In 2019, FaceApp’s viral aging filter triggered a privacy panic largely framed around the app’s Russian origins. A nationality is not a privacy audit.
The useful 2026 question is narrower: what does the company’s current policy say happens to photos and other data, what do the app stores disclose, and what controls does a user have?
What FaceApp currently says
Only images selected for editing are uploaded
FaceApp’s current FAQ says photos not edited with its filters are not uploaded to its servers.
Temporary encrypted processing cache
The company says selected edited photos are temporarily cached on Google Cloud Platform and Amazon Web Services.
Encryption key stays on the device
FaceApp says the cloud cache is encrypted with a key stored locally on the user’s device.
24–48 hours automatically
The company says cached photos are automatically deleted within 24–48 hours after the last edit, with a manual Delete Cloud Photo Cache option in settings.
The privacy policy covers broader information
FaceApp’s policy describes processing of device data, app usage information, purchase information, approximate location and other information for app functionality, analytics, fraud prevention, troubleshooting and — depending on consent and jurisdiction — marketing-related purposes. Google Play’s data-safety disclosure similarly lists several data categories that may be collected or shared.
Five questions
Does processing happen on-device or in the cloud?
Uploading a photo changes the privacy model.
How long is the uploaded image retained?
Temporary processing and indefinite storage are not equivalent.
What non-photo data is collected?
Device identifiers, diagnostics, purchases and location can matter.
Can you delete data?
Look for specific controls, not a vague promise.
Is the policy describing the current app version?
Old viral articles can outlive multiple policy and architecture changes.
A privacy policy is a company statement
The current FaceApp FAQ and privacy policy describe its practices; this article does not independently audit FaceApp’s servers or cryptographic implementation. App-store disclosures are also largely based on developer-provided information. Read them as documented claims and controls, not an independent certification.
The 2026 FaceApp privacy story is more specific — and more useful — than the 2019 panic
Selected photos are cloud-processed under the company’s current design, with encryption and time-limited caching claimed by FaceApp.
That still leaves a normal privacy decision: whether you are comfortable sending a face image to a cloud service and with the other data categories the app says it processes.