Find the operator and the applicable policy

Look for a legal company name, contact channel, privacy notice, and a date or version. Make sure the policy covers the chat service you are opening rather than only a parent marketing site. If the app opens on another hostname, check that hostname too.

Candy AI’s public privacy notice names EverAI Limited and says the service is for adults or the local age of majority. It describes categories of processing and GDPR-style rights. That makes the operator inspectable; it does not mean every privacy choice is automatically good for you.

Ask six boring questions

  • Are prompts stored, and for how long after account closure?
  • Can staff or contractors review chats, and under what triggers?
  • Can you delete the account and request erasure?
  • Are generated images or character profiles public by default?
  • Which processors receive payment, analytics, or moderation data?
  • Does the policy distinguish local browser storage from server records?

Separate privacy from secrecy theater

A padlock means transport encryption between your browser and the site. It does not describe retention, training, staff access, or government requests. “Private AI girlfriend” in promotional copy may describe the feeling of a one-to-one chat, not a legal confidentiality promise.

Use fictional names and scenarios. Never upload someone else’s face without consent. Do not use an AI companion as a vault for passwords, medical records, workplace secrets, or evidence of a crime. The safest intimate detail is one that cannot identify you if copied out of context.

Check the exit before the entrance

Locate cancellation and deletion instructions before paying. Logout, subscription cancellation, account deletion, and data erasure are four different actions. A product can offer one without the others. If the obvious terms URL returns an error, look inside the live footer or checkout before accepting a contract.

During our collection, Candy’s obvious /terms and /faq paths returned public 404 pages, while FAQ content was present on the homepage. That is a navigation observation, not proof that terms or help do not exist. It is a reason to inspect the live purchase path carefully.

Quick answers

Are AI girlfriend chats confidential like therapy?

No. They are consumer services governed by their own policies, not a privileged therapeutic relationship.

Does deleting a chat delete the account data?

Not necessarily. Read the specific retention and deletion language and use the provider’s account or privacy request process.