Privacy and retention
How long each kind of file is kept, everyone who receives one, and what is recorded about an account.
What happens to your files
They sit in storage we control. Some are on a clock and some are not, and the table says which.
| What | Kept for | To remove it sooner |
|---|---|---|
| Generations, the results of a swap | 30 days after the swap finishes. | Delete the generation or the whole swap. |
| The photos and videos you swap into | 30 days after the swap that used them finishes. A file that a newer swap or a saved face still uses stays for that. | Delete the generation made from the file. |
| Uploads that no swap points at | No time limit. That is an upload you never used, or one left behind when you deleted a swap whole. | Write to faceswaping@proton.me. |
| Face photos | No time limit. The 30-day deletion does not touch them, whether the face was saved to your library or used once. | Deleting a saved face takes it out of your library and keeps its photos. Write to faceswaping@proton.me to have them erased. |
| A file the automated check refuses | Deleted at once. | Nothing to do. |
| A file the check never answered for | Set aside after about a day, where nothing serves it, until a person decides. No time limit. | Write to faceswaping@proton.me. |
| The record of a swap | Kept after its files are gone: what went in, the options, the cost and how it ended. | Deleting the swap deletes the record. One audit line stays, with the swap's id and who deleted it. |
| The swap service's copy | 24 hours after the swap finishes, unless the service publishes another figure. | Deleting the swap asks the service to drop it. |
Where are my files stored?
In a Cloudflare R2 bucket that we control. An upload goes from your browser straight to the bucket, and a finished generation is copied there from the swap service.
Who can open a stored file?
Everyone in your team sees the team's uploads, saved faces and generations in the app. A stored file also has a public address on our own domain. That address is not listed anywhere and is built from long generated ids, but it does not ask for a sign-in, so anyone you give it to can open the file until the file is deleted.
What does deleted mean here?
The file is removed from the bucket, and the app stops serving it and will not use it in a swap. The 30-day deletion runs once a day, so files go within about a day of that mark. The swap's record stays and is marked as expired.
Are my uploads used to train a model?
No. Nothing in the app or in the moderation service uses an upload, a face or a generation to train or tune a model. The app stores no face embedding and no biometric template. A saved face is a name and its photos, and each swap sends those photos again.
Who else receives a file
A file leaves our storage for two jobs, the swap and the automated check.
| Who | What it receives | What it keeps |
|---|---|---|
| Cloudflare R2, the storage | Every upload, face photo and generation. | Each file until it is deleted, as in the table above. |
| The swap service, which runs the model | Links to the face photos, to the photos and videos to swap into and to a lip-sync audio track, with the options you chose. It also reads a file when you ask the studio to list the faces in it. | Its copy and the result for 24 hours after the swap finishes, unless it publishes another figure. |
| The moderation service | A short-lived link to each photo, video and face you upload. A file given to the API by link is passed on as that link. The same service makes a thumbnail when your browser could not, and builds the zip when you download several generations at once. | It has no database and does not keep the file it checks. A zip is stored so that you can download it. |
| The moderation model that the moderation service calls | Each photo, as an image. From a video, 5 to 20 still frames at reduced size. The request carries the image and nothing about your account. | That is governed by its provider's terms, not ours. |
Does anyone not in the table below receive my files?
No. The checkout, the email provider and the page-view counter never receive a file. Files are not sold and are not given to anyone for advertising.
Who receives other data about me?
Vercel hosts the app and counts page views. NOWPayments runs the checkout. Resend delivers email, so it receives your address and the message. Google or Discord take part only if you sign in with them. The public support board is run by Featurebase, and what you post there is public.
What we know about you
An account requires an email address and nothing else. This is what gets recorded around it.
- Signing in
- An emailed code or link, a password, a passkey, or a Google or Discord account. A second factor from an authenticator app is optional. Signups from disposable email domains are refused.
- Your account
- Your email address, and your Google or Discord id if you sign in that way. A password is stored as a hash. A username is made from the part of your email before the @, and a display name is optional.
- The Telegram mini app
- Opening our mini app in Telegram creates an account from what Telegram tells us: your Telegram id and the name on your profile. We store those two and nothing else from Telegram: no phone number, no photo and no contacts. The account has no email address, so we send it no email. The mini app sets no cookie; your session is held in memory while it is open. To have such an account deleted, write to support. A pack bought there with Telegram Stars is recorded like any other purchase, with Telegram's payment id and the Telegram id that paid.
- Each session
- Its IP address, your browser's user agent, and the approximate place the host reports for that address: city, region, country and coordinates. The city, region and country are also recorded once at signup. Your sessions are listed under Settings, Security. The email that reports a sign-in from a new device quotes that IP address.
- IP addresses in rate limits
- Sign-in, sign-up and the signup grant are counted against the IP address itself, and those counters are deleted within 3 days. The report form counts a keyed hash of the address and stores no address.
- Where you came from
- If you arrive from another site or a tagged link, a cookie keeps the referring site's host name, the campaign tags and the page you landed on for 30 days. They are saved with your account at signup. No IP address and no user agent is part of that record.
- Affiliate links
- Following one records a click: the page it led to, your browser's user agent and at most a keyed hash of your IP address, never the address. A click that leads to no signup is deleted after 37 days. One that does is kept.
- Age and consent
- Before your first swap you confirm that you are 18 or older and that everyone whose face you upload is an adult who agreed to it. The date of that confirmation is stored on your account.
- Payments
- For each purchase we keep the pack, the amount in US dollars, the invoice id, its status and the account that paid. Checkout asks for no card number, no billing name and no postal address.
- Page views
- Counted by the host without a cookie: the page path and the referrer. Pages whose address is itself a key, the affiliate portal and invitations, send nothing, and every query parameter except campaign tags is removed first. There is no other tracker and no advertising pixel.
- Logs
- One line for each request, with your account, team and organization ids and what the request did. The line we write holds no IP address, no user agent and no email address.
- Sent through Resend, and only for the account: sign-in codes and links, verification, password resets, invitations, security notices and download links. There is no marketing email.
The cookies we set
- Session
- Keeps you signed in. With several accounts signed in, there is one for each.
- Last sign-in method
- Lets the sign-in page show which method you used last time.
- Sign-in steps
- Short-lived, during a two-factor check, a passkey prompt or a Google or Discord sign-in.
- Language
- Set when the language you are reading in differs from your browser's, so the site opens in it next time.
- First visit, fsw_src
- Holds where you came from, as described above, for 30 days. Deleted at signup.
- Affiliate click, fsw_ref
- Holds the id of the click for 30 days, so a signup can be credited to the affiliate.
None of the cookies we set is for advertising.
Not answered here?
Write to faceswaping@proton.me. Support, abuse reports and requests about your data all reach that inbox.