Guide

Face Swap Privacy: Where Do Your Photos Go?

Yes, your face is on a cloud server. For how long?

Face-swap apps are camera-roll apps that upload your face photos to remote servers for processing. This raises legitimate privacy questions: where are the photos stored, who can access them, how long are they kept, and are they used to train models. This is the boring-but-important page on that subject.

Every face-swap app currently shipping in the App Store processes images server-side. On-device face-swap models exist as research projects but don't yet meet the quality bar of cloud-processed swaps. So the question isn't whether your photos are uploaded — they are — but rather what happens to them next.

What happens during a swap

When you tap Generate, the source face and target image upload to the app's cloud infrastructure. A face-swap model processes both, returns the resulting image, and the result downloads to your phone. The whole round-trip is typically 10–60 seconds.

  • Source and target uploaded to cloud storage (usually AWS S3 or similar)
  • Job sent to a GPU worker that runs the model
  • Result image written to cloud storage
  • App polls for completion, downloads the result

How AnyFace handles this

AnyFace stores source faces on your iPhone (in the app's local sandbox, not in cloud storage). When you run a swap, the source uploads only for that job, alongside the target. Both are stored on cloud infrastructure during processing.

After a successful swap completes, original source and target images are auto-deleted from our infrastructure within 24 hours. Result images stay so the app can show you history; you can delete them from within the app at any time.

We don't use uploaded images to train models. Our face-swap models come from upstream providers we license — none of our user data goes back into improving them.

How other apps handle this

Each face-swap app's ToS differs. Some retain rights to use uploaded images for product improvement. Some retain rights to train models. Some delete on a defined schedule. Read the privacy policy of any app before uploading your face.

  • Look for: data retention period (24h, 30d, indefinite)
  • Look for: training-data opt-in/opt-out language
  • Look for: third-party sharing (advertising partners, etc.)
  • Red flag: ambiguous language about 'product improvement' without specifics

Practical privacy guidance

If you're privacy-conscious about face-swap apps:

  • Use apps that store faces on-device (AnyFace) rather than in the cloud
  • Don't upload photos of friends without consent
  • Don't use face-swap on photos containing other identifying information (license plates, addresses)
  • Delete result images you don't need (storage and exposure go down)
  • Read the ToS before uploading — yes, actually read it

What we publicly commit to

AnyFace's privacy commitments are documented in our privacy policy at gradflowlab.com/privacy. Source and target images are deleted from servers within 24 hours of completion. Face libraries are device-local and never uploaded except per-swap. No training-data use of customer images.

FAQ

Q1Why not on-device only?

Mobile chips aren't yet fast enough to run a high-quality face-swap model in under a minute. On-device face-swap will arrive, but the current quality gap vs cloud-processed swap is large.

Q2Can someone subpoena my face-swap history?

Theoretically yes — if law enforcement obtains a valid subpoena, any cloud service must comply. AnyFace's 24h retention window means most subpoenas would find nothing beyond very recent activity.

Q3What about Apple's privacy framework?

App Tracking Transparency (ATT) and App Privacy Labels apply to AnyFace. Our App Store entry discloses the data categories we collect (face data, usage metrics).

Related

Published 2026-05-26.