Is Candy Shorts legit? The name on your bank statement
The Terms of Service name EverAI Limited, a company incorporated in Malta, as the owner and operator, and the footer of the plans page says the charge appears as "EverAI" on a bank statement. That is the company name, not the Candy Shorts brand name, which surprises people who scan their bank app for "Candy". Candy Shorts is a section of the same platform, so the terms, the age rules and the payment rules apply to it. Candy.ai's legal information page lists eleven documents, from the Terms and a Privacy Notice to an Underage Policy, a Complaint Policy and the Community Guidelines.
On entry, an age gate has you confirm that you are over 18, and the Underage Policy sets the same minimum. The Blocked Content Policy of Candy.ai bans content that resembles minors, deepfakes and non-consensual intimate images. This site is independent of Candy.ai and EverAI. Links from this site to Candy.ai carry an affiliate code: if you start a subscription through one, this site earns a commission, and your price stays the same, as the disclaimer page explains.
How I tested this
I treated the question as a due-diligence check, not a review of the episodes: who is behind the service, what you agree to when you pay, what happens to your data and which trust signals deserve your attention. My account is Premium, which means I have been through checkout and the paid episodes, and I went through the Terms and the Privacy Notice in full.
- As of October 20, 2026, the Terms of Service in force name EverAI Limited as owner and operator.
- The footer of the plans page says the charge appears as "EverAI" on a bank statement.
- Candy.ai's legal information page lists eleven documents, from the Terms to the Affiliate Terms.
- I watched Candy Shorts on Premium and on a free account, and episodes play without a chat on both.
- Payments and refunds are sections 9 and 10 of the Terms, and the table below summarizes the clauses that cost money or access.
The list is not a verdict on the product. It is evidence about the operator and its paperwork, which is what "legit" means here. "Safe" needs two more answers, one on trust signals and one on privacy, and the sections below take them in turn.
Five clauses in the Terms that cost money or access
Payment is by card, Pay by Bank or other methods offered in some countries, and the plans page adds that local taxes may apply. The payment section of the Terms holds clauses that most people skip, so I pulled out the five that can cost money or access.
| Clause | What the Terms in force say |
|---|---|
| Renewal | Plans renew on their own at the price and length shown at checkout, charged on the first day of the new period |
| Price increases | Allowed at Candy's discretion, but announced before a renewal at the higher price |
| Failed charge | If your default method fails, the backup method you saved can be charged the same amount |
| Chargeback | Opening one cancels the plan at once and revokes access to paid features |
| Moderation | No refund for moderation actions, or for characters and content that Candy removes or changes |
None of this is unusual for a subscription, but it bites when you don't know it. The backup clause matters if you saved a second card and forgot. The chargeback clause means a dispute with your bank ends your access the moment it opens. The refund and cancel rules get their own walkthrough, so here I stay on trust.
Reading trust signals: promo lines, quotes and your own checks
Read the trust signals on a plans page with a cold eye. The plans page of Candy.ai carries "Trusted by 50M Users" and "1000+ Ratings", which are promotional lines, not figures I verified. It also shows five user quotes under masked names such as A* and M*. I treat them as marketing, not as verification, and I would not base a payment on them.
Use checks of your own instead. To judge whether any site is legit, look at three things: the operator named in its terms, the name on the charge, and the address you typed yourself instead of a link from a stranger. Pages that promise leaks or a mod APK are a different risk, laid out in fake downloads and mod APKs. Reposts of clips on video sites are covered on the full episodes page.
Is Candy AI private? What the Privacy Notice says
The current Privacy Notice names EverAI as the controller of your data. To register you give an email address and a password, which is stored encrypted. Candy.ai also detects your country from your IP address and tracks your token balance. Card payments run through outside payment providers.
Chats are the sensitive part. The notice says that moderation tools and AI providers, including third-party language-model providers, may receive the content of your messages, and that anonymized exchanges can be used to train models. The Terms add that flagged content may be reviewed by hand. Candy Shorts do not need a chat: Candy.ai's help article on Candy Shorts says they play without one and leave your chat history alone.
If you want out, you can ask for deletion, and the notice says account data then goes without undue delay. Without a request, account data stays on file for up to three years after your last activity, though that period can be shorter, and financial records for ten years. Debug logs are deleted after 30 days.
Pay or pass: my verdict on the paperwork
Where I land: Candy.ai is a real business with strict, readable terms. Pay for Candy.ai if you have watched the free episodes, want more, and accept automatic renewal and a 24-hour refund window. Skip Candy AI if you need a trial period or an easy way to undo a purchase later. The cheapest safety check costs no money: episode 1 plays for a guest, and the route to the free episodes has the rest. Try Kiss My Enemy or YES MA'AM first, since whether Candy Shorts is worth it depends on the episodes, not on safety.