Privacy Policy

Last updated: May 14, 2026

This Privacy Policy describes how FaceLab ("we", "us", or "our") collects, uses, and protects your information when you use the FaceLab mobile application (the "App"). By using the App, you agree to the practices described below.

1. Information We Collect

1.1 Photos and Face Data

FaceLab uses your device's camera and TrueDepth sensor to capture photos and 3D face mesh data so the App can analyze facial features and generate AI-powered transformations.

• Photos you capture or import are processed to provide analysis and AI edits.
• Face mesh data from ARKit is used on-device for measurement and visualization.
• Photos and face data are stored locally on your device by default. We do not retain your photos on our servers after processing.

1.2 AI Processing

To compute your facial-feature scores, photos you capture or upload are sent securely over HTTPS to OpenRouter (an API gateway at openrouter.ai), which routes the request to a multimodal AI model hosted by OpenAI. The model returns a JSON object containing numeric scores (eyes, jaw, cheekbones, etc.) and a short text summary. No AI-generated image is returned. The "Before / After" preview shown later in the app is your own captured photo, blurred and locked — not an AI transformation. Per OpenRouter's and OpenAI's published API policies, your inputs are not used to train models, and we do not retain a copy of your photo on our servers beyond the time needed to deliver the JSON result.

1.3 Usage and Diagnostic Data

We may collect non-personal information to help us improve the App, such as:

• Device model, operating system version, and app version
• Anonymous crash logs and performance metrics
• Aggregate, non-identifying feature usage (e.g., which screens are opened)

1.4 Purchase Information

In-app purchases and subscriptions are handled by Apple. We receive a transaction identifier and subscription status, but we never receive your payment card or Apple ID password.

1.5 Face Data and TrueDepth Camera

Because face data is sensitive, this section provides a complete account of how FaceLab collects, uses, stores, and retains it. Anchor: #face-data.

What face data the App collects. When you tap "Start Scan" the App uses Apple's ARKit framework on devices equipped with a TrueDepth camera to:

• Capture a still photo of your face (front-facing) and, if your scan includes a side pose, a side-profile photo.
• Generate a 3D face-mesh geometry (approximately 1,200 vertex coordinates and triangle indices produced by ARKit's ARFaceAnchor.geometry). FaceLab does not request or use Apple's face-blendshape coefficients, expression data, gaze tracking, lookAtPoint, or any identifying biometric template, and does not perform face recognition.
• If your device does not have a TrueDepth camera, you may instead take a photo with the standard camera or choose a photo from your photo library — in which case only the still photo (no 3D mesh) is processed.

Purpose of collection. The App uses face data solely to:

• Compute and display your facial-feature analysis. The still photo is sent (see below) to a multimodal AI model which returns numeric scores (0–100) for eyes, proportions, jaw, nose, cheekbones, lips, and symmetry, plus an overall score and a short text summary. No image is returned and no AI-generated face image is produced by the App.
• Show you your own 3D face mesh preview inside the App (a rotating SceneKit view, rendered locally).
• Drive the guided 5-pose scan UX. ARKit's yaw/pitch values are read locally to detect when you are centered / turned left / right / up / down so the scan can advance.
• Track your scan history locally so you can see your progress over time.

Face data is never used for advertising, identity verification, biometric authentication, training third-party AI models, or any purpose other than the features above. The "Before / After" preview shown on the final-sell screen is your own captured photo, blurred and overlaid with a lock icon — not an AI-generated transformation.

Sharing with third parties and storage location.

• The 3D face-mesh geometry is processed and stored only on your device. It is never transmitted to FaceLab's servers, OpenRouter, OpenAI, or any third party. This is verifiable by inspecting network traffic from the device.
• The still photo captured during scanning, or that you take/import, is sent over HTTPS to OpenRouter (openrouter.ai/api/v1/chat/completions), which acts as our API gateway and routes the request to a multimodal AI model hosted by OpenAI. The model returns JSON containing numeric scores and a short text summary; no image is returned. Per OpenRouter's and OpenAI's published API policies, your inputs are not used to train models. API inputs may be retained by the processor chain for up to 30 days for abuse-monitoring purposes and are then deleted. FaceLab itself retains no copy of the photo on our servers after the JSON result is returned to your device.
• The only other third-party recipients of any data are Apple (StoreKit, for in-app purchases — receives transaction identifiers, never face data), RevenueCat (subscription middleware — receives transaction identifiers and entitlement state, never face data or photos), and PostHog (anonymous product analytics — receives anonymous event names such as "paywall_viewed", never face data or photos).
• FaceLab does not sell, rent, or otherwise share face data with advertisers, data brokers, or any party other than the OpenRouter → OpenAI processor chain described above.

Retention.

• Photos and 3D mesh data on your device are retained only on your device until you delete them in-app, reset onboarding, or uninstall the App. Uninstalling the App removes all locally stored face data.
• Photos sent to the OpenRouter → OpenAI processor chain are retained by that chain for up to 30 days under its abuse-monitoring policy and are then deleted. FaceLab's own servers retain no copy of your photos or mesh data after the result is delivered.
• FaceLab does not maintain a backend database of face data. There is no FaceLab account, no FaceLab login, and no cloud-stored face profile.

Where in this policy face data is covered. Face data is described in this Section 1.5 and is also referenced in Section 1.1 (Photos and Face Data), Section 1.2 (AI Processing), Section 3 (Data Sharing), and Section 4 (Data Retention). The text quoted above is the controlling, authoritative description of FaceLab's face-data handling.

2. How We Use Your Information

• Provide the core features of the App (face analysis, AI edits, progress tracking).
• Process and deliver AI-generated images you request.
• Maintain, secure, and improve the App.
• Manage in-app purchases and subscription entitlements.
• Comply with legal obligations.

3. Data Sharing

We do not sell your personal information. We share limited data only with the following service providers, and only as necessary to operate the App:

• OpenRouter (openrouter.ai) — API gateway that receives the still photo and routes it to OpenAI's multimodal model for facial-feature scoring. Returns JSON only; no image is returned.
• OpenAI — sub-processor that runs the multimodal model used by OpenRouter for facial-feature scoring.
• Apple — for in-app purchases (StoreKit) and crash reporting. Never receives face data or photos.
• RevenueCat — subscription middleware that handles purchase verification and entitlements. Receives transaction identifiers and subscription state, never face data or photos.
• PostHog — anonymous product analytics. Receives anonymous event names (e.g. "paywall_viewed") and aggregate metrics, never face data, photos, or personally identifying information.

We may also disclose information if required to do so by law or to protect the rights, property, or safety of FaceLab, our users, or others.

4. Data Retention

Photos and face data captured in the App are stored on your device and remain there until you delete them or uninstall the App. Still photos sent to the OpenRouter → OpenAI processor chain for analysis may be retained by that chain for up to 30 days under its abuse-monitoring policy and are then deleted. FaceLab's own servers retain no copy of your photos or mesh data after the JSON result is returned. See Section 1.5 for the complete face-data retention statement.

5. Your Rights and Choices

• Access and deletion: You can delete photos, face captures, and routines from within the App at any time. Uninstalling the App removes all locally stored data.
• Camera and Photo permissions: You can revoke camera and photo library access at any time from iOS Settings.
• Tracking: FaceLab does not track you across other companies' apps and websites.
• Children: The App is not intended for children under 13 (or the age required by your jurisdiction). We do not knowingly collect data from children.

6. Security

We use industry-standard safeguards, including HTTPS for data in transit and Apple's secure storage APIs for data at rest. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. International Users

FaceLab can be used worldwide. If you use the App from outside the country where our servers and processors are located, your information may be transferred to and processed in that country.

8. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Significant changes will be communicated through the App or the App Store listing.

9. Contact