Privacy Policy

1. Scope and who is responsible

This Privacy Policy applies to FaceEnjoy's mobile applications, websites, APIs, account services, purchases, support channels, and related services (collectively, the "Service"). The Service is intended for international distribution outside mainland China and is not offered for distribution in mainland China.

The data controller is the developer or publisher identified as the seller of FaceEnjoy in the App Store or Google Play listing from which you obtained the app ("FaceEnjoy," "we," "us," or "our"). You can contact us at support@faceenjoy.com. If a storefront identifies a legal person or entity in addition to the FaceEnjoy name, that person or entity is the contracting operator for that storefront.

2. Information we handle

We handle only the information reasonably needed to provide, secure, support, and improve the Service. The exact information depends on the features you use.

• Account and recovery information: an internal user ID, support ID, anonymous-account status, verified recovery email if you add one, account creation and update times, encrypted session credentials, and one-way hashes of device-recovery credentials. On supported Android devices, the app sends an app-signing-scoped Android identifier to the FaceEnjoy API over HTTPS, where it is transformed with a keyed one-way hash for reinstall recovery and to prevent duplicate welcome rewards; we do not persist the raw Android identifier. The app also stores a random 128-bit recovery token using Google Block Store and enables its cloud-backup option; backup availability depends on the device and system backup settings. This token is an account-recovery credential, not a photo or a face feature.
• Device and technical information: app and build version, operating system, device model, locale, time zone, IP address or a salted/hash-derived value, User-Agent, random installation identifier, request IDs, diagnostic events, and security or rate-limit records.
• Photos and creative content: the source and target photos you select for face swapping, locally created face-swap results, Android AI-generation prompts, selected models and aspect ratios, generated images and task records, original provider image URLs and/or image data (such as Base64), recovered image copies, work identifiers, and optional images or text you choose to submit with feedback.
• Face data handled on your device: Apple Vision on iOS or Google ML Kit on Android detects face bounding boxes and five landmark coordinates for the left eye, right eye, nose, left mouth corner, and right mouth corner. The local face engine may create temporary numerical face features solely to perform the composition you request.
• Google ML Kit Android SDK diagnostics: Google collects device manufacturer and model, operating-system version and build, available machine-learning hardware accelerators, package name and app version, per-installation identifiers, performance metrics, API configuration such as image format and resolution, input and output sizes, feature version, event types, and error codes. Google uses this information for diagnostics and usage analytics and encrypts it in transit using HTTPS. This SDK diagnostic collection is separate from the on-device processing of your photos and face data.
• Content-safety information: image digests, the configured inspection scope, moderation service and policy version, provider request IDs, risk decisions, labels and confidence information, and feedback reasons.
• Purchase and entitlement information: store product, platform, order and transaction identifiers, purchase time, subscription status and renewal period, refund or revocation information, points balance and ledger entries, and verification payloads received from Apple or Google. We do not receive your full payment-card number.
• Support and feedback information: email correspondence, feedback details, content IDs or URLs you submit, support and feedback codes, device diagnostics you choose to send, and records of how a report was handled.
• Local device data: language, consent state, secure session tokens, cached model files, local work references, temporary images, and other settings stored on your device.

3. On-device face swapping

Face detection, landmark processing, temporary face-feature extraction, and face-swap composition are performed on your device. Apple Vision on iOS or Google ML Kit on Android detects face bounding boxes and the five landmark coordinates described in Section 2. The app and its native face engine exchange local file paths, and FaceEnjoy does not upload source or target photos to a FaceEnjoy generation server merely to perform the face swap.

FaceEnjoy does not use this face data to identify or authenticate a person, build a facial-recognition profile, advertise to you, or train FaceEnjoy models. Temporary processing buffers are released after use, but bounded on-device caches can retain face bounding boxes and landmark coordinates across tasks. The native engine can also retain the most recent source image and derived features for reuse until the source is replaced, the engine is released, or the app process ends. These caches stay on your device. Landmark caches are evicted under capacity limits, memory pressure, or lifecycle cleanup; iOS also expires inactive entries after two hours when cache cleanup runs. App-managed temporary image and preview files are removed when released or replaced. Inactive files older than 24 hours are eligible for deletion at the next cleanup, such as app startup; cleanup does not run while the app is closed.

The app may download face-engine model files when first used. In the Android app, successful face-swap results are automatically saved in the app's private storage and listed in My Works. You do not need to choose Save to retain this private copy. A result is written to your photo library only when you choose Save, and is passed to another app only when you choose Share through the operating-system share sheet. Private copies remain until you delete the work, clear local works, or remove the app data; exported copies must be removed separately from your device. Cloud content-safety inspection and voluntary feedback are separate activities described below.

4. Cloud content-safety inspection

This section describes optional cloud inspection for on-device face swapping. Required checks for Android AI image generation are described in Section 5. FaceEnjoy may inspect a user-selected custom target photo before a face swap. A locally generated face-swap result is inspected only if you choose Report and then agree to a separate disclosure shown for that report. Source photos and built-in examples are not included. Before either image is sent, the app identifies Alibaba Cloud Green as the recipient, explains the image and purpose, and asks for your permission. If you decline, the image is not uploaded and that operation does not continue.

Before upload, the app removes metadata and resizes and compresses a copy of the applicable custom target photo or user-approved reported result. It requests short-lived and restricted upload authorization from the FaceEnjoy API, then uploads the minimized copy directly to Alibaba Cloud's temporary object storage in Singapore. The image bytes do not pass through or remain on FaceEnjoy's Vercel application servers or application database.

Alibaba's temporary image is normally retained for approximately 30 minutes. FaceEnjoy may retain a one-way image digest, upload-session metadata, and the standardized inspection result for no more than 7 days to avoid repeating the same inspection and to protect the Service.

If you voluntarily submit moderation feedback, we store the moderation result, reasons, app and device details, source IP, User-Agent, and an approximate country, region, city, coordinates, and time zone inferred by our hosting provider from the source IP. We do not request device GPS. An image is included only if you expressly add it and is kept in private Cloudflare R2 storage for no more than 30 days.

5. Android AI image generation and online templates

AI image generation and the online template catalog are available in the Android app; neither is offered in the current iOS app. If you choose Android AI image generation, the app presents a separate disclosure and asks for your consent before sending a request. FaceEnjoy sends your prompt, selected model, aspect ratio, request ID, and necessary technical information to FaceEnjoy servers and to ModelVerse or the model provider selected for your request. Do not include personal, confidential, or third-party information in a prompt unless you are authorized to provide it.

Every AI image-generation request is subject to FaceEnjoy server-side safety checks. Prompts that are not blocked by our local checks are sent to Alibaba Cloud Green in Singapore for automated text inspection before generation. If a provider returns an image, FaceEnjoy processes it on its servers to remove metadata, resize and compress it, and sends the resulting JPEG to Alibaba Cloud Green's temporary object storage in Singapore for automated image inspection before delivery. Rejected, uncertain or failed inspections do not permit delivery. These checks are required to use cloud AI generation and are separate from permission to inspect a custom face-swap target photo. If you do not want this processing, do not submit an AI-generation request or withdraw AI-generation consent.

Successful generated-image files are stored privately in Cloudflare R2 and normally available to you for three days. Download links are short-lived. Full prompt text and individual AI-generation inspection records become eligible for scheduled redaction or removal after 30 days. This cleanup is deferred while a deleted work is still in its seven-day investigation hold or an associated request awaits storage cleanup. Limited task identifiers, hashes and settlement records may remain for security, billing, dispute and audit purposes. Deleting a work immediately hides it from your history and stops user downloads. An image not already removed or in cleanup is retained privately for seven days from the first deletion for troubleshooting and safety investigations, then scheduled for physical deletion. Only authorized staff can access it during this period, and access is audited. Repeated deletion does not extend the period. Account deletion schedules cleanup without this seven-day hold. Opening My Works or saving/sharing a generated image may create a private on-device copy that remains usable after the cloud copy expires. Clearing local works removes these private copies and local work references, but does not delete cloud records or photos exported to your gallery. Still-available cloud works may download again on a later visit to My Works.

To diagnose generation, download and content-safety problems, FaceEnjoy privately stores the original image URL and/or image data (such as Base64) returned by the provider in its Supabase database, depending on the response format. This happens before downloading, decoding or minimizing the image, so the records can include results whose download later fails or whose image is rejected by safety inspection. Associated task, user and provider request identifiers and necessary diagnostics are retained with the result. Authorized staff may recover an image from the retained data or retry downloading its original URL for investigation; this does not approve it for user delivery. Original results and any recovered image copy share a fixed seven-day access period from the first save of the original result. Deleting a work or account, or recovering an image, does not renew or immediately erase this independent record. Staff access stops at expiry and scheduled deletion is retried if it fails, which may delay physical deletion. Retaining a URL does not extend the provider link’s validity or guarantee that an image can be recovered.

After a provider returns a valid image, FaceEnjoy registers and stores a separate minimized JPEG copy in private Cloudflare R2 storage for troubleshooting and safety investigations, including images that later fail safety inspection. This copy is retained for seven days from its registration, is not a user work, and is accessible only to authorized staff through audited access. Deleting a work or an account does not immediately delete or renew this separate investigation copy; it remains until its existing seven-day deadline. At that deadline staff access stops and scheduled physical cleanup begins. Cleanup failures are retried and may delay physical deletion. No investigation copy is created if the provider returns no valid image.

Alibaba Cloud's documentation describes the temporary local-image upload used for inspection as storing files for approximately 30 minutes. These temporary files are cleaned up through the provider-managed storage lifecycle. FaceEnjoy does not treat completion of an inspection or expiration of an upload credential as proof of physical deletion. This temporary storage is separate from FaceEnjoy delivery images, original provider results and safety-investigation copies, which follow their own retention periods described here.

We and our service providers use these inputs and outputs only to provide and protect the requested feature. We do not use your prompts, selected face-swap photos, face data, or generated images for advertising, sale, profiling, or training FaceEnjoy models, and our providers may not use them for unauthorized model training.

Browsing the Android online template catalog sends the package code, app locale, category, and pagination details to the catalog provider, which also receives standard network information such as your IP address. Template images are downloaded to your device for viewing and use. Browsing templates does not send your source face photo to the catalog provider. If you report a template, we receive its identifier and the feedback you choose to send.

6. Why we use information and our legal bases

We use information to create and recover accounts; provide on-device face swapping and Android cloud AI image generation; verify purchases; maintain points and subscriptions; deliver on-device face-engine model files and Android online templates; save preferences; prevent fraud and abuse; moderate content; diagnose failures; respond to support requests; comply with law; and establish, exercise, or defend legal claims.

Where applicable law requires a legal basis, we rely on performance of our contract with you, your consent, compliance with legal obligations, and our legitimate interests in securing, operating, supporting, and improving the Service. Where we rely on consent, you may decline or withdraw it, but the affected optional feature may no longer work. We do not use personal information for third-party advertising or cross-context behavioral advertising.

7. Service providers and disclosures

We disclose information only as needed to operate the Service, follow your directions, complete a transaction, protect users, or comply with law. Our principal categories of recipients are listed below. Their exact corporate entity and processing location can depend on your platform and the infrastructure available at the time of a request.

When a provider processes personal information for FaceEnjoy, we require contractual and technical protections that provide the same or equivalent protection. Alibaba Cloud Green, ModelVerse, and selected Android AI model providers may not use the data they receive from FaceEnjoy for advertising, sale, profiling, or unauthorized model training.

• Supabase: authentication, account records, relational database, email verification infrastructure, and private storage of original AI-generation image URLs and/or image data and recovered image copies for troubleshooting.
• Vercel: website and API hosting, request delivery, security controls, and IP-derived coarse location headers.
• Cloudflare R2: private storage for Android AI-generated images, normally available to users for three days. When a work is deleted before image cleanup, the remaining cloud image is retained privately for seven days from the first deletion for troubleshooting and safety investigations. A separate safety-investigation copy, including images that fail inspection, is retained for seven days from registration even if the work or account is deleted. Optional moderation-feedback image attachments are retained for no more than 30 days.
• Alibaba Cloud Green: direct receipt of a minimized custom-target-photo copy or a separately approved reported-result copy in temporary object storage and content-safety inspection, currently using the Singapore service endpoint. It also receives AI-generation prompts that pass local checks and the minimized generated JPEG for required automated text and image safety inspection in Singapore.
• ModelVerse and selected Android AI model providers: processing prompts, selected model and aspect ratio, request IDs, necessary technical information, and generated outputs for Android AI image-generation requests.
• Apple and Google: app distribution, in-app purchase processing, transaction verification, subscription lifecycle, refunds, and store records.
• Google ML Kit (Android): on-device face detection and receipt of the SDK diagnostics and usage-analytics information described in Section 2.
• Google Block Store (Android): storage and, where supported by the device and system backup settings, cloud backup of a random account-recovery token so an account can be restored after reinstall or device transfer. FaceEnjoy requests removal of the old token through Block Store when you delete an account in the app. Server-side recovery credentials are revoked on account deletion, so a residual backed-up token cannot recover the deleted account. If you continue using the app, it creates a new guest account and may store a new recovery token; deletion through the website cannot directly clear a device's Block Store storage.
• Model and content-delivery providers, including FaceEnjoy and ModelHubRouter domains: delivery of on-device face-engine files and the Android online template catalog.
• Professional advisers, regulators, courts, law enforcement, or a successor in a merger or asset transfer, where legally permitted and subject to appropriate safeguards.

8. No sale, targeted ads, or hidden tracking

FaceEnjoy does not sell personal information, share it for cross-context behavioral advertising, or use third-party advertising SDKs. The current app does not integrate a standalone general-purpose analytics or crash-reporting SDK. Google ML Kit nevertheless collects its own SDK diagnostics and usage-analytics information as described in Section 2. If our collection practices change, we will update this policy and the relevant store privacy disclosures before collecting the new data.

Our website may use essential operational storage and Vercel Speed Insights to understand aggregate performance. We do not use advertising cookies. Browser and hosting providers may still receive ordinary network information such as IP address and User-Agent when you load a page.

9. International transfers

FaceEnjoy and its service providers may process information in countries other than the country where you live, including the United States, Singapore, and other locations where our providers operate. Those countries may have different data-protection laws.

Where required, we use contractual commitments, transfer mechanisms, access restrictions, encryption, and data-minimization measures intended to protect transferred information. By asking us to provide a globally hosted feature, you understand that the technical processing described in this policy may occur across borders, subject to your non-waivable rights under applicable law.

10. Retention and deletion

We keep information only for as long as reasonably necessary for the purposes described above, including providing the Service, maintaining security and transaction integrity, resolving disputes, and complying with legal obligations. Retention periods differ by data type.

• On-device face data: temporary processing buffers are released after use. Bounded face bounding-box and landmark caches can survive individual tasks and are evicted under capacity limits, memory pressure, or lifecycle cleanup; iOS also expires inactive entries after two hours at cache cleanup. The native engine may retain the most recent source image and derived features until source replacement, engine release, or process termination.
• App-managed temporary face-swap input and preview files: removed when released or replaced. Inactive files older than 24 hours are eligible for deletion at the next cleanup, including app startup. Cleanup does not run while the app is closed. Saved results remain until you delete them from the app or your device.
• Alibaba Cloud Green temporary inspection images: normally approximately 30 minutes.
• Cloud copies of Android AI-generated image files: normally available for three days. Work deletion immediately hides the work and stops user downloads. Remaining images not already in cleanup are retained privately for seven days from the first deletion for troubleshooting and safety investigations; authorized staff access is audited. At the deadline, access ends and scheduled deletion begins. Cleanup failures are retried and may delay physical deletion. Account deletion schedules cleanup without the work-deletion hold. Private on-device copies are retained until you delete the work, clear local works, or remove the app data, and can outlast cloud expiry.
• Separate AI-generation safety-investigation copies: seven days from registration, including copies of rejected images. Work deletion and account deletion do not extend or immediately erase these independent copies. Staff access ends at expiry; physical cleanup is scheduled and retried if it fails.
• Original AI-generation provider results and recovered image copies: a fixed seven-day access period from the first save of the original result in the private database. This includes image URLs and/or image data such as Base64, even if a later download fails or the image is rejected. Work deletion, account deletion and recovery do not extend or immediately erase these independent records. Staff access stops at expiry; scheduled physical deletion is retried if it fails and may be delayed. Provider URLs may expire sooner.
• Full AI-generation safety-request prompts and inspection events: eligible for scheduled redaction or removal after 30 days, except while a deleted work remains in its seven-day hold or an associated request awaits storage cleanup. Limited request IDs, hashes and settlement records are retained separately.
• Optional moderation-feedback image attachments: no more than 30 days.
• Content-safety image digests, standardized results, and upload-session metadata: no more than 7 days. Upload authorizations expire sooner; expired upload-session records are removed by periodic cleanup.
• App-review session telemetry: normally 90 days.
• Expired authentication rate-limit buckets: normally removed after the window expires and the cleanup process runs.
• Android duplicate-welcome-reward prevention claims: a keyed one-way device or recovery-token hash, platform, claim state, reward-grant time, and claim timestamps may remain after account deletion to prevent repeated rewards. Deletion removes the old account association but does not immediately erase this limited fraud-prevention record. Claims are retained for no more than seven years after their most recent registration or update and are removed by periodic cleanup. This claim record is separate from the credentials used to recover an active account.
• Account, limited Android AI task and settlement records, entitlement, feedback, and operational records: while your account is active and afterward only as needed for security, support, dispute, audit, or legal purposes.
• Purchase, refund, fraud-prevention, tax, and audit records: up to seven years where reasonably necessary or legally required. Apple and Google retain their own store records under their policies.
• Local photos, exported results, downloaded files, and operating-system backups: until you delete them from your device or account with the relevant platform.

11. Your choices and privacy rights

Depending on where you live, you may have rights to know or access the information we hold about you; obtain a portable copy; correct inaccurate information; delete information; restrict or object to processing; withdraw consent; opt out of sale, sharing, targeted advertising, or certain profiling; and appeal a denied request. FaceEnjoy does not currently sell information or use it for targeted advertising.

You can decline or withdraw custom-target cloud content-safety consent in Settings > Privacy & Data. In the Android app, you can separately decline or withdraw AI image-generation consent. Withdrawal prevents the applicable future cloud processing, and FaceEnjoy will ask again before another request. Permission to inspect a face-swap result for a user-initiated report is requested separately for every report and can be declined without sending the result. These choices do not undo earlier lawful processing, automatically delete records already retained by FaceEnjoy or its service providers under the stated retention periods, or delete your local works.

You can also decline photo access or optional feedback, delete local works or Android AI-generated works, remove local files, cancel a store subscription in Apple or Google account settings, and request account deletion in the app or at the account-deletion page on faceenjoy.com. Account deletion does not automatically cancel a store subscription or remove exported files from your device.

To exercise another right, email support@faceenjoy.com from the address linked to your account if available and describe your request. We may verify your identity and authority before acting. You may use an authorized agent where local law permits. We will not discriminate against you for exercising a privacy right.

12. Children and teens

The Service is not directed to children under 13, or a higher minimum age where local law requires it, and they may not create or use an account. If you are under the age of legal majority where you live, use the Service only with permission and supervision from a parent or legal guardian.

Do not upload, generate, or manipulate sexual, exploitative, or otherwise harmful content involving a minor. If we learn that we collected personal information from a child contrary to applicable law, we will take reasonable steps to delete it. A parent or guardian may contact support@faceenjoy.com.

13. Security

We use measures designed to protect information, including HTTPS in transit, private object storage, short-lived signed links, restricted administrative access, row-level database controls, one-way credential hashing, encryption of recovery-token escrow, rate limits, and verified store webhooks. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

You are responsible for protecting your device, recovery email, recovery code, and store account. Contact us promptly if you believe your FaceEnjoy account or information has been compromised.

14. Regional notices

EEA, United Kingdom, and Switzerland: you may complain to your local data-protection authority. Where processing is based on legitimate interests, you may object based on your particular situation. Where processing is based on consent, withdrawal does not affect earlier lawful processing.

United States: the categories described in Section 2 are collected for the business purposes in Section 6 and disclosed to the service-provider categories in Section 7. We do not sell personal information or share it for cross-context behavioral advertising. We do not offer financial incentives in exchange for personal information. Applicable state law may give you additional access, correction, deletion, opt-out, appeal, and authorized-agent rights.

Other regions: mandatory local privacy rights and consumer protections continue to apply. Nothing in this policy limits rights that cannot legally be waived.

15. Changes and contact

We may update this policy as the Service, providers, or law changes. We will post the revised policy with a new date and, when required, provide additional notice or request renewed consent before a material change takes effect.

Questions, complaints, and privacy requests may be sent to support@faceenjoy.com. Please do not attach sensitive photos unless our support flow specifically asks for them and explains how they will be handled.