Is Face Swap Safe? I Actually Read the Privacy Policies of 5 Popular Apps
Not skimmed. Not "Ctrl+F and done." Actually read.
Five tabs, one very long Saturday afternoon, and a lot more variation than I expected.
Key takeaways
- I read the actual privacy policies of five popular face swap apps, using the same three-point framework — training language, retention, third-party sharing — that we've written about on this blog before, instead of skimming or just trusting the app's marketing.
- The results varied a lot more than I expected. A couple of policies were specific and reassuring about not using photos for training. A couple more were vaguer, leaning on broad phrases like "improve our services" without ruling training out directly.
- Popularity and how long an app had been around didn't reliably predict how good or specific its policy was — a newer, less established app had one of the clearer policies I read, and a bigger, more recognizable name had one of the vaguer ones.
Every time face swap apps come up, someone in the comments asks "but is it actually safe?" and someone else says "just read the privacy policy" like that settles it — except almost nobody actually does. So I picked five popular face swap or AI photo apps I could find, including Movcl, and actually read each one's privacy policy start to finish, checking for the same three things every time.
What I was actually looking for
I didn't want to just skim for scary words. I used a specific framework — the same one laid out in an earlier piece on this blog about reading privacy policies — and checked each app against the same three questions:
- Training language: does the policy say your photos are used only to generate your requested output, or does it reserve broader rights to "improve," "train," or "develop" its models with your content?
- Retention: is there a specific stated time period for how long your photos and results are kept, or just a vague "as long as necessary"?
- Third-party sharing: is sharing limited to narrowly scoped service providers, or does it extend to broader, less specific "third parties"?
What I actually found
To keep this fair and not turn into a "here's why App X is bad" callout post based on my own possibly-out-of-date reading, I'm not naming the other four directly — policies change, and I don't want anyone making a decision based on a snapshot from one Saturday afternoon months from now. What I can share is the pattern:
| App | Training language | Retention | Third-party sharing |
|---|---|---|---|
| App A (a big, well-known name) | Vague — "improve our services," no direct mention of training | "As long as necessary to provide the service" | Broad — includes unspecified "third parties" and affiliates |
| App B (newer, went viral on social recently) | Specific — states content isn't used to train models | Specific number of days after account deletion | Limited to named categories of service providers |
| App C (mid-size, been around a while) | Vague — mentions "product development" broadly | Vague — no specific period stated | Broad, including marketing partners |
| App D (free, ad-supported) | Vague — training not mentioned at all either way | Vague | Broad — explicitly includes advertising partners |
| Movcl | Specific — content is not used for model training | Specific stated period, with an in-app deletion option | Limited to named service providers for specific technical tasks |
The pattern that actually surprised me: I'd assumed the biggest, most recognizable app would have the tightest, most lawyer-reviewed policy, and it was actually one of the vaguer ones. Meanwhile, one of the newer apps — the kind I'd have guessed was moving too fast to think hard about privacy language — had one of the more specific, reassuring policies of the five. Popularity really didn't predict much here.
The app I trusted most going in wasn't the one that earned it once I actually read the document.
The retention question was the messiest one
Training language, once I knew what to look for, was actually the easiest thing to check — it's either specific or it isn't. Retention was consistently the vaguest section across the apps I read. Three of the five leaned on some version of "as long as necessary to provide our services," which is functionally a non-answer — necessary according to who, for how long. Only two gave me an actual number I could hold them to, and Movcl's was one of them, with a specific deletion option in account settings rather than just a policy sentence.
What this actually means if you're deciding between apps
Honestly, my biggest takeaway wasn't "app X bad, app Y good" — it was that the exercise itself is worth doing yourself, at least once, for whatever app you're about to hand a photo of your face to. It took about fifteen minutes per app, which is less time than most people spend picking a template. If you want the shortcut version of what to search for, the three-point breakdown in our piece on AI photo app permissions and privacy covers the biometric-data side of this too, which is worth reading alongside the policy itself.
Frequently asked questions
Is it safe to use face swap apps in general?
It depends on the specific app's actual policy, not the category as a whole. Some apps are explicit that your photos are only used to generate your requested output, while others reserve broader rights to use your content for training or share it with third parties. The category itself isn't inherently unsafe, but the individual apps vary a lot.
What's the fastest way to check if a face swap app is trustworthy with your photos?
Search the app's privacy policy for language about training, how long they retain your content, and who they share it with — the same three things covered in an earlier piece on this blog about reading privacy policies. It takes a few minutes and tells you more than the app's marketing copy will.
Do older, more established apps have better privacy policies than newer viral ones?
Not necessarily — in my own reading, how long an app had been around didn't reliably predict how specific or reassuring its policy language was. It's worth checking each app individually rather than assuming age or popularity is a proxy for trustworthiness.