FaceApp, CapCut, and Your Face: 3 Privacy Questions to Ask Before You Upload

Two of the best-known names in AI photo and video editing keep showing up in privacy headlines. One is a story from 2019 that resurfaces every time a filter goes viral. The other is still unfolding. Both point to the same three questions.

Every few months, a new AI filter takes over everyone's feed. You see your friends as 80-year-olds, as anime characters, as movie leads. And right on schedule, a second wave of posts follows: wait, where did my photo actually go?

I spent years building machine learning systems before I started writing about them, and I can tell you the honest answer is usually "it depends on three sentences buried in the privacy policy." Not the marketing page. Not the App Store description. The policy and the terms of service.

So instead of telling you which apps to fear, I want to give you the three questions that actually separate a careful app from a careless one, and show how they played out in two real cases.

Is my photo used to train AI models?

Your face becomes part of what the model learns, which can't really be undone.

How long is it kept?

"48 hours" and "as long as necessary" are very different promises.

Is it shared with, sold to, or licensed to anyone else?

Watch for "transferable" and "sublicensable," not just "sell."

Why face photos are different from other data

A leaked password can be changed. A leaked email address is annoying. Your face is neither. It's the same face that unlocks your phone, appears in your ID, and gets matched by recognition systems you'll never see. That's why several US states treat facial geometry as biometric data with its own rules.

The best known is Illinois's Biometric Information Privacy Act (BIPA), which requires companies to get written consent before collecting biometric identifiers and to publish a retention and destruction schedule. Texas and Washington have their own biometric laws. BIPA in particular lets individuals sue, which is why so many of the big AI photo cases end up in Illinois courts.

Keep that context in mind. It explains why "we analyze your content" lands differently when the content is your face.

Case 1: FaceApp, the classic that keeps coming back

Historical case, policy since revised

In the summer of 2019, FaceApp's aging filter went massively viral. Then people started reading the fine print, and three things worried them.

The developer was based in Russia. FaceApp was made by Wireless Lab in St. Petersburg, which raised questions about where data ended up.
Photos were processed in the cloud, not on your phone. Your image left your device to be edited.
The terms granted a perpetual, irrevocable license to user content, the kind of broad wording that sounds alarming once you actually read it.

July 2019The aging filter goes viral. US Senator Chuck Schumer asks the FBI and FTC to look into the app, and the Democratic National Committee warns campaign staff to delete it.
July 2019FaceApp responds that most images are deleted from its servers within 48 hours and that user data is not transferred to Russia.
Late 2019The FBI replies to Schumer that apps developed in Russia could pose a potential counterintelligence risk, speaking generally rather than alleging specific misuse by FaceApp.
2024FaceApp's updated policy states it uploads only the photos you choose to edit, stores them in an encrypted cache, deletes them within 24 to 48 hours, and does not sell photos to third parties.
Oct 2026A new round of viral aging filters brings a fresh wave of articles.

One fear from 2019 turned out to be overblown: people worried FaceApp was quietly uploading their entire camera roll. Security researchers who looked at the app at the time reported that it uploaded only the photo you selected. The real issues were the license wording and the lack of clarity about retention, and those are exactly what the company later spelled out.

The lesson: trust is lost in the fine print, and it takes years to win back. Even after a clearer policy, FaceApp still gets pulled into every new privacy conversation. Vague wording has a very long half-life.

Case 2: CapCut, the debate that's still live

Ongoing in 2026

CapCut, ByteDance's video editor, is a different kind of story. There's no single "scandal moment." Instead, the concern comes from the policy language itself, and that language is still there.

2023A class action is filed in the US alleging CapCut collected biometric data such as facial geometry without the consent BIPA requires. The case is still being referenced in 2026, and no final settlement has been reported.
Jan 2025CapCut briefly goes dark in the US alongside TikTok when the federal divest-or-ban law takes effect, then returns.
June 2025A terms of service update draws widespread criticism from creators for granting CapCut a broad, long-lasting license over user content, including rights connected to faces and voices.
Apr 2026CapCut's global privacy policy is updated on April 15. It still describes analyzing user content, including photos, videos, and audio, to improve its services and to train machine learning models.
Oct 2026Coverage including BusinessDay and PCMag continues to flag CapCut's data practices. Critics summarize the terms as giving the company broad, transferable, royalty-free, and perpetual commercial rights over uploaded faces and voices, potentially including AI training and marketing use, without asking again.

To be fair to CapCut: broad license language is common across content platforms, partly because a service legally needs some rights just to store, process, and display your video. The question is how far beyond that the license goes. When the wording covers sublicensing, transferring to others, commercial use, and model training, all with no end date, the gap between "what's needed to run the app" and "what the company is allowed to do" gets very wide.

The lesson: the risk isn't always a breach or a leak. Sometimes it's simply what you agreed to. A policy can be perfectly legal and still allow far more than most users expect.

Side by side: the three questions, applied

Question	FaceApp (current policy)	CapCut (current policy)	What a careful answer looks like
Used for AI training?	Not the focus of its current public commitments; its 2019 license wording was the original concern.	April 2026 policy describes analyzing content and training machine learning models.	A direct statement that your photos are not used to train or improve models.
How long is it kept?	States deletion within 24 to 48 hours from an encrypted cache.	Retention tied to service and legal needs; the content license itself is described as perpetual.	A specific time window, plus a way to delete on request.
Shared or licensed to others?	States it does not sell photos to third parties.	Terms criticized as transferable and sublicensable, with commercial use.	No sale, no sublicensing, sharing limited to service providers that process on the app's behalf.

Based on publicly available policies and reporting as of October 2026. Policies change, so check each app's current version before you decide.

Question 1, up close: is your photo used for training?

Here's why this one matters most. When a photo is used to train a model, it doesn't sit in a folder that can be deleted later. It nudges millions of numbers inside the model. Even if the original file is erased, what the model learned from it stays. That's why "we'll delete it on request" and "we don't train on it" are two separate promises, and you want both.

Companies rarely write "we train AI on your face." They write something softer. Here's how to read it:

Phrases that deserve a second look

"to improve and develop our services"
"to develop new features and technologies"
"machine learning" or "model training"
"analyze your content"

Phrases you want to see

"not used to train our models"
"used only to process your request"
"you can opt out of" (with a real toggle)

If you want to go deeper on this specific question, I walked through how training actually works in Does This App Train on Your Photos?

Question 2, up close: how long is it kept?

Good retention language has a number in it. "Deleted within 48 hours" is a promise you can hold a company to. "Retained for as long as necessary to provide the service" is a promise that means whatever the company needs it to mean.

Also look at what happens to the output. Your AI-generated result is a picture of your face too. Does the app keep it in your history? On their servers? For how long? Some apps are careful with the upload and vague about the result.

And notice the difference between storage and license. CapCut is a good example: even where files aren't kept forever, a "perpetual" license describes what the company may do with your content, which is a separate question from how long the file sits on a server.

Question 3, up close: who else gets it?

"We don't sell your data" is the sentence most apps lead with, and it's genuinely good to see. But selling isn't the only way data moves. Look for these words in the terms of service, usually in the section about content you upload:

Sublicensable: the company can grant the rights you gave it to someone else.
Transferable: the rights can move to another company, for example in a sale or merger.
Affiliates: for large companies, this can mean dozens of related businesses.
Commercial purposes: your content can be used in marketing or other money-making ways.

Sharing with service providers, like the cloud company that hosts the servers, is normal and usually fine, as long as those providers only process data on the app's behalf. The red flag is rights that let your content travel further than that.

A 5-minute check before you upload to any AI photo app

You don't need to read 6,000 words of legal text. Do this, in this order:

Open the privacy policy and search for "train." On a phone, use "Find in page." Then search "machine learning" and "improve." Read the sentences around each hit.
Search for "retain" or "delete." You're looking for a number of hours or days, not "as long as necessary."
Open the terms of service and search for "license." If you see "perpetual," "irrevocable," "sublicensable," and "transferable" together, pause.
Search for "biometric." A careful app will say whether it collects facial geometry and how it handles consent. Silence on this is itself information.
Check the date at the top. If the policy changed recently, search the app's name plus "privacy policy update" to see what changed and whether people pushed back.

If an app fails two or more of these, use it for photos you'd be comfortable seeing anywhere, like a landscape or a pet, and keep your face out of it.

Where Movcl stands

We built Movcl to be privacy-first, and the core promise is simple: the photos you upload are not used to train our AI models. Your photo is used to create the result you asked for, whether that's a face swap, an outfit change, an AI redraw, or a short video.

We'd rather you trust us because you checked than because we said so. Run the 5-minute check above on Movcl's own privacy policy too. That's exactly what it's for.

The bottom line

FaceApp and CapCut get named in these conversations for different reasons. FaceApp is a reminder of how long vague wording follows a brand, even after the policy is fixed. CapCut is a reminder that the most important privacy event isn't always a breach. Sometimes it's the "I agree" button.

Neither case means you should stop using AI photo tools. It means three questions are worth asking every time, because your face is the one piece of data you can't reset.

Frequently asked questions

Is FaceApp safe to use in 2026?

FaceApp's current published policy is much clearer than in 2019: it says it uploads only the photos you choose, deletes them within 24 to 48 hours, and doesn't sell them. Most 2026 coverage is revisiting the 2019 controversy rather than reporting a new problem. Whether it meets your comfort level is your call, but you can now check its commitments against the three questions above.

Does CapCut use my face to train AI?

CapCut's April 2026 privacy policy describes analyzing user content, including photos, videos, and audio, to improve its services and train machine learning models. Its terms have also been criticized for granting a broad, long-lasting license over uploaded content. If that matters to you, avoid uploading close-up face footage you wouldn't want reused.

Can I get my photos removed after I upload them?

Often you can request deletion of the stored file, and some state laws give you that right. But deletion doesn't reverse model training that already happened, and it doesn't cancel a license you already granted. That's why it's worth checking before you upload, not after.

What does BIPA have to do with face apps?

Illinois's Biometric Information Privacy Act requires written consent before a company collects biometric identifiers like facial geometry, and it lets individuals sue. That's why many AI photo and video apps, including CapCut, have faced BIPA class actions.

Keep reading

This article describes publicly available privacy policies, terms of service, and news reporting as of October 2026, and is for general information only. It is not legal advice. Company policies change frequently; always review the current version directly with the app provider.