Is Muah.ai Safe? (2026 Review)

The short answer

Muah.ai had a serious, public, well-documented data breach in the autumn of 2024. Have I Been Pwned dates it to 17 September 2024 and added it on 8 October 2024. Roughly 1.9 million email addresses plus associated chat prompts were exfiltrated, and the prompt data included explicit requests for CSAM, which drew wide press coverage. The hacker’s description of the site as “basically a handful of open-source projects duct-taped together” made the rounds. If you care about data security even a little, this is the largest case on the popular list where the concern has already come true (MyLovely’s April 2026 breach is another). That’s why the verdict here is caveated and stops short of “mostly safe.” Use it only with a throwaway email and never your main one.

What data does Muah.ai collect?

Muah asks for an email at signup and no phone number. It stores chat logs, prompt text, image generation prompts, generated images, character setups, and payment metadata via its processor. The 2024 breach leaked the email-to-prompt mapping, so attackers could see which email address had requested which content. For an AI companion app, that’s the exact data shape that turns a breach into a catastrophe.

There’s no ID verification.

Who owns the company?

Muah.ai’s corporate structure is less transparent than competitors like Candy or DreamGF. There’s no current, verified filing to point you at. Muah’s own privacy policy and terms of service don’t name a company or an address either: the terms only say “MUAH.AI is a software development company”, and both documents are still dated 17 May 2022, more than two years before the breach.

Compared to EverAI (Candy) or the operator behind DreamGF, Muah.ai is noticeably less institutional. That alone isn’t damning, but combined with the breach it’s a pattern.

Has Muah.ai had a breach or incident?

Yes. In September 2024 a hacker took Muah.ai’s database and shared it with 404 Media, and Have I Been Pwned added the data on 8 October 2024. The dump contained approximately 1.9 million email addresses along with chat prompts, character setups, and associated metadata. Because Muah.ai is an uncensored AI companion, the prompt data included explicit content, and a non-trivial subset involved requests for child sexual abuse material. That detail drove significant press coverage.

The hacker told 404 Media the site was “basically a handful of open-source projects duct-taped together” and that they found vulnerabilities “relatively quickly”. The breach exposed users to extortion risk. Anyone holding the data could contact people at the email addresses they’d signed up with and quote their specific prompts back to them.

For more detail, see /guides/muah-ai-data-breach/.

Since the 2024 incident, Muah.ai has made public statements about improving security. Nobody has independently verified whether the improvements are substantive.

Payment safety

Muah.ai bills through third-party payment processors, which handle the card data, so your card number never touches Muah.ai’s own servers. Other apps use the same industry-standard setup, and it wasn’t what failed in 2024.

Billing is discreet, though Muah doesn’t publish the exact descriptor. Still, pay with a virtual card. Given the breach history, you want every layer of separation you can get between Muah.ai and your everyday finances.

Content on your device vs on their servers

Everything is server-side, and the 2024 breach proved it when the leaked data went beyond account metadata to include chat content. You can submit deletion requests, but nobody has independently verified how thoroughly content is purged from backups. If you’re an EU user, GDPR applies and you can demand a full deletion.

Generated images are stored server-side too, and the 2024 breach showed what that means in practice.

Can anyone see what you’ve done?

By default, no. Accounts are password-protected and Muah has no public profile system. But the 2024 breach already answered the “what if there’s a leak” question in the worst possible way. For 1.9 million users, their email address is now publicly associated with specific prompts. If you signed up before October 2024 using your real email, that information is already out there.

For new signups since the breach, the risk is lower than it was, though still above zero, and Muah has the worst track record of any companion app we cover.

How to minimize your exposure

• Use a throwaway email alias and keep your main address well away. On Muah this is non-negotiable
• Pay with a virtual card (Revolut, Privacy.com) instead of a card tied to your main bank account
• Never upload photos of yourself or anyone you know
• Assume every prompt could end up public, and write accordingly
• Use a strong unique password that you don’t reuse anywhere else
• If you signed up pre-October-2024 with your real email, check HaveIBeenPwned and rotate any reused passwords immediately

Is Muah.ai safer than Candy.ai?

No. Candy.ai has no public breach history, a named EU-based corporate operator, and GDPR coverage. Muah.ai had a 1.9 million-user breach, a security setup the hacker described as weak, and a less transparent corporate structure. On the pure safety question, this isn’t close. Candy, DreamGF, and most competitors have a materially better track record. The only reason to pick Muah.ai over a competitor in 2026 is product features, and you pay for those features in risk.

Our verdict

Muah.ai is caveated. This is the largest case in the popular companion space where the worst-case scenario has already materialized (MyLovely’s April 2026 breach is another). The 2024 breach wasn’t hypothetical. It happened, it was large, and the data was exactly the kind (emails + explicit prompts) that ruins lives when it leaks. If you use Muah.ai, assume anything you type could appear next to your email in a future dump.

For anyone uneasy with that (and most people should be), we point privacy-conscious users to Candy.ai, a comparable product with no breach history and legal protections via GDPR, though its policy says your chats train its AI with no opt-out. For Muah specifically, if you’re going to use it anyway, a throwaway email and virtual card are the minimum viable hygiene.