It's the killer app of the last weeks, but FaceApp has been giving people the power to change their facial expressions, looks, and now age, since 2017.

But at the same time, people have been giving FaceApp the power to use their pictures — and names — for any purpose it wishes, for as long as it desires.

Peter Kostadinov, from PhoneArena, written and interesting article about this topic:

More than 100,000,000 Android users have downloaded and used FaceApp for the two and a half years it's been available. It's also currently the #1 top free and #2 top grossing app on the Apple App Store, which means that an equal amount of iOS users have likely downloaded and used it. 
It all looks like a harmless face filter app, and hopefully it is, but there are some serious concerns about the app's privacy. See, the app is developed by a Russian company called Wireless Lab and the terms & conditions of usage are sketchy at best. In their essence, the terms and conditions (linked here for your ease of use) are pretty standard... until you come to the part where

"you grant FaceApp a perpetual, irrevocable, nonexclusive, royalty-free, worldwide, fully-paid, transferable sub-licensable license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, publicly perform and display your User Content and any name, username or likeness provided in connection with your User Content in all media formats and channels now known or later developed, without compensation to you".

Essentially, once you download and use FaceApp, you're giving this Russian company the exclusive right to do whatever it desires with any photo you upload to the app.

You might end up on a billboard somewhere in Moscow, but your face will most likely end up training some AI facial-recognition algorithm.

The worst part is that this right is irrevocable, meaning you can't just delete your profile from the app and the app itself and expect Wireless Lab to stop using your content as it sees fit.

FaceApp is allowed to use your name, username or any likeness provided in any media format it likes without compensation, meaning you will not be paid for it, or have any ability to take it down or complain about it. This is also because FaceApp uploads your photo to the cloud for processing, it doesn’t carry out on-device processing like many apps do. After doing so, it retains the image long after you’ve deleted the app and moved on to the next viral sensation. People using the app are not made aware of this.

In order to work, FaceApp requires a user to hand over access to their entire camera roll, at which point the app automatically identifies images with faces. It doesn’t allow you to only permit camera access and take, say, one photo to be used by the app, or to upload individual photos to be filtered.

FaceApp also collects a variety of personally identifiable information, including “information from cookies, log files, device identifiers, location data, and usage data.” It provides this data to vaguely-defined "Affiliates" and "Service Providers," or parties that monitor the "effectiveness" of the app, "develop and test new products," track app metrics, and "diagnose or fix technology problems.” In other words, FaceApp reserves the right to share its information across several broad categories that could include several different types of companies.

Notably, FaceApp also gives user data to "third-party advertising partners."

FaceApp Isn’t Creepy Because It’s Russian, It's Creepy Because It’s Capitalist - VICE

What is the response from FaceApp?

According with this Forbes' article, FaceApp said that user data is not transferred to Russia and that "most of the photo processing in the cloud."

"We only upload a photo selected by a user for editing. We never transfer any other images from the phone to the cloud," Goncharov added.

"We might store an uploaded photo in the cloud. The main reason for that is performance and traffic: we want to make sure that the user doesn't upload the photo repeatedly for every edit operation. Most images are deleted from our servers within 48 hours from the upload date."

He said that users can also request that all user data be deleted. And users can do this by going to settings, then support and opt to report a bug, using the word "privacy" in the subject line message. Goncahrov said this should help speed up the process.

And he added: "We don't sell or share any user data with any third parties."


Essentially: your face will not be used for an advertising campaign, but it has certainly helped to train an AI and (perhaps) to build one of the largest facial recognition databases in history.