Sex Robots & AI Companions

Candy AI

Candy AI is an AI companion platform where you build a virtual partner from scratch, then chat with it across text, voice calls, and NSFW images, video, and roleplay. Launched…

Founded 2023 · 3 years on market

·

Visit Candy AI

·

How we score privacy →

·

All brands →

About Candy AI

Candy AI is an AI companion platform where you build a virtual partner from scratch, then chat with it across text, voice calls, and NSFW images, video, and roleplay. Launched in September 2023 and based in Malta, it covers the full feature stack you’d expect from the current generation of explicit companion apps: adaptive conversation that supposedly learns your preferences over time, personalized image generation, and voice messaging. By end of 2024 the platform had reportedly hit over $25 million in annual recurring revenue, which is a meaningful number for a product barely two years old and reflects genuine consumer appetite for this category rather than just hype. The platform markets itself on emotional intelligence and privacy, citing end-to-end encryption for intimate conversations. Both claims deserve the usual scrutiny: “adaptive learning” in this space typically means pattern-matching within sessions rather than anything resembling a persistent relationship, and encryption doesn’t address the broader data handling questions that made AI companions one of 2024’s defining sextech stories. SEXTECHGUIDE covers those considerations in more detail in its roundup of AI companion apps, worth reading before you start sharing your fantasy life with a server in Malta. Candy AI is a competent, well-monetized entry in a crowded field. Whether it earns long-term user trust will depend less on its revenue trajectory and more on how it handles the privacy questions the category still hasn’t answered cleanly.
Archival coverageFirst covered
3 articles 2023–2024 Peak: 2023 (2)

Candy AI

64%
1

Privacy deep-dive

In summary

In our assessment, Candy.ai's Privacy Notice and TOS demonstrate above-average structural transparency (detailed tables, named processors, specific retention periods) but the underlying data practices — perpetual AI-training licenses, third-party LLM chat sharing, and no account ownership — appear to favor the company significantly. We did not find a clear opt-out from AI training use of conversation content, which is a notable gap for an intimacy-oriented chat service.

  • Detailed purpose-to-legal-basis table provided in Privacy Notice
  • Named payment processors (Emerchantpay, TrustPay, Volt, Coingate, UpGate) disclosed
  • Specific retention windows stated for account, financial, log, and marketing data
  • Chat content explicitly flagged as potentially sensitive personal data requiring consent
  • Perpetual, transferable license to user content for AI training found in TOS

Our editorial assessment of Candy AI’s published policy — an opinion based on the policy text we reviewed, not legal advice or a compliance determination. Spot something wrong? Request a correction

Privacy Concerns

  • High Chat content may be shared with third-party LLM providers/hosters
  • High Perpetual, commercializable license over user content, including for AI model training, with no clear deletion mechanism from training datasets
  • Medium Users have no ownership interest in their own account
  • Medium Sensitive relationship/companion preference data collected, veracity unverified
  • Medium Aggregated/de-identified content usable indefinitely for research and training with no stated expiry

Privacy Positives

  • High Impact Detailed GDPR rights section with named DPO and UK representative
  • High Impact Zero-tolerance CSAM policy with reporting to authorities
  • Medium Impact Concrete retention periods stated for multiple data categories
  • Medium Impact Log files auto-deleted after 30 days
  • Medium Impact No stated sale of personal data to third parties

Security Overview

70% Security
Per-header results measured by Mozilla HTTP Observatory (this site blocks direct scanning).

Security Headers

HTTPS Secure connection
Pass
HSTS HTTP Strict Transport Security
Pass
CSP Content Security Policy
Fail
X-Frame-Options Clickjacking protection
Pass
X-Content-Type MIME type sniffing protection
Pass
Referrer-Policy Controls referrer information
Pass
Permissions-Policy Browser feature controls
Fail

From Their Privacy Policy

Direct excerpts from Candy AI's published privacy policyVerified August 3, 2026 · Source candy.ai/privacy-policy

Please note that these third parties may receive the content of your messages exchanged with our chatbot

Disclosure of chat content to third-party LLM providers/hosters

you grant to us a non-exclusive, royalty-free, fully paid-up, transferable, sub-licensable, worldwide, perpetual license to use, distribute, modify, run, copy, publicly display, make available, store, access, upload, distribute, transmit, translate, modify, exploit, create derivative works of, commercialize, and otherwise use and aggregate your Content

License granted by users over their input/output content

For three years after your last Account activity, to address potential customer inquiries and/or permit further use of the platform

Stated account data retention period

Recommend this brand? Your vote powers Reader favourites.

1