A practical guide to vetting AI apps before you install them, prompted by names like “91chigua” that turn up in chats and ads with no clear source.
We get lots of AI applications now, some real, many fakes with dubious intent. Lately, we have seen an application called “91chigua” which claims to be an artificial intelligence (AI) app.
I looked for this app and there was nothing. No Developer? No Official Store Listing? No Reviews? No Press Coverage?
That’s a great excuse to explain you How to Analyze Any New App!
What I found when I looked it up
A search on “91chigua” returned all sorts of things other than my beloved AI app… Chai, GigaChat, generic Chatbot list… You get the idea. Not one result pointed to a Developer Page/Store Listing/Review/New Article related to this app. And yet — here I am writing about how potentially dangerous an app can be by having no evidence to back up its existence.
91chigua – maybe this app is very new? Regional? Maybe they changed their brand-name? Or maybe they are distributing exclusively via private channel? Whatever the case, when there’s no independent evidence, please always take caution.
This guide serves as a framework for reusing against ANY app you might want to analyze!
Start with the name
The term “chigua” is derived from the Chinese slang “吃瓜,” literally translated as “eating watermelon,” referring to people who watch gossip/drama while being a bystander themselves. The addition of the numeric prefix further suggests these cloned apps were designed to mimic the naming conventions of many gossip/leaked content sites and not those of actual AI-powered products.
Of course, clones can copy anyone’s name, including these ones. But if it does happen to be named after a well-known term — just make sure not to fall for the clone trap we mentioned earlier when talking about numeric prefixes in Chinese language sites/apps — it might give you some pause before proceeding.
And here again, names don’t mean much in terms of giving away real insights into what an app is doing unless you’re really curious about where it fits within its industry landscape. After all plenty of legitimate startups go under weird sounding names too! So don’t get distracted by quirky nomenclature — think more deeply into how each element relates together.
Check where it comes from
The source of your download carries much more weight than the description that comes with the application.
- Official Stores – If an app is available on Google Play or the Apple App Store, check the developer details and the presence of a privacy policy. Chat groups, social media ads, or websites are often riddled with fake links but official stores tend to offer apps which undergo some form of review process.
- Direct APK Downloads – Bypassing the app store altogether means you’ll be sideloading apps without any sort of screening process going through them. This tends to make this category highly risky.
- A real website – There’s more to the product than just clicking “Download”. Legitimate companies will have pages explaining what they do (an about page), ways to reach out if you need help (support contact), how their site works for you (terms of service) and who actually runs this thing (a company).
An official store means little — even Apple can get hacked.
- Developer History – So when shopping around on an official site, check the developer’s history. Does that guy only have one app up, and was it just released? What’s his name? Generic names are common but don’t exactly scream legitimacy. You want someone with lots of apps over time.
- Middle-Rated Reviews – If you see a lot of near-identical short 5-star reviews all showing up over a short period (say, a few days), this is likely an indication that they are paid/fake reviews.
- Update History & Download Count – If there’s been no updates for many years then why even install? Or if it has only recently come out with huge download numbers claimed, you have to wonder about its validity.
- Privacy Disclosures – While both stores now require that developers make their privacy declarations known on which data they do collect, a general vagueness around the collection process is still always a red flag!
And be careful about how you came across this app. Links within ads, QR codes, shortened URLs or even messages from strangers or in group chats are the most popular ways people get infected.
If at all possible, avoid clicking through links and instead try searching for the app using its name in your app store.
Look at what it asks for
So what does an AI chat or image tool need from your phone? Here are some things to look out for:
Contacts / SMS Messages – don’t let these apps request this unless they really need it (e.g., for messaging features) Full Storage Access – many apps require this but could abuse it. Accessibility Services – only install these tools if you trust their security practices.
Payment Methods – always stick with payments through official stores. If you see any other ways to pay (like entering your card details on a strange-looking page) then steer clear. Avoid any request for gift cards or crypto.
Here is how to read common permission requests for an AI chat or image app:
| Permission | Reasonable for an AI app? | Why it matters |
| Internet access | Yes | Needed to reach the AI model |
| Photos you choose to upload | Sometimes | Fine if you pick specific images; avoid blanket library access |
| Microphone | Only for voice features | Should be requested at the moment you use voice |
| Contacts | No | Rarely needed; often used to spread the app or harvest data |
| SMS or call logs | No | Can be used to intercept verification codes |
| Accessibility services | No | Gives broad control over your screen and inputs |
| Install other apps | No | A common route for adding more unwanted software |
You can also easily check what android applications have requested in terms of permissions on your phone as well as revoke these if need be.
Same with iOS apps, so when you realize an application isn’t working anymore because of a missing permission this will tell you quite a lot about its actual purposes.
Look at what it promises
Apps with terms like ‘unfiltered’, ‘face swapping’ real people, or allowing users to remove their clothes from photos are all red flags pointing to apps that include non-consensual imagery — both of which can cause actual harm to individuals who use these tools and are illegal in many places. In addition to this risk, there is always a chance of being scammed by bad actors, having subscriptions tricked out of you, or worse yet, finding that some other nefarious actor has stolen your data.
If the primary selling point of an app is something that you wouldn’t want others doing to your own photos, then why would you do it to others?
It doesn’t take much imagination to realize how dangerous these types of tools can become when they’re being used to fabricate or reveal intimate aspects of someone’s private life, but we live in an age where many countries and platforms classify making or sharing such content as a crime or policy violation. If you need to upload someone else’s picture to use one of these apps, it stands to reason that they didn’t give consent. If you don’t get a “yes”, that means you should also say no.
But even beyond that, think about what kind of security risks these apps pose. An app focused on hosting potentially illicit content probably doesn’t put up huge efforts into keeping those user uploaded contents secure (including things like their photos or chat history) or protecting user’s personal data about their devices. You might be giving away far more than just your identity.
Search before you install
While your time may be limited, do spend two minutes to run this check before installing anything. Type the application’s name alongside terms like ‘review’, ‘scam’ and ‘safe’. You’ll likely find out if anyone from an independent tech site, forum or security researcher has mentioned the app. While lack of chatter isn’t confirmation that it’s dangerous, neither is silence indication of its safety.
Now we get into more detailed (and free) checks. They are good to try, even if you’re short on time:
- Search using the exact name – use a safety term. Try typing in the application name and then adding ‘scam’, ‘malware’, ‘review’, or ‘is it safe’. Are there reviews by independent writers, rather than just lists of links that seem ripped off from each other?
- Scan the link / file. Paste a download link or .APK file into scanners such as VirusTotal. This runs it through lots of different security engines – while getting nothing back doesn’t necessarily prove the software is innocent, it sure makes me feel better about clicking install.
- Find out how old the domain is. Run a whois lookup on the domain name to see when they were registered. If a website says it has millions of users, but only got registered a few weeks ago? That’s fishy.
- See what company they are. Can you find their business name and physical address? Is there a working email address where you can contact customer support? Try testing the email addresses you find in case they’re also fake.
- Ask someone in your trust circle. Most people I talk to use one or more subreddits or forums dedicated specifically to discussing Android/iOS/Android-based mobile phone apps and cybersecurity issues. Many of them know a known scam almost instantly upon being told its name.
If you already installed it
- Do not give out any further details – particularly passwords or financial info.
- Check the app’s permissions, and remove things that aren’t necessary.
- Uninstall it and run a reputable malware scanner.
- If you’ve paid money or given over sensitive data, get in touch with your bank and make sure passwords have been changed where relevant.
In case you want to go above-and-beyond – just because you’re paranoid doesn’t mean they’re not after you – check all your other online accounts for sign-ins that you don’t recognise, and enable 2-factor authentication wherever possible.
On Android specifically, fire up Google Play Protect, which will tell you whether any apps that you don’t remember installing have elevated privileges (like device-admin or accessibility).
Watch your bank and card statements closely for some time – maybe even several weeks – for small, repetitive charges. And if you used this as a password somewhere else, change them.
But what about my photos? Don’t use an app that involves sharing pictures from another person unless you know who owns those pics and trust them to treat them responsibly. It’s also important to note here that if the images uploaded were yours, saving copies could help prevent misuse of the material. And once again, keep an eye on the situation by letting others who might be impacted know they should not share the results either.
In cases where images containing people weren’t supposed to be posted online but ended up being done anyway, the best thing you can do now would be save any pieces of evidence showing unauthorized usage and pass along complaints to both platforms hosting said content and local law enforcement agencies / cybercrime reporting services.
Better options exist
You don’t have to take chances with your data if all you really want is an AI chatbot tool that can handle writing, translation, image creation and more. There are many established tools available from known companies with solid privacy policies and accountable teams behind them.
Don’t fall for some shiny new “AI” app just because its creators promise everything from chatting about cats to building cars. You probably already have access to all those functions via existing services — but here’s how you can be sure what exactly you’re getting when you sign up.
At-a-glance checklist
| Check | Green flag | Red flag |
| Source | Official app store listing | Chat link, ad, or direct APK |
| Developer | Named company, other apps, support contact | Anonymous, new, or no website |
| Permissions | Only what the feature needs | Contacts, SMS, accessibility, install-apps |
| Payments | Handled through the store | Card details on an unfamiliar page, crypto, gift cards |
| Marketing | Clear, specific description of features | “Unfiltered,” face-swap of real people, clothing removal |
| Reviews | Varied, detailed, spread over time | Short, identical, posted in bursts |
| Independent coverage | Tech sites, security researchers, forums | Nothing but the app’s own pages |
Frequently asked questions
Is 91chigua a scam? Honestly, we couldn’t find any reliable info on this one either, so we can’t really confirm if it’s legit or not. But what we can do is check all those signals to make sure.
Will a clean malware scan ensure that an application is okay? Not quite! Malware scans only help identify well-known viruses, but there might still be other ways for your phone to get infected without even knowing about it. There are also several types of dangerous applications (like applications that collect way too much data) which aren’t classified as malware per se, and there’s always a chance they won’t be picked up just yet!
So is every single free AI application inherently risky compared with their premium counterparts? That depends entirely on what sort of monetization strategy they’ve come up with. While many choose to run ads and collect lots of user data over time – both things you’d typically avoid doing unless forced by circumstance – at least nobody has ever been caught trying to sell subscriptions behind users’ backs!
What should parents and teens watch for? Apps that are promoted in short videos or group chats. Apps that promote “unfiltered” content. Apps that request broad permissions. Openly talk to your teen about these things. Make sure they understand that they can report abuse without you punishing them for this.
The bottom line
Unfortunately, I can’t tell you what 91chigua is, because it turns out you should never be able to find out who made an app — and if you couldn’t figure out how it got your information, then why would you give them your phone or your information?
When in doubt, don’t use it. If you have some specific info on the app, including who makes it or what it says it does, post it here in the comments below.
