Reading Muun's post on "security": their wallet holds one key on your device and the other key on their servers.

So at all times they have access to both of your keys that are used to sign transactions:

https://blog.muun.com/muuns-multisig-model/

--- start quote ---

Muun ensures your decrypted private keys are never stored in the same place:

- Your phone stores only the first key

- Muun's servers store only the second key

--- end quote ---

Oh, there's also the Emergency Kit that--I pinky swear--is encrypted in a way that Muun knows nothing about both keys in it.

Moreover, if you go ahead and install Muun, there's literally nothing about secret keys in the app: you can immediately send and receive bitcoin. Which really tells you all you need to know about its security.