Candy AI drops 'end-to-end encryption' and 'never shared or sold' from its privacy answer

Between September 16 and September 22, 2026, Candy AI rewrote its homepage answer to 'Is chatting with an AI Girlfriend private and secure?'. It used to say Candy 'uses end-to-end encryption to keep all AI GF conversations safe and confidential' and 'Your data is never shared or sold.' It now says Candy uses 'industry-standard security measures, including encrypting data in transit using TLS 1.2+ protocols', and points to the Privacy Notice. That notice, in force before and after, says the content of your messages may go to third-party AI model providers.

Date: 2026-09-22 · first seen by us; the Internet Archive still shows the old answer on September 16. The Terms are dated September 22
App: Candy AI · prices, rules and full change history
Primary source: Candy AI homepage FAQ, "Is chatting with an AI Girlfriend private and secure?"
Last checked: 2026-09-27

The answer, before and after

	Before	After
Encryption	Candy AI uses end-to-end encryption to keep all AI GF conversations safe and confidential.	Candy AI uses industry-standard security measures, including encrypting data in transit using TLS 1.2+ protocols.
Your chat history	You have full control over your chat history	(removed)
Two-factor login	can enable two-factor authentication for extra security	(removed)
Sharing and selling	Your data is never shared or sold.	You can find more information on how we keep your data safe in our Privacy Notice.
Terms of Service	Date of Revision: August 17, 2026	Date of Revision: September 22, 2026

Candy AI's homepage FAQ answer before the rewrite, claiming end-to-end encryption and that data is never shared or sold — Before: the answer in the Internet Archive's copy of candy.ai from 2026-09-16.

Candy AI's rewritten homepage FAQ answer, citing encryption in transit with TLS 1.2+ and linking the Privacy Notice — After: the same answer on the live homepage, captured from the US on 2026-09-27.

What happened

The old answer was on the homepage in every one of our captures from July 6 to September 11, 2026, and the Internet Archive still shows it on September 16. We first saw the new one on September 22, the day Candy's Terms of Service took a new revision date. Candy announced neither change.

The Privacy Notice the new answer points to is dated July 30, 2026, so it was in force while the old answer was up. It never mentions end-to-end encryption. It says message content may be shared with 'third-party LLM providers and/or hosters', and that 'these third parties may receive the content of your messages exchanged with our chatbot', which a chat encrypted end to end would not allow. It also lists access by 'our staff, as needed for them to carry out their work'. The disclosure about AI providers was already in the May 27, 2026 version of the notice. The FAQ was corrected to match the notice; nothing we read says Candy changed how it handles chats.

On selling, the notice promises less than 'never'. Candy 'will not disclose, sell, trade, or otherwise transfer your Personal Data to any third parties without your Consent (where required) or unless otherwise stated in this Privacy Notice', and if the company is sold, 'your data may be transferred to any successor, acquirer, or purchaser'. Nothing we read says Candy sells user data.

The Terms revision of September 22 added one sentence: Candy may offer 'selected users promotions, including rebates in bonus tokens equal to a percentage of tokens spent', 'subject to specified minimum spending thresholds and other eligibility conditions'. In plain terms, a discretionary token rebate for customers who spend enough.

The Eliza Report earns a commission when readers subscribe to Candy AI through our links. That has no bearing on what we record here.

Sources

To cite this page: The Eliza Report, "Candy AI drops 'end-to-end encryption' and 'never shared or sold' from its privacy answer", filed 2026-09-27, last checked 2026-09-27, https://elizareport.com/changelog/2026-09-22-candy-ai-privacy-answer-rewrite/

Candy AI drops 'end-to-end encryption' and 'never shared or sold' from its privacy answer

The answer, before and after

What happened

Sources

Related records

More on Candy AI