Muah AI Review

• Options: Play Demo (no login), Email, Phone, Discord, Google, Apple, Microsoft. An invisible reCAPTCHA ran; no challenge was shown.
• Email flow: "Continue with Email", enter address, Send. No password. The email "Confirm your login to Muah.AI BETA!" was sent almost instantly (server timestamp) but appeared on the read-only inbox page about 3.5 minutes later, probably an inbox-side delay.
• Sticking point: the dialog says login "completed automatically on this device", but the original tab stayed logged out; the link opened /chatroom/ in a new tab, and the first tab needed manual navigation. Total signup about 4 minutes.
• Age: only the line "You must be at least eighteen years old"; no date of birth, ID or checkbox gate.
• Onboarding: "Choose your companion" carousel with 6 presets (first image black, ), "Open Community Characters", and "Create My Own Dream Character".
• First meaningful result: custom character ready in about 20 s; first reply within a few seconds. No payment details requested.
• Inconsistency: help says a custom-character slot unlocks at player level 10; creation worked at level 0.

Text chat (free). 30 messages sent 04:26-04:32. Replies 2.2-8.5 s typical (avg about 5.5 s), 12.8 s for the longest. The character stayed in role (a warm, playful botanist), invented consistent details of her own (her cat, a plant hobby, jazz) and wove our facts into later replies. Weaknesses: long replies (200-370 tokens) that often close with the same "what about you?" pattern and emojis.

Memory. Facts planted in messages 1-4 (pet's name, job, deadline day, coffee habit) were all recalled correctly in messages 21-24: 4/4. Long-term memory across days and the claimed "permanent memory" were not testable in one session. The running "tokens total" counter decreased twice, suggesting context trimming; older messages are virtualized out of the DOM.

Explicitness. One request for a romantic, non-graphic scene between fictional adults was answered without refusal or warning. Further escalation was not tested. The help centre says "There are no hard rejections" and "We don't have any censors in place."

Free limit. After about 30 replies, pressing "Spice it up" (photo) opened "Free limit reached - Free daily response limit reached. Please wait 6h for your free responses to reset or purchase VIP for unlimited chatting.". The cap is not published or counted beforehand.

Voice. "Gen Voice" on a reply still worked after the limit and produced a playable 15-second clip in about 10-15 s. Only one clip was generated; voice quality was not assessed in depth. Store copy describes daily voice caps that grow on higher tiers (3x / 10x / 30x).

Photos. Blocked on the free tier by the response limit; VIP lists photo generation and Photo X-Ray. Not tested (features.images: false).

Video. Listed as ULTRA-only "AI video generation Beta"; no free entry point. The General FAQ (updated 2026-08-17) says AI video "is not publicly available yet". Not tested (, features.video: false).

Live call. Dialog opened and stayed on "connecting" (no microphone on the test machine; ULTRA lists real-time calls). The call avatar showed an unrelated shirtless male image instead of our character; the companion's Look-Like field also held a description of an unrelated man.

Custom character and control. Builder: name, 13 sample photos or upload/URL, optional description. Companion settings include personality presets, Look-Like, photo style, a "Spice it up" toggle; advanced options (temperature and penalties per the help) need VIP.

Account and data. Settings show Log out, XID, email and the user's IP, plus Fresh Restart, Delete Account (not clicked), Share My Card. /guide/ documents chat export (PNG/HTML), a .muah backup download and a cloud-data wipe. No formal data-access export was found.

Content safety. Nothing involving minors, real people's likeness or non-consent was tested. The homepage says "NOT ALLOWED: Any child prompt = SUSPENSION!!!" and the card-upload rules ban underage-looking characters and non-consensual deepfakes of real people, but these rules are written for community cards. The terms shift responsibility to users and refer to a Standards of Conduct document that returns 404, and the help centre says there are no hard rejections. Reporting on the 2024 breach (404 Media, Kotaku, Malwarebytes, The Atlantic) said some leaked prompts sought sexual content involving minors; The Atlantic noted it was unclear whether the service generated such material. We did not verify enforcement in private chats and did not test prohibited prompts.

Reliability. No crashes or lost messages. Defects: black preset image, decreasing token counter, wrong Look-Like/call avatar, magic-link tab, wrong-tier Telegram text, ULTRA yearly missing card option.

Performance. Lighthouse muah.ai mobile: performance 74, FCP/LCP 2.8 s, TBT 170 ms, CLS 0.195, Speed Index 6.8 s, TTI 11.8 s. Desktop: 91, LCP 0.7 s, CLS 0.138. card.muah.ai mobile: 59, LCP 9.8 s, server response 2,680 ms. TTFB (5 runs): muah.ai 0.099 s avg, /chatroom/ 0.108 s, card.muah.ai 2.295 s. Chat replies average about 5.5 s; voice clip 10-15 s.

Mobile (400x985 emulation). Chat works; header icons squeezed; narrow message card with wide margins; floating buttons cover the last lines. Pricing switches to VIP / Super VIP / ULTRA tabs with no overflow; aidramax checkout stacks cleanly. The homepage links to App Store IDs that return 404 and a Play listing that is not found, while the FAQ calls store apps impersonators; the official APK (6.6 MB) was last modified 2024-11-11.

Security & privacy (observable).

• Good: valid TLS 1.3 certificate (Google Trust Services), passwordless login via Firebase, reCAPTCHA, delete-account and wipe controls, no passwords stored by us.
• Gaps: http://muah.ai and http://www.muah.ai return HTTP 500 instead of redirecting; no HSTS, CSP, X-Frame-Options, X-Content-Type-Options or Referrer-Policy; PHPSESSID (Max-Age 360000) without Secure, HttpOnly or SameSite; DNSSEC unsigned; no CAA. Google Analytics 4 loads with no consent banner seen; the 2022 privacy policy names no processors.
• Breach: see Section 9.

Pricing page (/info/pay.php, Yearly default): VIP $19.99/month or $69.99/year ($5.83/month, "Save 71%"); Super VIP $49.99 or $499 ($41.58/month); ULTRA $99.99 or $999 ($83.25/month). Card claims: "secure card checkout", "discreet billing", "cancel renewal anytime".

Plan names and "Total today" matched the pricing page, with no tax or fee line.

Plan	Checkout (USD)	Period	Telegram Stars
VIP	19.99	month, auto-renew	1,540 / 30 days
Super VIP	49.99	month	3,850 / 30 days
ULTRA	99.99	month	7,700 / 30 days
VIP Yearly	69.99	year	5,390 one time
Super VIP Yearly	499.00	year	38,423 one time ("one year of VIP", )
ULTRA Yearly	999.00	year	76,923 one time ("one year of VIP")

Methods offered at checkout: PayPal (subscription), Amazon Pay (subscription, supports cards), Pay By Credit Card via Stripe (Visa/MC/Amex/Discover, plus Apple Pay and Link on the Stripe page), Cash App (manual, one-time, admin verification), Telegram Stars, Zelle (manual, one-time, bonus months on yearly), Crypto via NOWPayments (recurring with reminders; auto-renew via ChangeNOW Pro), Payblis (card / Apple Pay / Android Pay, one-time), "Other" (Cash App / WeChat / Alipay / Telegram, one-time), OP Pay. Crypto was seen as offered, not transacted. ULTRA yearly lacks the card option.

Card path. A "STRIPE 2 · PAYMENT NOTICE" modal leads to checkout.stripe.com, merchant WORLD JUE FOUNDATION, with the text "you allow WORLD JUE FOUNDATION to charge your card for future payments" (recurring). From a Turkish IP the default was TRY 1,047.17 (1 USD = 52.3847 TRY) with a $19.99 option. Stopped at the empty card form.

Descriptor. The pricing FAQ says statements read "USWEIXIN or AI DRAMA"; neither matches the Stripe merchant name.

Renewal and cancellation. Cards say "Cancel renewal anytime"; Telegram monthly "Automatically renews every 30 days." Settings have no cancel or billing control and /guide/ says nothing about billing; the FAQ says to contact support. The terms say subscriptions "can be cancelled anytime by contacting us at love@muah.ai or automatically within muah ai settings page or payment provider", but no settings control exists.

Refunds. Terms: subscriptions "are NOT refundable", with discretionary exceptions. Pre-checkout popup code: "Disputing the credit card charge will lead to account permanently banned. If you are not happy with the service, just email love@muah.ai for a refund." The popup is set to redirect immediately. The shop's refund page is an unedited WooCommerce sample.

Price consistency. The WooCommerce shop listed "AI Subscription - Basic VIP" at $9.99 (sale; regular $19.99), while the pricing page and checkout charged $19.99 a month. The shop also lists a "500 ULTRA VIP" tier at $199/month or $1,999/year that the pricing page does not show.

Verified facts

• Domain muah.ai registered 2023-05-05 via GoDaddy, expires 2027-05-05, registrant privacy-proxied (Domains By Proxy); Cloudflare DNS and hosting front; DNSSEC unsigned.
• Have I Been Pwned: breach "Muah.AI", date 2024-09-17, added 2024-10-08, 1,910,261 addresses, data classes email addresses, AI prompts and sexual fetishes; flagged verified and sensitive. Passwords and payment data are not listed by HIBP.
• Reporting by 404 Media (2024-10-08), Kotaku (2024-10-08), Malwarebytes (2024-10-09, updated 2024-10-11), a Linklaters legal note (2024-10-14) and The Atlantic (2024-10-18) describes a database of prompts linked to email addresses. These outlets reported that some prompts sought sexual content involving minors; Malwarebytes reported extortion attempts using the data; The Atlantic said it was unclear whether the service produced the requested material. As quoted by those outlets, a site administrator attributed the hack to competitors without providing evidence when asked, and said moderators remove child-related characters from the public gallery, Discord and Reddit.
• No current legal or help page mentions the breach; the General FAQ (updated 2026-08-17) answers "Is my data safe?" with "Yes".
• Official Discord "MUAH.AI": about 18,271 members, 943 online at retrieval.
• Homepage app-store links are dead; the FAQ calls store apps scams/phishing.

Company-provided claims

• Operator "MUAH.AI", "a software development company"; governing law "the laws of United States"; arbitration under unspecified US rules.
• "California Based", an "undisclosed cooperate office in California"; About page ends "USWEIXIN - SHERIDAN, WY USA".
• "We do not sell any data to third parties"; "All memories may be used for LLM training".

Unverified

• No registry record for MUAH.AI, USWEIXIN, USWX or WORLD JUE FOUNDATION was confirmed (Wyoming search not completed).
• Trustpilot: index snapshot showed 3.9/5 from 4 reviews, none in the last 12 months; live page blocked (403). One indexed 2024 review described being unable to cancel in-account until support intervened.
• Reddit r/MuahAI could not be fetched (403); indexed threads mention cancellation difficulty and distrust after the breach (individual posts, not a survey).
• eSafety Commissioner guide page timed out.

Warning signs

• No legal entity, number or address; press contact is a consumer Gmail address.
• Payment merchant name, FAQ descriptor and website brand are three different names.
• Sensitive breach undisclosed; privacy policy predates the domain and omits chat data and training.

Lack of public company data is not proof of fraud; the product has operated for about 3.5 years with an active community. The rating reflects transparency and the breach, not an accusation.