Privacy Policy

1. Scope and who is responsible

This Privacy Policy applies to FaceEnjoy's mobile applications, websites, APIs, account services, purchases, support channels, and related services (collectively, the "Service"). The Service is intended for international distribution outside mainland China and is not offered for distribution in mainland China.

The data controller is the developer or publisher identified as the seller of FaceEnjoy in the App Store or Google Play listing from which you obtained the app ("FaceEnjoy," "we," "us," or "our"). You can contact us at support@faceenjoy.com. If a storefront identifies a legal person or entity in addition to the FaceEnjoy name, that person or entity is the contracting operator for that storefront.

2. Information we handle

We handle only the information reasonably needed to provide, secure, support, and improve the Service. The exact information depends on the features you use.

• Account and recovery information: an internal user ID, support ID, anonymous-account status, verified recovery email if you add one, account creation and update times, encrypted session credentials, and one-way hashes of device-recovery credentials. On supported Android devices, an app-signing-scoped device identifier may be transformed with a keyed one-way hash for reinstall recovery and to prevent duplicate welcome rewards; we do not store the raw Android identifier.
• Device and technical information: app and build version, operating system, device model, locale, time zone, IP address or a salted/hash-derived value, User-Agent, random installation identifier, request IDs, diagnostic events, and security or rate-limit records.
• Photos and creative content: the source and target photos you select for face swapping, locally generated face-swap results, AI image prompts, selected model and aspect ratio, AI-generated images, work identifiers, and optional images or text you choose to submit with feedback.
• Face data handled on your device: Apple Vision on iOS or Google ML Kit on Android detects face bounding boxes and five landmark coordinates for the left eye, right eye, nose, left mouth corner, and right mouth corner. The local face engine may create temporary numerical face features solely to perform the composition you request.
• Content-safety information: image digests, the configured inspection scope, moderation service and policy version, provider request IDs, risk decisions, labels and confidence information, and feedback reasons.
• Purchase and entitlement information: store product, platform, order and transaction identifiers, purchase time, subscription status and renewal period, refund or revocation information, points balance and ledger entries, and verification payloads received from Apple or Google. We do not receive your full payment-card number.
• Support and feedback information: email correspondence, feedback details, content IDs or URLs you submit, support and feedback codes, device diagnostics you choose to send, and records of how a report was handled.
• Local device data: language, consent state, secure session tokens, cached model files, local work references, temporary images, and other settings stored on your device.

3. On-device face swapping

Face detection, landmark processing, temporary face-feature extraction, and face-swap composition are performed on your device. Apple Vision on iOS or Google ML Kit on Android detects face bounding boxes and the five landmark coordinates described in Section 2. The app and its native face engine exchange local file paths, and FaceEnjoy does not upload source or target photos to a FaceEnjoy generation server merely to perform the face swap.

FaceEnjoy does not use this face data to identify or authenticate a person, build a facial-recognition profile, advertise to you, or train FaceEnjoy models. In-memory derived face data is cleared when the task or engine session ends. App-managed temporary image and preview files are deleted when they are replaced or no longer needed and, as a fallback, within 24 hours.

The app may download face-engine model files when first used. A face-swap result remains in the app only when you choose to keep it, is written to your photo library only when you choose Save, and is passed to another app only when you choose Share through the operating-system share sheet. Saved results remain until you delete them from the app or your device. Cloud content-safety inspection and voluntary feedback are separate activities described below.

4. Cloud content-safety inspection

Cloud content-safety inspection is separate from face-swap generation. FaceEnjoy may inspect a user-selected custom target photo before a face swap. A locally generated face-swap result is inspected only if you choose Report and then agree to a separate disclosure shown for that report. Source photos and built-in template images are not included. Before either image is sent, the app identifies Alibaba Cloud Green as the recipient, explains the image and purpose, and asks for your permission. If you decline, the image is not uploaded and that operation does not continue.

Before upload, the app removes metadata and resizes and compresses a copy of the applicable custom target photo or user-approved reported result. It requests short-lived and restricted upload authorization from the FaceEnjoy API, then uploads the minimized copy directly to Alibaba Cloud's temporary object storage in Singapore. The image bytes do not pass through or remain on FaceEnjoy's Vercel application servers or application database.

Alibaba's temporary image is normally retained for approximately 30 minutes. FaceEnjoy may retain a one-way image digest, upload-session metadata, and the standardized inspection result for no more than 7 days to avoid repeating the same inspection and to protect the Service.

If you voluntarily submit moderation feedback, we store the moderation result, reasons, app and device details, source IP, User-Agent, and an approximate country, region, city, coordinates, and time zone inferred by our hosting provider from the source IP. We do not request device GPS. An image is included only if you expressly add it and is kept in private Cloudflare R2 storage for no more than 30 days.

5. Cloud AI image generation

If you choose AI image generation, the app presents a separate disclosure and asks for your consent before sending a request. FaceEnjoy sends your prompt, selected model, aspect ratio, request ID, and necessary technical information to FaceEnjoy servers and to ModelVerse or the model provider selected for your request. Do not include personal, confidential, or third-party information in a prompt unless you are authorized to provide it.

Successful generated-image files are stored privately in Cloudflare R2 for normally no more than three days. Download links are short-lived. The task record, including the prompt, model, points charged, status, provider request ID, and timestamps, remains associated with your account until you delete the account or we remove or anonymize it under our retention program. Deleting a work removes it from your visible history and requests deletion of its stored image, but limited task records may remain for security, billing, dispute, and audit purposes.

We and our service providers use these inputs and outputs only to provide and protect the requested feature. We do not use your prompts, selected face-swap photos, face data, or generated images for advertising, sale, profiling, or training FaceEnjoy models, and our providers may not use them for unauthorized model training.

6. Why we use information and our legal bases

We use information to create and recover accounts; provide local face swapping and cloud AI generation; verify purchases; maintain points and subscriptions; deliver templates and model files; save preferences; prevent fraud and abuse; moderate content; diagnose failures; respond to support requests; comply with law; and establish, exercise, or defend legal claims.

Where applicable law requires a legal basis, we rely on performance of our contract with you, your consent, compliance with legal obligations, and our legitimate interests in securing, operating, supporting, and improving the Service. Where we rely on consent, you may decline or withdraw it, but the affected optional feature may no longer work. We do not use personal information for third-party advertising or cross-context behavioral advertising.

7. Service providers and disclosures

We disclose information only as needed to operate the Service, follow your directions, complete a transaction, protect users, or comply with law. Our principal categories of recipients are listed below. Their exact corporate entity and processing location can depend on your platform and the infrastructure available at the time of a request.

When a provider processes personal information for FaceEnjoy, we require contractual and technical protections that provide the same or equivalent protection. Alibaba Cloud Green, ModelVerse, and selected model providers may not use the data they receive from FaceEnjoy for advertising, sale, profiling, or unauthorized model training.

• Supabase: authentication, account records, relational database, and email verification infrastructure.
• Vercel: website and API hosting, request delivery, security controls, and IP-derived coarse location headers.
• Cloudflare R2: private storage for generated images for normally no more than three days and optional moderation-feedback attachments for no more than 30 days.
• Alibaba Cloud Green: direct receipt of a minimized custom-target-photo copy or a separately approved reported-result copy in temporary object storage and content-safety inspection, currently using the Singapore service endpoint.
• ModelVerse and selected AI model providers: processing prompts, selected model and aspect ratio, request IDs, necessary technical information, and generated outputs for AI image-generation requests.
• Apple and Google: app distribution, in-app purchase processing, transaction verification, subscription lifecycle, refunds, and store records.
• Model and content-delivery providers, including FaceEnjoy and ModelHubRouter domains: delivery of face-engine files and Discover materials.
• Professional advisers, regulators, courts, law enforcement, or a successor in a merger or asset transfer, where legally permitted and subject to appropriate safeguards.

8. No sale, targeted ads, or hidden tracking

FaceEnjoy does not sell personal information, share it for cross-context behavioral advertising, or use third-party advertising SDKs. The current app does not use a third-party analytics or crash-reporting SDK. If this changes, we will update this policy and the relevant store privacy disclosures before collecting the new data.

Our website may use essential operational storage and Vercel Speed Insights to understand aggregate performance. We do not use advertising cookies. Browser and hosting providers may still receive ordinary network information such as IP address and User-Agent when you load a page.

9. International transfers

FaceEnjoy and its service providers may process information in countries other than the country where you live, including the United States, Singapore, and other locations where our providers operate. Those countries may have different data-protection laws.

Where required, we use contractual commitments, transfer mechanisms, access restrictions, encryption, and data-minimization measures intended to protect transferred information. By asking us to provide a globally hosted feature, you understand that the technical processing described in this policy may occur across borders, subject to your non-waivable rights under applicable law.

10. Retention and deletion

We keep information only for as long as reasonably necessary for the purposes described above, including providing the Service, maintaining security and transaction integrity, resolving disputes, and complying with legal obligations. Retention periods differ by data type.

• In-memory face bounding boxes, landmark coordinates, and temporary numerical face features: cleared when the task or engine session ends.
• App-managed temporary face-swap input and preview files: deleted when replaced or no longer needed and, as a fallback, within 24 hours. Results you choose to save remain until you delete them from the app or your device.
• Alibaba Cloud Green temporary inspection images: normally approximately 30 minutes.
• Generated-image files: normally no more than three days, or earlier when successfully deleted by you; short-lived access links expire sooner.
• Optional moderation-feedback image attachments: no more than 30 days.
• Content-safety image digests, standardized results, and upload-session metadata: no more than 7 days or the shorter session expiry.
• App-review session telemetry: normally 90 days.
• Expired authentication rate-limit buckets: normally removed after the window expires and the cleanup process runs.
• Account, prompt, entitlement, feedback, and operational records: while your account is active and afterward only as needed for security, support, dispute, audit, or legal purposes.
• Purchase, refund, fraud-prevention, tax, and audit records: up to seven years where reasonably necessary or legally required. Apple and Google retain their own store records under their policies.
• Local photos, exported results, downloaded files, and operating-system backups: until you delete them from your device or account with the relevant platform.

11. Your choices and privacy rights

Depending on where you live, you may have rights to know or access the information we hold about you; obtain a portable copy; correct inaccurate information; delete information; restrict or object to processing; withdraw consent; opt out of sale, sharing, targeted advertising, or certain profiling; and appeal a denied request. FaceEnjoy does not currently sell information or use it for targeted advertising.

You can separately decline or withdraw custom-target cloud-content-safety consent and AI image-generation consent in Settings > Privacy & Data. Withdrawal prevents the applicable future cloud processing and means FaceEnjoy will ask again before another request. Permission to inspect a face-swap result for a user-initiated report is requested separately for every report and can be declined without sending the result. These choices do not undo earlier lawful processing, delete records already handled under the stated provider retention periods, or delete your local works.

You can also decline photo access or optional feedback; delete individual generated works; remove local files; cancel a store subscription in Apple or Google account settings; and request account deletion in the app or at the account-deletion page on faceenjoy.com. Account deletion does not automatically cancel a store subscription or remove exported files from your device.

To exercise another right, email support@faceenjoy.com from the address linked to your account if available and describe your request. We may verify your identity and authority before acting. You may use an authorized agent where local law permits. We will not discriminate against you for exercising a privacy right.

12. Children and teens

The Service is not directed to children under 13, or a higher minimum age where local law requires it, and they may not create or use an account. If you are under the age of legal majority where you live, use the Service only with permission and supervision from a parent or legal guardian.

Do not upload, generate, or manipulate sexual, exploitative, or otherwise harmful content involving a minor. If we learn that we collected personal information from a child contrary to applicable law, we will take reasonable steps to delete it. A parent or guardian may contact support@faceenjoy.com.

13. Security

We use measures designed to protect information, including HTTPS in transit, private object storage, short-lived signed links, restricted administrative access, row-level database controls, one-way credential hashing, encryption of recovery-token escrow, rate limits, and verified store webhooks. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

You are responsible for protecting your device, recovery email, recovery code, and store account. Contact us promptly if you believe your FaceEnjoy account or information has been compromised.

14. Regional notices

EEA, United Kingdom, and Switzerland: you may complain to your local data-protection authority. Where processing is based on legitimate interests, you may object based on your particular situation. Where processing is based on consent, withdrawal does not affect earlier lawful processing.

United States: the categories described in Section 2 are collected for the business purposes in Section 6 and disclosed to the service-provider categories in Section 7. We do not sell personal information or share it for cross-context behavioral advertising. We do not offer financial incentives in exchange for personal information. Applicable state law may give you additional access, correction, deletion, opt-out, appeal, and authorized-agent rights.

Other regions: mandatory local privacy rights and consumer protections continue to apply. Nothing in this policy limits rights that cannot legally be waived.

15. Changes and contact

We may update this policy as the Service, providers, or law changes. We will post the revised policy with a new date and, when required, provide additional notice or request renewed consent before a material change takes effect.

Questions, complaints, and privacy requests may be sent to support@faceenjoy.com. Please do not attach sensitive photos unless our support flow specifically asks for them and explains how they will be handled.