Is Muah.ai legit?

What is Muah.ai?

Muah.ai is an uncensored AI companion app that has been running since at least May 2022, the date on its terms. It is best known for real-time voice calls (on its top ULTRA VIP tier, $99.99/mo) and an uncensored content policy, with no content filter on paid tiers. Most mainstream AI companion apps advertise "no filter" and then apply one anyway, but Muah is one of a handful that actually follows through. See our full Muah.ai review for the product-level breakdown.

The legitimacy question around Muah is not "does it deliver the product." It does. The question is about the company's security and operational maturity, which the September 2024 breach answered in a way that is hard to walk back.

Who owns it?

This is the part of Muah's profile that is weaker than its peers. The operating company is not widely published. Muah.ai's website and help docs do not feature a prominent legal entity name, jurisdiction, or corporate address of the kind EverAI (Candy.ai) or Kibergrad-family operators display. For an adult-tech company running since 2022 and processing card payments at scale, we would expect more corporate transparency than Muah provides.

We couldn't verify the legal entity, jurisdiction, or founding team from public sources. That is itself a data point. Not disqualifying, because plenty of legitimate small-to-mid adult-tech operators run quietly, but it stands out against Candy.ai (EverAI Limited, Malta/Cyprus) and Janitor.AI (JanitorAI Inc.), which both name the company behind them.

Track record

Muah has been running since at least May 2022 and established itself in the uncensored / voice-first niche quickly. Voice was its calling card from early on, and product momentum was real.

Then in September 2024 (disclosed October 8), Muah was hacked. Approximately 1.9 million email addresses were exfiltrated alongside user chat prompts and AI image generation prompts. The data hit Have I Been Pwned on October 8, 2024 (haveibeenpwned.com/Breach/Muah). The hacker told security reporters the backend was "a handful of open-source projects duct-taped together" and that initial access was trivial.

404 Media's reporting identified that a non-trivial portion of leaked prompts described child sexual abuse scenarios. Because emails were plaintext and tied to the prompts, users who had attempted those requests became immediately identifiable. Linklaters noted active extortion attempts using the data. We have a full breach explainer if you want the detailed timeline.

User reviews and sentiment

Trustpilot's sample size is small (under a dozen reviews), making the numerical rating unreliable. Reported figures range from 3.2 to 3.9. What matters more is the Reddit sentiment, which is mixed to hostile. Muah was reportedly banned from r/ChatGPT for running a bot farm to promote positive feedback, and that is a trust signal in itself. Organic enthusiasm isn't the community's default mode.

Users who stick with Muah tend to cite two things: the uncensored chat (nothing else in the category goes as far without a jailbreak) and the voice quality on ULTRA VIP. Users who leave cite the breach, the occasional technical glitches, limited free-tier functionality, and the general scrappy feel of the UI compared to Candy or Nectar.

Google pulled the mobile app from the Play Store at some point. We have seen this reported but couldn't pin down the exact date or reason. Current delivery is primarily web-based.

Red flags and concerns

• The 2024 breach. This is the big one. 1.9M records, emails in plaintext, prompts attached. Anything you typed before the September 2024 breach, assume someone else may have read.
• Opaque corporate identity. No named legal entity, no clear jurisdiction.
• "Duct-taped" infrastructure per the hacker. Post-breach hardening may have happened, but we have no independent verification it did.
• Reddit bot-farm accusations. Astroturfing positive reviews is a trust-destroying move when it's caught.
• Google Play removal. A mainstream app-store distribution problem.

Billing and payment safety

We couldn't independently verify Muah's billing descriptor from public sources. Payment processing is handled by a third party, which is why payment card data was not part of the 2024 breach. The leaked data was user-account content with no financial details in it. That limits the downside in one important way. If your card was on file with Muah when the breach happened, your card number was not exposed.

If you plan to subscribe, use a virtual card (Privacy.com, Revolut disposable, or your bank's one-time-use card feature) instead of your primary card. This caps the blast radius if there's ever a future incident.

Privacy posture

Weak. The breach made clear that, at the time, prompts were stored in a form that could be extracted with emails attached. There is no public-facing detailed post-mortem of the kind you would see from a serious SaaS company after a breach of this magnitude. There is no evidence Muah has implemented end-to-end encryption, moved prompts to at-rest encryption with meaningful key separation, or otherwise structurally changed how chat data is stored.

If privacy is your top concern, Muah is the wrong pick. Candy.ai and Nectar.AI have no public breaches and score higher on privacy (6 and 8, against Muah's 5). OurDream AI has no public breach either, but its privacy policy says your data trains its AI, and we score its privacy 5, level with Muah.

The verdict in detail

Muah.ai is legitimate in the sense that matters for an "is this a scam" question. The product exists, the company ships, customers get what they pay for, and payment processing works. It is not legitimate in the sense of "this is a company you can trust with sensitive data". The 2024 breach proved that.

If you want the specific things Muah does best (real-time voice calls, zero-filter chat), use Muah, but go in assuming future breaches are plausible, sign up with a throwaway email, never upload photos of yourself, and treat every chat as data that could become public. If privacy is on your priority list at all, use Candy.ai or Nectar instead. Those products aren't as uncensored, but they also aren't in Have I Been Pwned.

FAQ

Was my email leaked?

Check haveibeenpwned.com and look for "Muah.ai" in your result. If it's there, change the password immediately, change any password you reused elsewhere, and assume your chat prompts are in the dump too.

Has Muah.ai been hacked again since 2024?

Not that we are aware of. No follow-up breach is listed on HIBP as of 7 November 2026.

Is the company going to disappear?

Muah is still operating and still processing payments, which suggests the card networks have not cut them off. Still, uncensored-content operators are always one policy change away from a payment-processor problem. Don't buy a lifetime plan from any company in this space expecting it to still exist in five years.

Is it safe to pay with my real card?

Your card data isn't in the 2024 breach. The processor holds it, not Muah. But a virtual card is still the right move for any adult-tech subscription.

What's a safer alternative for uncensored chat?

Nectar.AI (voice and video calls, no public incidents, a slightly tighter filter) or Candy.ai (no public breach, broader polish but a tighter filter). OurDream has no public breach either, but we score its privacy 5, the same as Muah, because its privacy policy says your data trains its AI. See our uncensored alternatives guide for the full list.

Does Muah have a refund policy?

Muah's terms say subscriptions are not refundable. For a billing error, such as a duplicate charge, a chargeback via your bank is the realistic fallback if you can't get a response.