Episode 2 of a Candy Shorts series ends mid-sentence, episode 3 asks for tokens, and a payment form is waiting. That is the moment to ask who sits on the other side of your card.
Is Candy Shorts legit, and who runs it?
Legit, on the checks I ran. Candy Shorts lives inside Candy.ai, and the Terms of Service, revised on September 22, 2026, say that EverAI Limited, a Maltese company, operates the platform. Charges, policies and complaints trace back to that one named company, which is what separates a business from a pop-up page. A named operator is the first test of a legit website, and Candy.ai passes it.
I read the legal documents that Candy.ai gathers on one page. On September 24, 2026, that page listed eleven: the Terms of Service, the Privacy Notice, the Cookies Notice, the Underage Policy, the Content Removal Policy, the Blocked Content Policy, the DMCA Policy, the Complaint Policy, an 18 U.S.C. 2257 exemption notice, the Community Guidelines and the Affiliate Terms. The Complaint Policy, dated February 14, 2025, promises an acknowledgment within 24 hours and a resolution within seven calendar days.
Two caveats keep the verdict honest. This guide is independent of EverAI, and the watch buttons on the page are affiliate links, so check my reading against the documents themselves. And legit describes the operator, not the content: what the series show is covered in our guide on whether Candy Shorts is porn.
How does the charge show up, and can you get a refund?
On a card statement the charge reads EverAI, after the company, not Candy.ai or Candy Shorts. Local taxes can apply on top. If you see that name, it is the expected one. Prices and plan terms live in our Candy Shorts pricing guide, so this page stays with the rules.
You can cancel any time from the account settings. A plan renews on its own at the same price and length, so the date to watch is the renewal date: cancel before it, not after. Put it in your calendar the day you subscribe.
Refunds are narrower, and they follow section 10.4 of the Terms of Service. They cover card purchases. For buyers outside the EU and the UK, the window is a single day, and spending past 20 tokens closes it early. In the EU and the UK, a first purchase carries a 14-day withdrawal right, reduced by what you used, with renewals left out. The arithmetic is in the pricing guide, so decide on a refund the same day, not after a binge.
What does Candy.ai say about your data?
The Privacy Notice and the Cookies Notice are the documents to read on what Candy.ai collects and how it uses it. They sit on the same legal page as the Terms of Service. I send you there instead of paraphrasing them, because a summary goes stale the day a notice changes. Read both before you create an account you plan to use for chat.
Other documents settle a few privacy points. Watching a Candy Shorts episode does not touch your chat history (Help Center, August 25, 2026). The doorway to the chat sits at the end: the player of Mona's Worst Enemy closes an episode by offering a chat with Mona Newman, and you can ignore it. The Content Removal Policy treats removal requests as confidential, although Candy.ai may ask for proof of identity.
The Community Guidelines, revised March 6, 2026, mention trust and safety checks and sanctions up to closing an account. A service that runs checks and applies sanctions has rules behind the screen. I treat a chat with that in mind: it takes place inside a company's product, not in a sealed diary.
Who gets in, and what stays out?
You must be at least 18. The Underage Policy, revised October 10, 2025, says so, and the entrance puts up an age gate where you declare that you are over 18. A declaration rests on your word, so a shared phone or tablet deserves a thought. Candy.ai also describes itself as fully AI-generated: its 18 U.S.C. 2257 exemption notice, revised February 14, 2025, states that no real person takes part in making the content.
The Blocked Content Policy, revised July 30, 2026, lists what cannot be created or shared: illegal content, hate and discrimination, violence and self-harm, child exploitation, which the policy says is reported to NCMEC, content that resembles minors, privacy and copyright violations, deceptive impersonation of real people or celebrities, intimate images shared without consent, and deepfakes. It applies to text, images, video and any other AI content on the platform. The Community Guidelines add bans on getting around moderation and on framing, embedding or mirroring the site's content without written consent.
If a piece of content looks like you or another real person, the Content Removal Policy lets you ask for its removal through the support email or the Contact Us area. Candy.ai keeps the request confidential and removes the content after verification. The policy treats any other resemblance to a real person as coincidence, except where a known person consented explicitly and granted the rights to use a digital version of themselves. That is how the creator digital twins work: Riley Reid licensed hers for My Step-Sister's Dormitory and did not perform in it.
Is Candy AI safe? Where the real risks sit
The trouble I would watch for starts away from Candy.ai. Sites that sell full episodes, ask you to download a file or send you to a group chat are not Candy.ai, and none of the rules above covers them. In my September 24, 2026 check, the official accounts on Instagram, TikTok, YouTube, Facebook and X all used the handle trycandyai. An account with another handle is not an official channel.
The plans page offers the app as a home screen shortcut from your browser, not as a file, so an installer that claims to be the app should stop you. Our leaked guide goes through the look-alikes one by one.
The second risk is yours to control. The Terms of Service call the chats fiction, but you are not fiction. Keep your full name, address, employer, face photos and card details out of a conversation: no character needs them to tell a story. Free accounts get 5 chat messages and Premium removes the cap, which makes the first message the right moment to set the rule.
Final verdict: is Candy Shorts worth it, and is it safe?
Candy Shorts is legit: a named company, written rules for payments, content and removal, and an age gate. It is safe to try without paying: on October 16, 2026, the catalog held 159 series, and 145 of them opened with two episodes at zero tokens. The risks that remain are the ones you control: where you click, what you type and when your plan renews.
Whether it is worth paying for is a question of taste, and the free episodes answer it at no cost. Pay for episode 3 when episode 2 leaves you needing it, cancel before the renewal date if it does not, and keep your real details out of the chat. Pass on it if you are under 18, or if you would rather keep adult material off your screen. For the rest of Candy.ai, read our Candy AI review, and to see what plays at no cost, the free episodes guide.