Privacy policy

Your account

Your email address, and your Google or Discord id if you sign in that way. If you use a password, we store a hash of it, never the password itself.

A username, seeded from the part of your email before the @.

The city, region and country your signup came from, as reported by Vercel's edge.

For each session, its IP address, browser and approximate location, read when the session starts. We keep these to investigate abuse.

The declaration your first swap asks for — that you are 18 or older, and that everyone whose face you upload is an adult who has agreed to it — with the date you made it. It is written on your account once, is never cleared, and stays as long as the account does.

Your files

Your photos and videos, your generations, and their thumbnails. They sit in a Cloudflare R2 bucket the Company controls.

A stored file is served from a public address on our own domain. It is not listed anywhere and the address cannot be guessed, but anyone you give it to can open it without signing in, and so can anyone they pass it on to.

Photos, videos and generations are deleted 30 days after the swap finishes, or sooner if you delete them. Download what you want to keep.

The faces you save in your face library stay until you delete them.

A record of each swap: the photos and videos that went in, the options you chose, what it cost and how it ended.

To run a swap, your files go to the inference provider. It deletes them, and the generation, 24 hours after the swap finishes. We copy the generation into our own storage inside that window.

The photos, videos and faces you add are screened by an automated service before anything serves them. A flagged file is deleted and refused. One the screening could not reach is stored and looked at again over the following day, and comes down if it is flagged then. Generations are not screened; the material that went into them was.

Everyone in your team sees the team's photos and videos, face library and generations.

Payments

Checkout is in crypto through NOWPayments. We keep the invoice record: the pack, the amount in dollars, the invoice id and its status, and which account paid.

No card is involved, so we never see or store card details.

Affiliate links

If you arrive through an affiliate link, a cookie remembers that click for 30 days so a signup can be credited to the affiliate.

The click record holds the page you landed on and your browser's user agent. Your IP address is stored only as a keyed hash, and only when a hash key is configured. The address itself is never stored.

A click that never led to a signup is deleted after 37 days.

If you join the affiliate program yourself, we keep your name, your email address and the payout address you give us.

Email, cookies and logs

We send email through Resend, and only when your account needs it: sign-in codes and links, address verification, password resets, invitations, and download links. There is no marketing email.

Cookies hold your session and, if you came through an affiliate link, the click id above. Nothing else about you is kept in your browser.

Each request writes one log line with your account, team and organization ids and what the request did. We use these to debug the service and to investigate abuse.

Who else sees your data

Vercel hosts the app, and its firewall runs the rate limits on signing in, on estimates and on the report form. That check reads the IP address of the request.

Cloudflare stores the files: the bucket is Cloudflare R2, and what has been stored is served from a public address on our own domain.

The inference provider runs the swap. The moderation service screens the files. NOWPayments handles checkout. Resend delivers email. Each one gets what it needs for its job and nothing else.

Featurebase runs the public support board and the changelog. What you post there is public, and it is held by Featurebase rather than by us.

Affiliate payouts are USDC transfers on Arbitrum. A payout address, its amount and the transaction are public on that chain and permanent: neither we nor anyone else can delete them. Nothing is sent on chain for anyone who is not an affiliate.

We do not sell your data and we do not give it to anyone for advertising.

Deleting your data

Delete a swap, or one generation in it, whenever you like. The stored files go with it.

Delete a face and it leaves your face library. The record is kept so the generations made with it still read whole.

Delete your account from settings. The account is closed and your sessions and API keys are revoked at once. Your photos, videos, generations and face library are not deleted with it, so remove what you want gone first. Payment records are kept.

If other people are still members of your organization, the deletion is refused until you have handed the organization over.

For a copy of your data, or to remove something you cannot remove yourself, write to faceswaping@proton.me.

People in your photos and videos

The people whose faces appear in your photos and videos are not our users, and we have no way to reach them. You are responsible for having their consent.

If your face is in material here without your consent, write to faceswaping@proton.me and we remove it.

The service is for adults only. If we learn that an account belongs to someone under 18, we close it and delete its content.

If you report something

The form at faceswap.ing/takedown is open to anyone, and most people who use it have no account here. This section is for them.

It takes your name, your email address, the links you are reporting and what you want to say about them, plus whether you state you are the person shown and when you affirmed the report is accurate. That is all it asks for and all it keeps; it stores no IP address.

Vercel's firewall rate-limits the form, and that check reads the IP address of the request. A copy of the report is emailed to us through Resend so a person reads it.

Every report is kept: what was sent, what was decided and when. Reports are not deleted, including ones that are refused or withdrawn, because the record of what was asked and what was done about it is the whole point of keeping one.

To ask about a report you sent, write to faceswaping@proton.me with the reference you were given.