1. Who this policy covers
This policy applies to candy--ai.org and nothing else. It does not cover the platform we write about, which is operated by EverAI Limited and runs its own privacy practices on its own domain, nor any other site you reach from ours. Once you click through, that site's policy is the one that governs you.
2. What we do not collect
Stated as a list, because the absences matter more than the presences here. We do not:
- Offer accounts, logins or profiles, so there is no user record to hold.
- Run any analytics product, first-party or third-party. No page-view pixel, no session recorder, no heatmap.
- Serve advertising or embed ad-network tags.
- Operate forms, newsletters or comment threads.
- Load fonts, scripts or images from third-party domains. Every asset on these pages is served from this one.
- Sell, rent, trade or share personal data with anyone, for any price.
The stylesheets and the single script file this site loads run entirely in your browser. The script's only jobs are to show the action bar when you scroll, highlight the section you are reading, open one disclosure at a time in the questions list, and open the platform's site in a new tab when you press an action button. None of that sends anything anywhere.
3. Server logs at our host
Like any website, this one is served by a hosting provider that records technical request data: the IP address making the request, the time, the URL requested, the HTTP status, the referring page where the browser supplies one, and the user-agent string. These logs exist for security and reliability, including the detection of abuse and automated scraping.
We do not combine those logs with anything else, build profiles from them, or use them for marketing. They are retained for a short operational period by the host and then discarded on its ordinary schedule.
4. Cookies and browser storage
This site sets no cookies of its own and writes nothing to local storage, session storage or IndexedDB. There is no consent banner because there is nothing to consent to.
If you reach us through a search engine or another website, that intermediary may already have set cookies in your browser. Those are theirs, placed before you arrived, and governed by their policies rather than this one.
5. Referral links and what leaves with you
Our action buttons open the platform through a tracked referral link, which is how this site is funded. When you follow one, the tracking service and the destination site receive the technical details any web request carries, such as your IP address, your user-agent and the fact that the visit originated from a link of ours. A tracking identifier tells the platform which publisher to credit if you later subscribe.
What is not transmitted: we attach no identifier of our own, we pass no information about you because we hold none, and we receive no report naming individual visitors. What we see, at most, is an aggregate count of conversions. We never learn who subscribed, what they paid, which companion they chose or anything that happens inside their account.
If you would rather not be referred
Type the platform's address into your browser directly instead of using our buttons. You will get the same product at the same price; we simply will not be credited.
6. Email you send us
If you write to the address on our contact page, we necessarily hold your message, your email address and anything you chose to include. We use it only to answer you and to fix what you reported.
Correspondence is kept for up to twelve months so that we can follow up on a correction or a removal request, then deleted. We do not add correspondents to any list, and we do not use an address you wrote from for any purpose other than replying to you. Please do not send sensitive personal data by email; we do not need it and would rather not hold it.
7. Why we are allowed to do this
Where data protection law requires a legal basis, ours are the straightforward ones. Keeping security logs rests on our legitimate interest in running a site that stays online and is not abused. Answering your email rests on your own initiative in contacting us, and on our legitimate interest in maintaining accurate pages. Referral attribution rests on our legitimate interest in being paid for editorial work that is free to read.
We rely on consent for nothing, because we ask you for nothing.
8. Your rights and how to use them
Depending on where you live, you may have the right to ask what personal data an operator holds about you, to have it corrected or erased, to restrict or object to its processing, and to receive a copy of it. You may also have the right to complain to your national supervisory authority.
To exercise any of these with us, write to the address on our contact page. In practice the answer will usually be short: unless you have emailed us, we hold nothing about you beyond host-level logs that are not linked to any identity. For requests concerning your Candy AI account or the content you generated there, contact the platform directly, since we have no access to it.
9. Minors
This site covers an adult platform and is intended only for people aged 18 or over, or the age of majority where they live. It is not directed at children, we do not knowingly hold data about anyone under 18, and if you believe a minor has sent us anything, tell us and we will delete it on receipt.
10. Changes to this policy
If our practices change, for example because we add a feature that needs storage, this page changes with them and the review date at the top is updated. We will not quietly introduce analytics or advertising while leaving this text as it is; the policy you are reading is meant to be an accurate description of the site, not a template.
The terms governing use of the site are separate, and are set out in our legal notice, which also carries our commercial disclosure.