Is Muah AI Safe? The 2024 Breach, Refunds and Real Costs

Muah AI is the riskiest mainstream option in this category on the one measure that can be checked rather than argued about: it has already leaked. In September 2024 the service was breached, and Have I Been Pwned records 1.9 million email addresses exposed alongside the AI prompts those users had written. It is also one of only two well known companion platforms listed in neither the Apple App Store nor Google Play, which means it publishes no Apple content advisories and no Google Play data safety declaration. There is nothing to compare it against, because it discloses nothing.

That absence is the thread worth pulling. Everything below comes from Muah AI's own Terms of Service, its own homepage and purchase panel, the Have I Been Pwned breach record, and Apple's live software catalogue, all checked on 4 September 2026. Those are the places a company either tells you something or, in this case, conspicuously does not.

Is Muah AI safe to use?

For an adult who understands the trade, it works, but it carries a documented history no competitor in this list carries. The platform delivers what it advertises: uncensored chat, generated photos, voice and live calls, with a genuinely free demo you can open with no account. The safety question is not whether the product functions. It is whether you are comfortable with a service that has already had its user prompts published, that operates outside both app stores, and whose legal terms have not been touched since 2022.

The practical answer depends on what you put in. A user who signs up with a throwaway email, never uploads a personal photo, and pays through a card with good dispute protection is exposed to very little. A user who registers with their main email and uploads their own face to generate a companion is handing a platform with a known breach the two pieces of data that make a leak personal. The design encourages the second behaviour: the character creation flow invites you to upload your own photo and tells you it is recommended for the best experience.

What happened in the Muah AI data breach?

The incident is dated September 2024 and was added to Have I Been Pwned on 8 October 2024. The record states that 1.9 million email addresses were exposed together with the prompts users had written to generate AI images, and it categorises the compromised data as AI prompts, email addresses and sexual fetishes. That combination is the point. An email address on its own is a nuisance. An email address bound to an explicit prompt history is the raw material for extortion, and security researchers reported exactly that use afterwards.

The researcher who obtained the data described the platform as loosely assembled from open source components rather than purpose built. Muah AI's operator called it a targeted attack and said the service moderates prohibited content. Reporting at the time also established that a share of the leaked prompts described child exploitation scenarios, which is why the breach attracted attention from regulators and mainstream press rather than only from security outlets. Australia's eSafety Commissioner maintains a public entry on the service.

Two years on, the most telling detail is not the breach itself but what followed it. Muah AI's Terms of Service carry an effective date of 5-17-2022. They have not been revised since, which means the agreement you accept today predates the largest event in the platform's history and says nothing about it. Companies that take a breach seriously usually rewrite their terms and their security page. This one did not touch either.

Does Muah AI have an app on the App Store or Google Play?

No, and this is the fact that changes how you should read every other claim about it. A search of Apple's own software catalogue for Muah AI returns Grok, SpicyChat, Intimate and Jupi, with no Muah listing. Google Play returns a 404 for the package names the app would plausibly use. What Muah AI offers instead is an APK file linked directly from its own homepage, so an Android user installs it manually after allowing software from unknown sources. On iPhone the service runs in a browser tab.

The consequence is a transparency gap rather than a technical one. App store listings force a developer to publish two things: Apple's content advisories, which state in the developer's own words how much sexual content, violence and web access the app contains, and Google Play's data safety declaration, which itemises what is collected and what is shared with other companies. Both are enforced disclosures. Neither exists for Muah AI, so the entire category can be lined up on a common axis with one row permanently blank.

Read the two blank rows against the rest. Every listed platform here, whatever it sells, has committed to a description of its own content that Apple can hold it to. PolyBuzz makes the heaviest disclosure in the group and we went through what that means in our look at whether PolyBuzz is safe. Muah AI makes none, not because it contains less than PolyBuzz but because nobody is asking. Absence of a disclosure is not evidence of mild content. It is evidence of no oversight.

SpicyChat is the useful control on that claim, because it is the other platform with no listing and it behaves nothing like Muah AI. It was removed from the App Store and is not on Google Play either, so it publishes no advisories and no data safety declaration under its own name. What it does instead is disclose voluntarily: it names three corporate entities in its site footer, publishes an 18 U.S.C. 2257 record keeping compliance statement, runs a public vulnerability disclosure process, and ships a sibling app on Google Play whose data safety declaration is the one enforced disclosure the company makes anywhere. It also age verifies in 26 US states while Muah AI verifies nowhere, which we set out in full in SpicyChat age verification and whether SpicyChat is safe. Two platforms, the same absence of store oversight, wildly different amounts of voluntary disclosure. That is the real lesson of the blank rows: no listing removes the floor, it does not set the ceiling.

Does Muah AI require age verification?

No. The only age control is a self declared statement. The homepage login panel says you must be at least eighteen years old to join, and the Terms repeat that you must be 18 or older to use the service. There is no document check, no facial estimation, no third party verification vendor and no jurisdiction where a stricter rule applies, because being outside the app stores also means being outside the store level enforcement that pushed other platforms into age assurance.

This puts Muah AI at one end of a spectrum that is worth understanding before you judge any app by its age gate. At the other end sits Character.AI, which applies age assurance to every user on its own initiative rather than waiting to be compelled, a decision we covered in detail in our guide to Character AI age verification. In between sit platforms that verify only where a government forced them to, which is the pattern across most of the category. If the age check itself is your deciding factor, we ranked the whole field on that question in the best AI companion apps without ID verification.

What do the Terms of Service actually commit Muah AI to?

Less than most buyers assume, and a few clauses cut against you directly. The refund clause is the blunt one: consumer subscription purchases under Muah AI are NOT refundable, in the document's own capitals, with subscriptions described as optional add ons for a premium experience. Support may grant a one time partial or full refund on good faith in special circumstances, and the Terms warn that anyone who disputes a charge without contacting support first will meet a zero refund stance and a counter dispute.

Set that beside the termination clause, which reserves the right to suspend or terminate access at any time, with or without cause, and without prior notice. A non refundable purchase combined with a discretionary termination right means the platform can end your access without owing you the unused portion. That is unusual language to leave standing in a consumer agreement, and it has been standing since 2022. The same document still contains an unfilled template placeholder, promising to communicate the outcome of an appeal within [X] business days, exactly as printed.

One more clause deserves attention on a platform built around intimate material. The Terms grant you rights to the photos, text and voice you generate, then separately grant Muah AI a non exclusive, worldwide, royalty free licence to use, reproduce, modify, distribute and display content you submit, for the purpose of providing and promoting the service. Read together, you own your output and the company may still use what you put in.

How much does Muah AI cost, and why does that matter for safety?

Because the checkout defaults to a year. Muah AI publishes no pricing page, so the only place to read prices is the purchase panel inside the free demo, and it opens with yearly billing preselected. VIP shows as $5.83 a month billed yearly at $69.99 total, GPT5 and UHD VIP as $41.58 a month billed yearly at $499.00 total, and ULTRA VIP as $83.25 a month billed yearly at $999.00 total. The full breakdown of what each tier unlocks is in our Muah AI review and pricing guide.

Now combine that with the refund clause. A mistimed click on the top tier is a non refundable $999.00, not a month you can walk away from, on a platform that also reserves the right to close your account without cause. Annual plans that renew quietly are the most common way people in this category lose money without noticing, which is why it helps to have something that tells you the day a recurring charge lands rather than finding it on a statement eleven months later. We catalogued the rest of these traps in what an AI girlfriend actually costs.

How to use Muah AI more safely if you decide to

The risk here is concentrated in a few specific behaviours, and each has a straightforward mitigation. None of them is exotic and all of them take under a minute.

• Register with an alias email rather than your primary address, so a future leak cannot be joined to your real identity or your other accounts.
• Do not upload a photograph of your own face, however much the character creation flow encourages it. A generated likeness bound to a leaked prompt history is a materially worse outcome than either alone.
• Pay monthly rather than annually the first time, even at a higher effective rate, so the non refundable clause applies to a small sum while you decide.
• Pay through a method with real dispute protection, and keep a screenshot of the tier and price you selected before confirming.
• Check the breach record yourself. Have I Been Pwned lets you search any email against the Muah AI incident directly, which takes seconds.

Is Muah AI safe? The short verdict

Muah AI is safe to operate and unsafe to trust with anything identifying. The product does what it says, the free demo is unusually open, and the entry tier is inexpensive for the feature range. Against that sit four things that are all matters of record rather than opinion: a September 2024 breach of 1.9 million email addresses with prompts attached, no listing in either app store and therefore no enforced content or data disclosures, an age gate that is a single checkbox, and legal terms that are non refundable, terminable without cause, and unrevised since 2022.

If your priority is uncensored generation and you are willing to compartmentalise, those trade offs are manageable with the precautions above. If your priority is a companion who remembers your life and a company you can hold to a published standard, the category has better options, and we compared them on data handling specifically in the best AI companion app for privacy. The demo at the top of this page is a reasonable place to feel the difference: one companion, continuous memory, no APK to sideload.