Privacy Policy

Last updated: September 23, 2026

Version: 2026-09-23

1. Overview

This Privacy Policy explains how FunnyFace collects, uses, stores, shares, and protects data when you use the FunnyFace app on iOS and Android.

FunnyFace is an AI photo generation and editing app. Because the app processes photos you upload, including photos that may show faces, we try to be specific about what is processed and why.

• Operator: Nguyen Van Tuyen, an individual developer
• Contact: support@funny-face.org

FunnyFace is offered in selected countries only, and is not offered in the European Economic Area, the United Kingdom, or Switzerland.

2. Data We Collect

2.1. Account Data

We use Firebase Authentication for sign-in with Apple, Google, and email. Account data may include:

• Firebase user ID;
• Email address;
• Email verification status;
• Sign-in method;
• Display name;
• Avatar, if you upload one;
• Account creation and update timestamps;
• Account status and information needed for support or security;
• The date, time, and document version of the acceptance you gave when creating the account.

2.2. Photos and Content You Provide

When you generate images with FunnyFace, we process:

• The photos you upload;
• The photos you keep in your Library;
• The images we generate for you;
• The style and settings you chose;
• Whether a generation succeeded or failed, and technical error information when it failed;
• Your generation and download history.

Uploaded and saved photos and generated images are kept until you delete them, or until you delete your account. See section 10.

2.3. Credits, Purchases, and Usage Data

We store what is needed to run the credit system:

• Your balance in each of the two credit wallets — credits and fast credits;
• A record of credits spent, refunded, and granted;
• Your account status.

Credits can be bought as in-app purchases. The payment is taken by Apple or by Google, never by us, and we collect no payment information of any kind — no card number, no bank details, no billing address, no name from the payment, and no advertising or purchase profile. What we store is the record of the transaction, which is what lets us deliver the credits you paid for, refuse to deliver them twice, and handle a refund:

• Which store the purchase was made in, and whether it was a live purchase or a store test purchase;
• The store's own identifier for the transaction, and the app it was made in;
• Which credit pack it was, how many credits it is worth, and its quantity;
• Its status — awaiting payment, credited, refunded, revoked, or waiting for a person to look at it — and whether the store still needs us to finalise it;
• When the store reported it, and when the credits were delivered;
• For a refund: when it took effect, how many credits it covered, how many we were able to take back, and whether the store later reversed it;
• A random identifier that links the purchase to your account, described below.

Where the store hands the app a receipt or token that our servers need in order to confirm the purchase with the store, we store it encrypted, and it is used for nothing but asking Apple or Google about that purchase. It is redacted from our logs. See section 10 for how long purchase records are kept, and section 11 for what happens to them when you delete your account.

Your purchase is linked to your account by a random identifier, not by anything that names you. When the app starts a purchase, it gives the store an opaque identifier generated for your account. It is not your user ID, not your Firebase ID, not your email address, and not derived from any of them, and it is the only thing about you that reaches Apple or Google from us. It is what tells our servers, when the store reports a payment, which account the credits belong to — and what stops a receipt from one account being used to claim credits on another.

2.4. Device and Notification Data

If you enable push notifications, we may store:

• An identifier for your device;
• A notification token, so that Firebase can deliver a message to it;
• The type of device;
• What is needed to notify you when a generation finishes.

We do not use push notifications for marketing. Push is used for generation status and app operation.

Push notifications carry no personal content. They say only that an image is ready or that one could not be created, together with whether a credit was returned. They contain no image, no prompt, no account details, and no error text from an AI provider. A notification on your lock screen reveals nothing about what you generated.

2.5. Crash Reporting

FunnyFace uses Firebase Crashlytics to detect, analyse, and fix crashes. Crash reports may include device information, operating system, app version, stack traces, crash timestamps, and related technical data.

FunnyFace shows no advertisements. No advertising identifier — the IDFA on iOS, the Advertising ID on Android — is collected or used, and nothing about you is sent to an advertising network. See section 13.

We send no marketing email and no marketing push notifications.

2.6. Technical Logs and Security Data

We collect technical logs to operate, secure, debug, and support the Service, and to prevent abuse. Logs may include your IP address, the time of a request, error information, details about your device and app version, and an internal reference to your account.

Purchase receipts, store tokens, and the identifier that links a purchase to your account are redacted before anything is logged, on every path including error output, so they do not reach a log file at all.

Technical logs are retained for up to 45 days, unless a longer period is needed to comply with the law, resolve a dispute, or investigate fraud or abuse.

2.7. Support Communications

If you contact us, we may process your email address, the content of your message, screenshots, account information, and what else is needed to answer you. We keep support communications only for as long as needed to respond, maintain a record of the request, resolve disputes, investigate abuse, or comply with law.

3. How We Use Data

We use data to:

• Generate, process, store, and return your images;
• Authenticate your account and maintain your session;
• Run the credit system, deliver credits you bought, and handle refunds;
• Notify you about generation status;
• Show you your Library, your avatar, and your generation history;
• Provide technical support;
• Detect crashes, debug, and fix errors;
• Protect our systems against spam, abuse, fraud, and unauthorised access;
• Comply with the law, respond to valid requests from competent authorities, and protect our and our users' legitimate interests.

4. Legal Basis for Processing

When you create a FunnyFace account, you confirm that you accept the Terms of Service and that you have read this Privacy Policy. We record the date, time, and document version of that acceptance, and no account exists without it.

We process the photos you upload in order to generate new images because that is the service you asked us to provide. Doing so is necessary to provide the Service and perform our agreement with you. We do not present it as a separate consent you could withhold, because the app does nothing else with a photo and withholding it would leave nothing to use; asking would suggest a choice that does not exist. The choice that does exist, every time, is whether to upload a particular photograph at all.

The rest of what we do rests on its own grounds:

• Running the Service — accounts, sessions, credits, your Library, notifications about your generations, and support — is necessary to perform our agreement with you.
• Delivering a purchase — checking with Apple or Google that a payment is real, adding the credits it bought, and applying a refund — is necessary to perform our agreement with you. Keeping the record of that sale afterwards, including after you delete your account, rests on our legal obligation to keep records of a sale and on our legitimate interest in not delivering the same purchase twice.
• Keeping the Service working and safe — crash reporting, debugging, and protection against spam, abuse, fraud, and unauthorised access — rests on our legitimate interest in operating a service that functions and is not abused.
• Meeting legal obligations — responding to valid requests from competent authorities, and keeping the records we are required to keep.

You can stop all processing of your photos by deleting your account, which removes your data as described in section 11. That is also how you end this agreement altogether.

5. AI Processing and Third-Party Providers

To generate an image, FunnyFace sends the photo you uploaded, together with the instructions describing the style you chose, to a third-party AI service provider. The provider may be a model provider, an AI gateway, or another intermediary that routes the request to model infrastructure.

We send nothing that identifies you. The request carries no account or user identifier, no email address, and no device identifier, and your file is sent under a generic name. The provider receives an image and a set of instructions, with nothing in the request that links either of them to your account.

This is a data minimisation measure, not anonymisation: a photograph of a person is itself identifying, and we do not claim otherwise.

The provider holds the image, instructions, and result on its own systems while the generation runs and while we retrieve the result. After that the result is stored on our systems. Provider retention, security, sub-processing, training use, and geographic routing are governed by that provider's own terms, policies, and configuration, not by this Privacy Policy.

Why we describe AI providers as a category rather than by name. We name the companies behind our stable infrastructure, such as Firebase, Cloudflare, Google, and Apple, because those choices rarely change. The set of AI providers we use may change over time for operational quality, capacity, resilience, pricing, and availability. A provider may also route the request to model providers or infrastructure of its own. For that reason, we do not publish a fixed provider list in this document.

We maintain internal records of the AI providers we enable, the date we reviewed their published terms or policies, and the settings we use where those settings affect retention or model training. We may disclose provider information where required by law, by a competent authority, by a store review process, or where needed to resolve a specific user request.

We are an individual developer and we generally use the standard terms made available by AI providers or intermediaries. We do not usually have individually negotiated data processing agreements with them. We take a provider's stated data practices into account when we choose one, and where a provider offers a setting that limits retention or the use of submitted data for model training, we enable it.

We do not describe, promise, or guarantee any provider's data practices on its behalf, because we are not in a position to enforce them. What we commit to is the part we control: what leaves our systems, described above; the provider category and purpose; and the operational records we keep internally. The part that remains entirely yours is whether to upload a particular photograph at all. If you have questions about any of this, contact support@funny-face.org.

6. Facial Images and Biometric Data

Many FunnyFace users upload photos of themselves or of people they know, so we want to be precise about what we do and do not do with a face.

FunnyFace does not perform facial recognition. We do not detect, extract, measure, or store facial features, face templates, embeddings, or any other biometric identifier. We do not match one photo against another, we do not group photos by the person shown in them, and nothing in our system can determine that two uploads show the same person.

Our own handling of an image is limited to preparing it for storage. Before a photo you upload is stored, we strip the metadata embedded in the file — EXIF, XMP, IPTC, and comments — which is where a photo taken on a phone carries the GPS coordinates of the place it was taken, the capture time, and the device model. This is done without decoding or re-encoding the picture, so the image itself is unchanged, and the metadata is gone before the photo is sent to an AI provider. Everything else is the generative transformation performed by the AI provider, which returns a new image and no analysis of the original.

We treat your photos as personal data. We do not process them as biometric data, because we do not derive biometric information from them. If that ever changes, we will update this policy and ask for your consent before the change takes effect.

7. How We Share Data

We do not sell your photos. We share data with the following categories of third party, only to the extent necessary:

• Firebase and Google: authentication, push notifications, crash reporting, and related infrastructure.
• Apple and Google: identity providers, when you sign in with an Apple or Google account; and, as the operators of the App Store and Google Play, the parties that take payment for an in-app purchase and tell our servers whether that purchase is real, still pending, or refunded. What we send them about you is the random purchase identifier described in section 2.3.
• Cloudflare R2: image storage in production.
• Our hosting provider in Vietnam: running the servers that FunnyFace operates on.
• Third-party AI service providers: image processing and generation, as described in section 5.
• Competent authorities or other relevant parties: where required by law, or where necessary to protect legitimate interests, investigate violations, prevent fraud or abuse, or protect user safety.

We share no data for advertising. FunnyFace shows no advertisements, so there is no advertising network in the list above, and there is no targeted advertising for a privacy law to treat as a "sale", "sharing", or "targeted advertising".

8. Staff and Administrative Access

FunnyFace has an internal administration tool used to operate the Service and answer support requests. Through it, the developer can see your account information — including your email address and display name — along with records about your generations: the style you chose, the original name of a file you uploaded, when it ran and whether it succeeded, your credit history, and how much storage your account uses. It also reaches the purchase records described in section 2.3, which is how a support request about a purchase that did not arrive gets answered.

The administration tool does not display the content of your photos. It works with records and summaries; it gives no view of the images you upload or generate. It does not display purchase receipts or store tokens either: those are stored encrypted and are redacted from anything the tool returns. Support can ask our servers to re-check a purchase with the store; it cannot choose an amount of credits to grant, and re-checking the same purchase twice delivers it once.

Access is limited to the developer operating the Service and is used only for operation, support, security, and abuse investigation.

9. Storage Location and International Processing

The servers that run FunnyFace are located in Vietnam. Some data and services are handled by Firebase and Google, Cloudflare R2, Apple, and third-party AI service providers. Those providers may process or store data in a number of countries and regions, depending on their configuration and infrastructure. A purchase is processed by Apple or Google on their own infrastructure, wherever that is, under their terms; we query it from Vietnam.

By using FunnyFace, you understand that data may be processed outside the country or region where you live.

Where cross-border transfer requirements apply, we keep the records and review materials needed for the transfer to the extent required by applicable law.

10. Retention

We keep data for as long as needed for the purposes described in this policy. Currently:

• Uploaded photos, saved photos, and generated images are kept until you delete them or delete your account. No automatic expiry is applied to them today. We are able to switch on an expiry period for generated images; it is currently switched off, and if we switch it on we will update this policy and notify users before it takes effect.
• Credits and fast credits do not expire. What you hold stays until you spend it, whether they were granted to you or bought.
• Records of a purchase and of a refund are kept for 10 years from the transaction. We chose that period because Vietnamese accounting law sets it for records of a sale, and because it is longer than any refund, chargeback, or dispute window a store applies. They survive the deletion of your account, and section 11 describes what they still say about you once it is gone. The encrypted receipt or store token stored with such a record is kept for as long as the record is.
• The random identifier that links purchases to an account is kept indefinitely, and is never issued to another account. Once your account is deleted, it names nobody: it is a random value with your account no longer attached to it, and keeping it is what stops an old store receipt being used to claim credits on a new account. Section 11 describes this.
• Technical logs are retained for up to 45 days.
• Some data may persist for a limited period in backups, or where necessary for security, fraud prevention, dispute resolution, or legal compliance.

11. Deleting Data and Deleting Your Account

You can delete your account from the app's settings. Deleting your account requires a recent sign-in; if you have not signed in recently, the app will ask you to sign in again first.

When you delete your account, we permanently delete the account and the data attached to it in our systems, including:

• The photos you uploaded and saved;
• The images we generated for you;
• Your avatar;
• Your generation and download history;
• Your devices and their notification tokens;
• Your credit balances and credit history.

Account deletion cannot be undone. If you signed in with Apple, the app may require you to revoke your Apple token first.

Two things do not disappear at the moment you press delete, and we state both explicitly:

• Your Firebase sign-in record is deleted on a best-effort basis. Your account in our system is removed first, which ends access immediately. If the Firebase deletion then fails, we log it; the leftover record is inert, and signing in again produces a clean, empty registration.
• The records of purchases you paid for are kept, together with any refunds, for the period in section 10. They are the record of a sale, and they are also what stops the same store receipt being presented again on a new account to claim the credits a second time. What they stop holding is any link to you. The random identifier they point at is detached from your account at the moment of deletion — it keeps existing so that it can never be reissued or claimed, but it names no account from then on, and nothing in our systems connects it back to your email address, your Firebase ID, or the account you deleted. Apple or Google still hold their own record of the payment, under their own policies; that is not ours to delete.

A purchase whose payment is reported to us after the account is gone is not delivered to anyone and not reassigned. It is recorded against the identifier that no longer names an account, and a person looks at it, which is how a payment made just before a deletion gets refunded rather than silently kept.

We no longer keep any value derived from your email address after deletion. An earlier version of this policy described a hash retained for 48 hours to stop a daily credit allowance being collected twice; there is no daily allowance any more, so there is nothing for it to protect and it is not kept.

You can also delete individual images in the app. If we cannot delete a stored image, the whole deletion fails rather than half-succeeding — so you are never left with a record saying an image is gone while the image itself survives.

12. Your Rights

Depending on where you live, you may have the right to:

• Ask what data we hold about you;
• Ask to access, correct, or update it;
• Ask us to delete your data or your account;
• Object to or restrict certain processing;
• Withdraw consent where processing is based on it;
• Ask for an export of your data, within what is technically reasonable.

In the app you can edit your display name, upload or remove your avatar, and delete your account. For access, export, correction requests, or any other question, contact support@funny-face.org.

We will respond as soon as reasonably possible. If you are not satisfied with our response, you may complain to the competent data protection authority where you live. In Vietnam, personal data protection is administered by the Ministry of Public Security.

13. Advertising

FunnyFace shows no advertisements. This version of the app contains no advertising and no advertising software. We do not collect or use your advertising identifier — the IDFA on iOS, the Advertising ID on Android — for any purpose, nothing about you is sent to an advertising network, and no profile of your interests is built from your use of FunnyFace.

There is therefore nothing here to opt out of. Because we do not use it, no App Tracking Transparency prompt is shown on iOS, and your Android Advertising ID settings make no difference to what FunnyFace collects.

If we introduce advertising in a future version, we will update this Privacy Policy first, describe what would be collected and what choices you would have, and ask for any permission the law or your device requires before a single advertisement is shown.

14. Security

We apply reasonable technical and organisational measures to protect data, including Firebase authentication, restricted access, storage through established infrastructure providers, and appropriate operational practices. Access to your images is gated by the signed-in account that owns them. For downloads and image display, we may issue short-lived links; anyone who has one of those links can access the file until the link expires, so do not share download links with people you do not trust.

No system is perfectly secure. Keep your device, your Apple, Google, or email account, and your sign-in credentials protected, and do not share them.

15. Data Breach Notification

If personal data we hold is lost, disclosed, altered, or accessed without authorisation, and that is likely to affect you, we will:

• Act to contain the incident and limit its effects as soon as we become aware of it;
• Notify the competent authority where the law requires it, within the period the law sets. Where Vietnamese personal data protection law applies and a notification is required, we aim to notify within 72 hours of becoming aware of the incident, or explain the reason for any delay;
• Notify affected users without undue delay, in the app or by email, describing what happened, what data was involved, what we have done, and what you can do;
• Record the incident and what we changed as a result.

FunnyFace is operated by one person, so we would rather tell you plainly what we know when we know it than delay a notice until every detail is settled.

16. Children

FunnyFace is for people aged 16 and over. It is not designed for and not directed at anyone under 16, and we do not knowingly collect personal data from anyone under 16.

If you become aware that someone under 16 has created an account, contact support@funny-face.org. If we confirm it, we delete the account and its data, in the same way as described in section 11, and we do so without requiring the account holder to act.

17. Third-Party Services and Links

FunnyFace integrates with or links to third-party services including Apple, Google, Firebase, Cloudflare, and third-party AI service providers. Your use of those services may be governed by their own privacy policies and terms.

We encourage you to read them, particularly when you sign in or use AI generation features.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Each version carries the version identifier shown at the top of this document.

Where a change is significant, we will try to notify you in the app or by another appropriate means. If a change requires your consent or a new acceptance under applicable law, we will ask for it before the change applies to you. The last updated date is always shown at the top.

19. Contact

Questions, requests, or complaints about privacy, and support requests:

• Email: support@funny-face.org