Can You Just Upload A Photo For Faceapp

FaceApp responds to privacy concerns

FaceApp, the AI-powered selfie-editing app that'southward been having another viral moment of late, has now responded to a privacy controversy that nosotros covered earlier hither.

We've pasted the visitor's full statement at the bottom of this post.

The tl;dr here is that concerns had been raised that FaceApp, a Russian startup, uploads users' photos to the deject — without making it clear to them that processing is non going on locally on their device.

Another effect raised by FaceApp users was that the iOS app appears to be overriding settings if a user had denied access to their camera ringlet, later people reported they could yet select and upload a photo — i.e. despite the app non having permission to access their photos.

As we reported earlier, the latter is really allowed behavior in iOS — which gives users the power to choose to block an app from full camera roll access but select individual photos to upload if they so wish.

This isn't a conspiracy, though Apple could probably come upward with a ameliorate fashion of describing the permission, as nosotros suggested before.

On the wider matter of cloud processing of what is, after all, facial data, FaceApp confirms that well-nigh of the processing needed to power its app's beautifying/gender-bending/age-accerating/-defying effects are washed in the deject.

Though it claims it merely uploads photos users have specifically selected for editing. Security tests accept besides not establish evidence the app uploads a user'due south entire camera gyre.

FaceApp goes on to specify that it "might" store the photos users have called to upload in the deject for a short period, claiming this is washed for "performance and traffic" — such equally to make sure that a user doesn't repeatedly upload the aforementioned photograph to carry out another edit.

"Most images are deleted from our servers within 48 hours from the upload appointment," it adds.

It likewise claims no user data is "transferred to Russia", even though its R&D team is based there. So the suggestion is that storage and cloud processing are existence performed using infrastructure based outside Russia. (We've asked it to confirm where this is done. Update: Founder Yaroslav Goncharov told the states it uses AWS and Google Cloud.)

"We don't sell or share whatever user data with any third parties," it adds.

FaceApp besides says users tin request their data is deleted. Though it doesn't withal have a very polish fashion to practise this — instead it asks users to transport delete requests via the mobile app using "Settings->Support->Report a issues" with the word "privacy" in the bailiwick line, adding that it'south "working on a better UI for that".

Information technology besides points out that the vast majority of FaceApp users don't log in — making the point that it's non able to link photos to identities in most cases.

Hither's its statement in full:

We are receiving a lot of inquiries regarding our privacy policy and therefore, would similar to provide a few points that explain the basics:

i. FaceApp performs nearly of the photo processing in the deject. We just upload a photo selected by a user for editing. Nosotros never transfer any other images from the phone to the cloud.

2. Nosotros might store an uploaded photograph in the deject. The principal reason for that is performance and traffic: nosotros desire to make sure that the user doesn't upload the photo repeatedly for every edit functioning. Most images are deleted from our servers within 48 hours from the upload appointment.

three. We accept requests from users for removing all their information from our servers. Our back up team is currently overloaded, only these requests accept our priority. For the fastest processing, we recommend sending the requests from the FaceApp mobile app using "Settings->Support->Report a bug" with the word "privacy" in the discipline line. We are working on the better UI for that.

4. All FaceApp features are available without logging in, and you tin can log in just from the settings screen. Every bit a event, 99% of users don't log in; therefore, we don't take access to any data that could place a person.

5. Nosotros don't sell or share any user data with any third parties.

6. Even though the core R&D squad is located in Russia, the user data is non transferred to Russia.

Additionally, we'd like to comment on one of the about mutual concerns: all pictures from the gallery are uploaded to our servers afterwards a user grants access to the photos (for example, https://twitter.com/joshuanozzi/condition/1150961777548701696). We don't do that. We upload only a photo selected for editing. You can quickly check this with any of network sniffing tools available on the internet.