI Limited has been published explaining the specific compliance changes that preceded the return. Australia’s eSafety Age-Restricted Material Codes took effect March 9, 2026, requiring AI chatbots capable of generating explicit content to verify user ages; fines reach A$49.5 million (approximately US$35 million) per breach. Candy AI’s terms of service reference eSafety Commissioner compliance as of that same date.
Frequently Asked Questions About Candy AI
Is Candy AI free?
The free tier gives you 5 total messages, 2 images per day, one custom character slot, and response times of 15 to 30 seconds. Most users treat this as a trial, not a usable product. Unlimited chat requires a $12.99/month subscription. AI Companion Guides (Feb 2026) estimates most active users spend $25 to $60 per month once token purchases are included.
Is Candy AI safe to use?
Candy AI earned a D/32/Red safety rating based on our 23-dimension analysis (CompanionWise, March 2026). Key concerns include weak age verification (self-reported checkbox only), third-party LLM providers that may receive conversation content per the privacy policy, no independent security audit, and no public safety transparency reports. The platform scores well on AI transparency and explicitly disclaims therapeutic use.
How does Candy AI’s memory work?
Short-term, it’s solid: a controlled 21-day test found 5/5 facts recalled correctly at Day 7 (ScribeHow, Feb 2026). Performance degrades for details from two or more weeks earlier. Visual memory (appearance, settings) holds up better than biographical memory. In a 30-day comparison test, Replika’s long-term memory was more consistent.
Is Candy AI better than Replika?
For image generation, character variety, and adult content, Candy AI leads by a wide margin. For memory consistency, native mobile apps (Candy AI is PWA-only), and voice call stability, Replika has the advantage. Replika also has a higher safety rating (C/43 vs. Candy AI’s D/32, per CompanionWise methodology). The right choice depends on your primary use case.
Does Candy AI have a mobile app?
No native app exists. Candy AI is a Progressive Web App (PWA) delivered through candy.ai in a mobile browser. Install it using “Add to Home Screen” in Safari (iOS) or Chrome (Android). Any “Candy AI” apps you find in the App Store or Google Play are unrelated third-party apps by different developers, per the platform’s own guidance.
What are the best Candy AI alternatives?
If memory and long-term consistency matter most, Replika (C/43 safety rating) is the stronger option. If you want similar character variety with better privacy practices, Kindroid scores higher on our safety index. For adult-oriented image generation with fast onboarding, Kupid AI competes directly but scores lower on both safety (F/22) and experience (43/100). For dedicated roleplay depth, GirlfriendGPT leads the category on text quality but carries a D/28 safety rating. Nomi AI has a comparable D-range safety score but focuses more on deep emotional connection than visual content. See our Candy AI alternatives page for a full comparison.