Most "is it safe" questions about AI companion apps are hypothetical: what could happen to your chats. With Muah AI, it already happened. In 2024 a hacker took a database linking users' email addresses to the prompts they'd written, and that data circulated widely enough to be catalogued by breach-notification services. If you searched is Muah AI safe, that's the first thing you need to know.
Not for anything you'd want kept private. In September 2024, Muah.AI suffered a breach exposing 1.9 million email addresses alongside AI prompts, according to Have I Been Pwned. Its terms don't name a registered company, and subscriptions are non-refundable by default. If you use it, use a throwaway email and never type identifying details.
Sources: Have I Been Pwned "Muah.AI Data Breach," 404 Media (Oct 8, 2024), Muah.AI Terms of Service (effective May 17, 2022), read Oct 7, 2026.
What Muah AI is
Muah AI (muah.ai) describes itself as "an AI companion platform for adults." You create a fictional character, shape its personality and appearance, and chat by text, voice, generated photos and video. It offers a browser demo without logging in, and sign-in by email, phone or Discord.[1] The site states it is "for adults 18+."[1]
The 2024 Muah AI data breach
Have I Been Pwned (HIBP), the breach-notification service run by security researcher Troy Hunt, lists the incident this way: "In September 2024, the 'AI girlfriend' website Muah.AI suffered a data breach. The breach exposed 1.9M email addresses alongside prompts to generate AI-based images."[2]
| Detail | What the record shows |
|---|---|
| When | September 2024 |
| Accounts | 1.9 million email addresses |
| Data exposed | AI prompts, email addresses, sexual fetishes |
| HIBP status | Flagged "Sensitive Breach": not publicly searchable |
| First reported | 404 Media, Oct 8, 2024 |
404 Media, which viewed the data, reported that the prompts "reveal users' sexual fantasies" and are "linked to email addresses, many of which appear to be personal accounts with users' real names." The hacker told the outlet the site looked "put together pretty poorly" and that they found vulnerabilities "relatively quickly."[3] Both HIBP and 404 Media also report that many prompts described child sexual abuse scenarios.[2][3]
That combination, real email addresses tied to explicit prompts, is the worst case for this category, because it creates obvious blackmail and extortion risk for the people in the data.
We haven't found a detailed public statement from Muah.AI on what it changed after the breach. Users discussed the incident on the r/MuahAI subreddit, but we don't report security claims we can't confirm from the company or an independent source.
How to check if you were in the Muah AI breach
- Go to haveibeenpwned.com and sign in to your dashboard with the email address you used on Muah.AI.[2]
- Open Breaches under Personal. Because the Muah.AI breach is flagged as sensitive, it won't show in a public search; it only appears to the verified owner of the address.
- If it's listed: treat any email or message referencing your Muah activity as a possible extortion attempt. Don't pay, don't reply, and keep the evidence.
- Change the password anywhere you reused your Muah password, and turn on two-factor authentication on your email account.
Who runs Muah AI?
This is harder to answer than it should be. The Terms of Service refer to the operator only as "MUAH.AI," describe it as "a software development company," and say disputes are governed by "the laws of United States." They don't give a registered company name or postal address.[4] The homepage says "California Based."[1] The terms carry an effective date of May 17, 2022, and still contain an unfilled template placeholder: appeals will be answered "within [X] business days."[4]
Compare that with competitors that name their legal entity and registration number, like Candy AI (EverAI Limited, Malta, C107181). An unnamed operator isn't proof of wrongdoing, but it does make complaints and data requests harder to pursue.
Muah AI pricing and refunds
Muah AI doesn't publish a public price list. Its user guide says the chatroom presents "VIP and higher media or model tiers," and that "plan names, prices, quotas, and individual tool rules" can change, so you should review the total, the billing period and the account before checkout.[5] Free accounts can hit message limits, photo-generation quotas, locked photos and call allowances.[5] Unverified We'll add actual plan prices after a test purchase.
The refund rule is in the terms:
Consumer subscription purchases under Muah AI are NOT refundable.
The same clause says subscriptions "can be cancelled anytime" by emailing [email protected], in the settings page or through the payment provider, and that support "can issue one-time exception partial refund or even full refund" in special circumstances. It also warns that users who dispute payments without contacting support first will face a "zero refund stance" and a counter-dispute.[4]
What Muah AI users report
- Trustpilot: the "Muah" profile we found had only 4 reviews and none in the last 12 months on Oct 7, 2026, and is categorised as an SEO service, so we don't treat it as a meaningful signal.[6]
- Reddit: Muah has its own subreddit, r/MuahAI. We'll summarise specific threads with links after reviewing them in full.
If you use Muah AI anyway
- Sign up with an email address that contains no part of your real name and isn't used anywhere else.
- Never type names, locations, workplaces or photos of real people into chats or image prompts.
- Use a unique password.
- Pay with a method you can cancel easily, and screenshot the plan and total before checkout.
- Assume anything you write could one day be read by someone else.
Safer Muah AI alternatives
No companion app can promise your chats will never leak. But you can choose one with a named, registered operator, a published privacy policy and a clearer refund rule. Candy AI is run by EverAI Limited in Malta, discloses its billing name, and refunds within 24 hours if you've used 20 tokens or fewer; read our Candy AI review. For more options, see the best Candy AI alternatives and adult Character AI alternatives.
Frequently asked questions
Is Muah AI safe?
It has a serious privacy track record. In September 2024 Muah.AI suffered a data breach that exposed 1.9 million email addresses alongside AI prompts, according to Have I Been Pwned. Its terms don't name a registered company, and subscriptions are non-refundable by default. If you use it, use an email address that isn't linked to your real identity.
Was Muah AI hacked?
Yes. Have I Been Pwned lists a Muah.AI breach from September 2024 covering 1.9 million email addresses, AI prompts and sexual fetishes, flagged as a sensitive breach. 404 Media reported on Oct 8, 2024 that a hacker had taken a database of users' chatbot prompts linked to email addresses.
How do I check if my email was in the Muah AI breach?
Because Have I Been Pwned flags the Muah.AI breach as sensitive, it isn't publicly searchable. Sign in to your Have I Been Pwned dashboard with the email address and check the Breaches section.
Is Muah AI legit?
It is a real, working service that has operated for years, with published terms effective May 17, 2022. But its terms describe the operator only as "MUAH.AI" without a registered company name or address, and the homepage says only "California Based." That makes it harder to know who you're dealing with than with competitors that name their legal entity.
Does Muah AI give refunds?
Its terms say consumer subscription purchases are "NOT refundable," though support "can issue one-time exception" partial or full refunds in special circumstances. Subscriptions can be cancelled in the settings page, through the payment provider or by emailing [email protected].
How much does Muah AI cost?
Muah AI doesn't publish a public price list. Its user guide says plans, prices and quotas are shown in the chatroom's membership comparison and can change. We'll add verified prices after a test purchase.
Sources
- Muah.AI homepage, read Oct 7, 2026
- Have I Been Pwned: Muah.AI Data Breach, read Oct 7, 2026
- 404 Media: Hacked 'AI Girlfriend' Data Shows Prompts Describing Child Sexual Abuse, Joseph Cox, Oct 8, 2024
- Muah.AI Terms of Service, effective May 17, 2022 (read Oct 7, 2026)
- Muah.AI user guide, read Oct 7, 2026
- Trustpilot: muah.ai, read Oct 7, 2026