How long are conversations kept?

Account data for three years after the account closes — or one year after last activity or the end of a paid subscription, or until a deletion request, whichever applies. Financial records run ten years under tax law. Those are real periods, and only one other vendor in this file publishes any.

Does a person read my chats?

The privacy notice states that preparing datasets for model training may include human review of de-identified or anonymised interactions with AI companions. No other vendor read here discloses that, which is a point in favour of the disclosure rather than against the practice — it is likely not unique, only uniquely written down.

EverAI Limited, registered in Malta under number C107181. Worth noting alongside JuicyChat, whose operator gives the same business-centre address in Santa Venera; the documents state the addresses, and nothing here infers anything further from that.

Candy AI: real periods, narrow ownership

One of two vendors in this file that answer the retention question with numbers. The ownership clause needs reading twice, because the second half takes back something the first half appears to give.

Several products 2 of 6 documents read Privacy notice revised the day before reading

The question

Two things make this entry worth more than its search demand suggests. It publishes retention periods, which almost nobody in this category does. And its terms contain the clearest example of a pattern worth learning to spot: an ownership sentence followed, several sections later, by a restriction that narrows it considerably.

What we checked

Privacy policy

How long are prompts and generations kept, and can they be deleted?

Satisfied by

A retention period in days or months, a deletion route that removes rather than flags, and a plain statement about training use.

Usually found

No period at all, deletion described as account closure, and training use addressed in a sentence that could mean either thing.

At stake

Prompts in this category are the most sensitive record a consumer service can hold. Indefinite retention turns one breach into a permanent problem.
Terms of service

Who holds rights in what the tool produces?

Satisfied by

An explicit grant of output rights to the user, and a narrow, stated licence back to the vendor for operating the service.

Usually found

Silence about the user's rights and a broad perpetual licence to the vendor covering promotion and model training.

At stake

Publishing anything made with the tool depends entirely on this paragraph, and it is never on the pricing page.

Pricing page Not opened
Terms of service Contradicted elsewhere
Privacy policy Published
Content policy Not opened
Checkout and cancellation Not opened
Support channel Not opened

The walk for Candy AI: 2 of the six documents opened, on 20 October 2026. Each stop restates the finding recorded further down this page, with the page it came from.

The periods it states

Three of them, in the notice itself, which is two more than five of the seven vendors here manage between them. The tax-law figure is the longest number on this site and it is also the least alarming of the three: it covers invoices, not conversations.

1 year

Account data after last activity · Candy AI, privacy notice

3 years

Account data after closure · Candy AI, privacy notice

10 years

Financial records, under tax law · Candy AI, privacy notice

Read on 20 October 2026, from Candy AI's own documents — the periods it states, in the words it states them in.

What the documents said

2 of the six documents have been opened. Each row gives the page it came from and the date it was read; where a document carries its own last-modified date, that is in the note, because in this category the age of a policy is itself a finding.

PublishedPrivacy policy

One of only two vendors here that publish actual periods. Account data is kept three years after closure — or one year after last activity or the end of a paid subscription, or until a deletion request — and financial records for ten years under tax law. The notice also states that interactions are used to train models and that preparing those datasets may include human review of de-identified conversations, which no other vendor in this file discloses. Revised 19 October 2026, the day before it was read.

candy.ai/privacy-policy · read 2026-10-20

Contradicted elsewhereTerms of service

The operator is EverAI Limited of Malta, registry number C107181. The terms say the user retains ownership of their input and that the operator will never claim it — then take a perpetual, sublicensable, transferable licence including commercialisation, and separately prohibit the user from using anything generated on the platform for commercial purposes of any kind. Ownership that cannot be exercised commercially is a narrower thing than the first sentence suggests.

candy.ai/terms-of-service · read 2026-10-20

Paid placement

SpicyAI — Discover AI characters with unique personalities. Chat, share stories, or create a companion of your own — with text, voice, images, and video.

Contradicted elsewhere Pricing page. The only vendor read here that publishes its limits and its prices without a sign-in: $6.99 a week, $9.90 a month, $59.88 for twelve months, with 100 images and 10 videos a month on Premium. The same page then states the free allowance twice, as five chat turns on the plan card and ten turns per character in the table, and the Premium allowance twice, as unlimited on the card and 1,000 turns in total in the table.

Published Terms of service. Effective 2 December 2025, with the operator named and a contact address in the document. The user owns what they generate, and the licence running back is perpetual, irrevocable, sublicensable and transferable — and extends beyond operating the service to promotion and advertising.

Published Privacy policy. No retention period: the policy gives the factors it weighs instead, which is the same answer six of the eight catalogued vendors give. Chats and user content are used to train the models and are monitored for compliance, and the policy says so plainly rather than burying it.

Contradicted elsewhere Content policy. The community guidelines are the strongest of any vendor read here: eighteen and over, no character presented as younger than that and no aged-up rewrite of one, no sexualised depictions of real people without consent, human and automated review. The public tag list then carries jk, a Japanese abbreviation that denotes exactly the age bracket those guidelines rule out.

Published Checkout and cancellation. Card only, with other methods described as coming. Cancellation any time, with access running to the end of the billing cycle and no further charge — stated on the page where the subscription is sold rather than in a separate document.

Contradicted elsewhere Support channel. A support address is published, which several vendors here do not manage. Two of them, in fact: the terms give one address and the community guidelines give the same mailbox at a different domain.

Go to SpicyAI Go to the Telegram bot

Questions

Do I own what I make on Candy AI?: The terms say you retain ownership of your input and that the operator will never claim it. They also prohibit using anything generated on the platform for commercial purposes of any kind. Both sentences are in the same document, and together they describe ownership you may exercise privately and not commercially.
How long are conversations kept?: Account data for three years after the account closes — or one year after last activity or the end of a paid subscription, or until a deletion request, whichever applies. Financial records run ten years under tax law. Those are real periods, and only one other vendor in this file publishes any.
Does a person read my chats?: The privacy notice states that preparing datasets for model training may include human review of de-identified or anonymised interactions with AI companions. No other vendor read here discloses that, which is a point in favour of the disclosure rather than against the practice — it is likely not unique, only uniquely written down.
Who operates it?: EverAI Limited, registered in Malta under number C107181. Worth noting alongside JuicyChat, whose operator gives the same business-centre address in Santa Venera; the documents state the addresses, and nothing here infers anything further from that.