Is Muah AI safe? The breach, the company and what to do

The 2024 Muah AI data breach

In September 2024 a hacker accessed Muah AI's database. Have I Been Pwned (HIBP), the breach notification service, added it on 8 October 2024 and lists these facts (Have I Been Pwned):

• 1.9 million email addresses were exposed.
• They were exposed alongside the prompts users had written to generate images.
• HIBP notes that many prompts were sexual in nature and many described child exploitation, and it flags the breach as sensitive, so it cannot be searched publicly.

Malwarebytes reported that the prompts were linked to email addresses, many of which appeared to be personal accounts with users' real names. It quoted the hacker describing the platform as "a handful of open-source projects duct-taped together", and said Muah AI's administrator claimed the attack was sponsored by competitors (Malwarebytes). The story was first reported by 404 Media. Our AI girlfriend data breaches guide tracks this and other leaks.

How to check if your email was exposed

1. Go to haveibeenpwned.com and use its notification service with your email address. Because the Muah breach is flagged sensitive, HIBP only shows it to the verified owner of the address, after you click a link it emails you.
2. If your address appears, change the password on any account that used the same one, and turn on two-factor login where you can.
3. Watch for emails that mention Muah AI or your chats and ask for money. Do not reply or pay; report them to your email provider.

If the email carries your real name or workplace, consider moving your companion app accounts to a separate address. Our guide to staying anonymous on companion apps explains how.

Who runs Muah AI

Muah AI's terms and privacy policy, both dated 17 May 2022, name only "MUAH.AI" and give no company name or street address; the site footer says "California Based", and the terms are governed by US law with arbitration (terms, archived). The terms describe Muah AI as an "AI processing service provider" and make users responsible for content the AI generates from their prompts. Contact is love@muah.ai. Among the 31 apps in our ranking, it is one of very few that does not name its operator. Our Muah AI review covers the product.

Privacy claims vs what happened

Muah AI's landing page promises "Absolute Privacy", "Encrypted Communication" and "Delete account with ease", and says "We do not sell ANY data to ANY 3rd party" (landing page, archived). Its privacy policy adds that data is shared with service providers, when required by law and in a merger or sale.

The breach showed the limits of those claims: prompts were stored in a way that could be tied to email addresses. Nothing in its public pages describes what changed afterward. Our guide on whether companion apps read your chats covers what a strong privacy policy looks like.

Billing, deletion and age checks

• Billing: the VIP checkout is card only, and Muah AI does not publish its statement text or offer discreet billing in our data.
• Refunds: subscriptions are not refundable; disputing a charge without contacting support first triggers a "zero refund stance".
• Deleting your account: a "Delete account" option sits in the account menu, and privacy requests go to love@muah.ai.
• Age checks: users must be 18 or over by self-declaration, and accounts shown to be under 18 are suspended. There is no ID or selfie check. The homepage warns that any child prompt means suspension.
• Apps: the site offers an Android APK; its App Store and Google Play links no longer led to a US listing on 29 September 2026.

Our age verification guide explains why most named apps now check ages more strictly.

How to use Muah AI more safely

• Use a separate email with no real name, and a password you use nowhere else.
• Share nothing identifying: no real names, addresses, workplaces or photos of yourself or anyone real, including in photo exchange.
• Try the no-login demo first, before creating any account.
• Pay monthly, not yearly, since subscriptions are not refundable.
• Only use muah.ai or mwah.ai, which it says it owns, and its own APK; avoid mirror sites and "free VIP" offers.

If trust is a deal-breaker, apps run by named companies offer the same calls and photos. See Muah AI vs Nomi AI and Muah AI alternatives.