FaceApp differs from other photo-editing applications because it uses artificial intelligence to alter the photo, instead of slapping a filter on top of it.
The app is owned by Wireless Lab, a company based in St. Petersburg, Russia, and has legal jurisdiction in Santa Clara County, California, according to its privacy terms.
But before downloading the app, keep in mind that under its privacy terms it can collect:
• Any photos or other content that is uploaded and posted.
• Information on the websites you visit and how you use the app, which the terms say doesn't identify individual users.
• Cookies and data that identifies your device to share with third-party advertisers to deliver targeted advertising to your device.
• Your Web request, IP address, browser type, referring/exit pages and URLs, number of clicks and how you interact with links on the app, domain names, landing pages, pages you view, what emails you open every time you access the FaceApp application or website.
• Metadata.
Founder and CEO Yaroslav Goncharov told TechCrunch that FaceApp uses Amazon Web Services and Google Cloud to store uploaded photos. The company said in a statement that this is used to evaluate performance and traffic, and that most images are deleted from the servers within 48 hours, TechCrunh reported yesterday.
But even if you delete content from the app, FaceApp can still store and use it, according to its privacy terms. FaceApp also says it can't guarantee your data or information is secure. The company can share your information with its other affiliated companies and third-party advertisers, which aren't disclosed in the privacy terms.
The company said in its statement that users who want to remove their data from FaceApp can make the request through the app: Click "Settings," then "Support," then "Report a bug" with "privacy" in the subject line.
"Our support team is currently overloaded, but these requests have our priority," the company statement read.
The company also said it doesn't sell or share any user data with any third parties, which contradicts its privacy terms on the FaceApp website.
FaceApp's privacy terms say it can share information with a government agency if a subpoena, court order or search warrant is issued and that the company has "a good faith belief that the law requires" it to do so.
And this information can also be shared to any country that FaceApp maintains facilities in, including Russia.
"The user data is not transferred to Russia," the company said, even though that's where the company is based.
However, it noted in its privacy terms, "By accessing or using our Services, you consent to the processing, transfer and storage of information about you in and to the United States and other countries, where you may not have the same rights and protections as you do under local law."
Baptiste Robert, a French security researcher who uses the pseudonym Elliot Alderson, said he looked into the traffic between FaceApp on his phone and the Internet to understand how the network operates for users.
He found that only photos that are uploaded and modified are saved to the server, not the user's entire camera roll. But he also said he didn't think the app was compliant with the European Union's new privacy rule, the General Data Protection Regulation (GDPR).
"When you upload your photo, you have no idea how your photo is used," Robert said, noting that the app's terms and conditions are vague. "Don't rush to use this application, because you don't know how your data is used after that."
