Privacy Policy
This Privacy Policy is subject to change. The date above shows when it last changed, and Section 16 explains how updates work.
Invictan Corp. ("Invictan," "we," "our" or "us") develops and operates FaceMorphs. This privacy policy ("Policy") describes how we collect, use, store, disclose and otherwise process Personal Data in connection with the FaceMorphs mobile application (the "App"), the website at facemorphs.com (the "Site"), and the subscriptions and related services offered through them (together with the App and the Site, the "Services").
"Personal Data" means any information relating to an identified or identifiable individual, and includes "personal information" as defined under applicable U.S. state law. "Face Data" has the meaning given in Section 3.
The App is built so that Face Data is processed on your device. It leaves your device only as Harmon training uploads, which users aged 18 or over agree to on the App's consent page before using the App (Section 3), and it is never sold or shared for advertising. This Policy forms part of our Terms of Service, and any dispute about this Policy or your Personal Data is subject to the Terms of Service, including their agreement to resolve disputes by individual arbitration and their class action waiver (Section 16). If you do not agree with this Policy, please do not use the Services.
Policy topics
- Data controller and contact information
- Personal Data we process and why
- Face Data
- How we collect Personal Data
- Cookies and similar technologies
- Data sharing
- Data retention
- Your choices and controls
- Your rights
- Security measures
- International data transfers
- Eligibility and children's privacy
- Do Not Track
- Third-party services and links
- Jurisdiction-specific notices
- Updates and amendments
1. Data controller and contact information
Invictan Corp. is the controller of the Personal Data described in this Policy. For any question about this Policy or to exercise your rights, contact us at:
Invictan Corp.
Attn: Privacy
313 Front St
Lemont, IL 60439-8845
United States
Email: privacy@facemorphs.com
For help with the App or a subscription, contact support@facemorphs.com or visit facemorphs.com/support.
2. Personal Data we process and why
The table below sets out each category of data, why and how it is processed, and the lawful basis we rely on where the EU or UK General Data Protection Regulation ("GDPR") applies. Categories marked "on your device" are stored only in the App's storage on your device and are not processed by Invictan.
| Data | Purpose and operations | Lawful basis (GDPR) |
|---|---|---|
| Face Data (on your device) | Locating facial features, displaying measurements and scores, applying the edits you choose, and keeping them aligned on the live camera. Not transmitted to us, except the Harmon training uploads you separately agree to (next row). See Section 3. | Not processed by Invictan. The App asks for your explicit consent before processing on your device |
| Harmon training uploads (users aged 18 or over, with the written consent given on the App's consent page): for each Harmon scan taken with the App's camera, the front photo, its side photo if it has one, the facial landmark points the App placed on them, the photo's size and the App version, and the sex, date of birth and ethnic background you entered in the App; a random upload identifier; a keyed hash of a random key kept on your device; a security key your device creates through Apple's App Attest, so we can check that uploads come from our App; and, if you are signed in when you upload, a link between that hash and a keyed hash of your account identifier | Reviewing the uploads and, if suitable, using them to train and test Harmon, the App's facial analysis model. Never used to identify or authenticate anyone, for advertising, or to build a profile of you. See Section 3. | Explicit consent, which you can withdraw at any time (Section 8) |
| Setup information (on your device): your sex, ethnic background, date of birth and any referral code | Scoring your measurements against the reference values for your sex and background, and keeping your age and any referral code with your scans and settings. Your sex, date of birth and ethnic background are sent to us only with Harmon training uploads you consent to (Section 3). Never included in Usage Data; the referral code is never sent. | Not processed by Invictan |
| Account data: account identifier, sign-in method, email address, name (if you share it through Sign in with Apple or Google), and for Sign in with Apple, a token issued by Apple | Creating and maintaining your account, signing you in, linking a subscription to you, sending account and subscription messages, and revoking Sign in with Apple when you delete your account. For email sign-in, your account identifier is derived from your email address. If you buy on the Site from the App without logging in, we create an account for that purchase and keep the email address you enter at checkout with it. It becomes your login once you confirm it with a code. An account that never completes a purchase expires 24 hours after its last checkout and is then deleted. Acting on the notices Apple sends about Sign in with Apple (Section 4). | Performance of a contract |
| Authentication data: sign-in sessions (stored only in hashed form), the device type your phone reports (for example, "iPhone"), and one-time email codes (stored in hashed form) | Keeping you signed in on each device and verifying that you control an email address. | Performance of a contract |
| Notification data (only if you allow notifications for the App): the push address Apple gives your device for notifications from FaceMorphs, whether that address is for a test or a released version of the App, whether you turned on News and announcements, and, while you are signed in on that device, your account identifier | Telling you when a payment for a subscription bought on the Site fails, on the devices signed in to that account; and, only if you turn on News and announcements in the App (Settings > Preferences), sending you announcements. We send them through Apple's push notification service. | Performance of a contract (payment notices); consent (announcements) |
| Subscription data: whether you have Pro and until when, your Stripe customer and subscription identifiers, and for App Store subscriptions, the records Apple signs for each purchase (the plan, when it started and ends, whether it was a free trial, and whether it was refunded) | Providing Pro features on your account on any device, allowing one free trial per person, sending the emails about your subscription (Section 8: a confirmation when a subscription or free trial on the Site starts, a reminder before a free trial ends, and a reminder before each yearly renewal on the Site), and handling cancellations, refunds and support. We never receive your full card number or your Apple payment details. | Performance of a contract |
| Sales records: for each subscription event (a free trial starting, a payment, renewal being switched off or back on, a refund, a chargeback being opened, won or lost, a subscription ending), the plan, the amount, the date and the store. Each record, and the subscription it belongs to, is filed under a keyed hash of Stripe's or Apple's identifier, not the identifier itself. They do not include your name, email address or account identifier. | Understanding our revenue and how many people start, keep and end subscriptions. These come from Stripe and Apple, not from the App, so they are not Usage Data and are kept whether or not Usage Data is on. | Legitimate interests (running and accounting for our business) |
| Free-trial markers: keyed hashes of your account identifier, your email address and a card fingerprint generated by Stripe, stored with the identifier of the subscription that used the trial | Allowing one free trial per person on the Site and preventing abuse. | Legitimate interests (preventing fraud and abuse) |
| Payment-dispute records: if a payment on the Site is disputed with your bank (a chargeback) or reported by your card network as possibly fraudulent, the payment's details, your email address, when you signed in and the days your account used the App after paying; and keyed hashes of your email address and card fingerprint, kept to stop further purchases and free trials | Responding to the dispute (we send these records to Stripe, which passes them to your bank) and preventing repeat fraud. | Legitimate interests (establishing and defending legal claims; preventing fraud) |
| Usage Data: the screens and features you open, the editing tools you use and their strength, durations, whether a scan was completed, whether you have Pro, and your interactions with subscription offers; if you installed the App from an Apple Ads ad, which campaign, ad group, search keyword and country it was (the App gets an attribution token from Apple and sends it to us, and Apple tells us the ad, never who you are); linked to a random installation identifier and, if you are signed in, a keyed hash of your account identifier | Understanding how the App is used, improving it, measuring subscription offers, and learning which of our ads bring people to the App (Section 5). For ads on other apps and websites, Apple itself reports to us and to the ad network, anonymously, only that an install came from a campaign and how far it got (such as starting a trial); it never names you or your device. Usage Data never includes Face Data, photos, measurements, setup information or text you type, and is not stored with your IP address (our server logs, kept 14 days, record the IP address of every request, as described under Log and security data). | Legitimate interests (understanding and improving the App). You can object at any time by turning Usage Data off (Section 8) |
| Crash and diagnostic reports: the report iOS produces when the App crashes, freezes or exceeds a processing or storage limit (call stacks, the App and iOS versions, the device model and timing), sent only while Usage Data is on. Not linked to your account or installation, and not stored with your IP address (our 14-day server logs record it, as for every request) | Finding and fixing crashes and freezes in the App. | Legitimate interests (a working App). You can object at any time by turning Usage Data off (Section 8) |
| Log and security data: IP address, request details, and server logs, which may include your account identifier (containing your email address, for email sign-in), Stripe identifiers and error details; counters of recent requests by IP address or email address; and a security audit record of each access to stored Harmon training uploads (which of our systems or which IP address and type of device uploaded or read which upload, and when) | Operating, securing and troubleshooting the Services; limiting abuse of the Services (sign-in codes, checkout, uploads, Usage Data and crash reports) by IP address and email address; and detecting and investigating unauthorized access to Harmon training uploads. | Legitimate interests (secure and reliable Services) |
| Communications: your email address, the contents of your message and any attachments; for Report an issue, the App version, device model and iOS version the App adds to the email | Responding to your requests and providing support. You can review or remove the added details before sending. | Legitimate interests; performance of a contract where your request concerns your subscription |
| Any of the above, as needed | Complying with law, enforcing our Terms of Service, and establishing or defending legal claims. | Legal obligation; legitimate interests |
Apart from the Harmon training uploads the App requires from users aged 18 or over (Section 3), you are not required to give us any Personal Data. An account is optional for most features, but without one you cannot subscribe on the Site or keep a subscription bought there linked to you. The App cannot be used without your consent on its consent page (Section 3).
We do not use Personal Data for automated decisions that produce legal or similarly significant effects on you.
3. Face Data
"Face Data" means images of a face captured with the App's camera or selected from your photo library, and the information the App derives from them, including facial landmarks, facial geometry, a three-dimensional model of the face, measurements, ratios, scores and edits. Face Data may be considered a "biometric identifier" or "biometric information" under the laws of some jurisdictions, including the Illinois Biometric Information Privacy Act. This Section is our publicly available written policy on Face Data, including our retention schedule and guidelines for permanently destroying it, for the purposes of the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, Washington's biometric identifiers law (RCW 19.375), the Colorado Privacy Act and similar laws.
Processing on your device
Face Data is processed on your device. Invictan does not collect, capture, purchase, receive or otherwise obtain Face Data, except the Harmon training uploads described below, which users aged 18 or over agree to before using the App. We do not sell, lease or trade Face Data, and it is not used to identify or authenticate you or anyone else, for advertising, or to build a profile of you. The App is a cosmetic tool, not a medical device, and Face Data is not used to diagnose, assess or treat any health condition.
Use of information from Apple's TrueDepth camera
On iPhones with a TrueDepth front camera, the App uses that camera only to capture the standard colour image. The App does not access depth data or Face ID data, and no information from the TrueDepth API is collected by Invictan, shared with third parties or used for advertising.
Consent
Before you use the App, it asks for your consent on one page during setup, "Things you need to know before we start": to our Terms of Service and this Policy (an "I agree" switch), to the processing of Face Data on your device, and, if you are 18 or over, to Harmon training uploads (described below). Pressing "Accept and Continue" with the switch on gives that consent. The App cannot be used without it.
Retention and destruction
Face Data remains on your device until you delete the scan, look, draft or measurement it belongs to, clear it in the App's settings, or delete the App, which permanently removes the App's storage from your device. Harmon training uploads, the only Face Data Invictan holds, are retained and destroyed as described below.
Device backups
If you back up your device to iCloud or to a computer, the backup includes the App's data, including Face Data, as it does for your other apps. Those backups are controlled by you and Apple and are not accessible to Invictan.
Harmon training uploads
Your consent. If you are 18 or over, the App's consent page includes a section, "Harmon, our AI", which says, before anything leaves your device:
- what each Harmon scan sends: its front and side photos, the face points Harmon placed on them, and the sex, date of birth and background you entered, to FaceMorphs (Invictan Corp.);
- that we use them only to review, train and test Harmon, and a person on our team checks each scan first, and only good ones join Harmon's training set;
- that only scans taken with the App's camera are sent, never scans of photos from your photo library, and that you should scan only your own face;
- that photos of your face and the face points on them are biometric data, and your background is sensitive personal information;
- that they are stored encrypted with Amazon Web Services in the United States, and kept until you withdraw or delete your account, and never longer than 3 years, and that a version of Harmon already trained on them can't be un-trained;
- that they are never sold, used for ads, shared with other AI companies or used to identify you;
- that this is required to use the App at 18 and over, and that you can withdraw at any time in Settings → Face Data, which deletes your uploads, after which the App can't be used until you agree again; and
- that agreeing is your written consent, under the Illinois Biometric Information Privacy Act and similar laws, to us collecting, storing and using this data as described.
Pressing "Accept and Continue" on that page is that agreement; without it the App cannot be used and nothing is sent. Users under 18 are not shown this section, and nothing is sent from their devices. If you turn 18 after setup, Settings → Your Data → Face Data → Help us improve shows the same text with an I agree button. That page, together with this Section, is our written notice and your written release for the purposes of the Illinois Biometric Information Privacy Act and similar laws. You do not need an account. You may send scans of your own face only (Terms of Service, Section 6); if we learn that an upload shows anyone else, or anyone under 18, we delete it.
What is sent. For each Harmon scan you take with the App's camera after agreeing: the front photo, the side photo if the scan has one, and the facial landmark points the App placed on them, with the photo's size and the App version, and your sex, date of birth and ethnic background as you entered them in the App. A scan of a photo chosen from your photo library is never sent. The photos and the points on them are biometric data, and your ethnic background is sensitive personal information; we use them, like the rest of the upload, only to review and train Harmon (for example, to check that Harmon works equally well for every background). Your name, account, email address, score, referral code and anything you type are not sent. If you agreed before October 7, 2026 to an earlier consent text that did not include your sex, date of birth and background, your uploads do not include them unless you agree to the current text.
Why. To review the uploads and, if suitable, use them to train and test Harmon, the App's facial analysis model.
How they are handled. Uploads go directly from your device to private storage at Amazon Web Services in the United States, encrypted in transit and at rest with a dedicated encryption key, and are kept out of Harmon's training data until a member of our team has reviewed them. They are stored under a random identifier, not your name or account. Your device keeps a random key so that your uploads can be found and deleted when you ask; we store only a keyed hash of that key and, if you are signed in when you upload, a link between it and a keyed hash of your account identifier. Only uploads judged suitable are copied into Harmon's training data. Training runs use a copy of the training data on our team's computers, which is refreshed from our storage, without withdrawn or expired uploads, before each run.
Withdrawing. You can withdraw at any time: turn off Help us improve on the device you uploaded from, or delete your account (which covers uploads made while signed in to it and uploads from the device you delete it on). Because the App requires this consent at 18 and over, turning Help us improve off returns the App to its consent page, and it cannot be used until you agree again. We then delete your uploads from our review storage at once, and remove any copies from our training data within a day and before it is next used to train Harmon. A version of Harmon already trained using your uploads cannot be un-trained, but your uploads will not be used to train future versions. If you lose the device before turning the option off, we cannot identify your uploads to delete them early. You can also email privacy@facemorphs.com.
Retention and destruction. Uploads, and any copies of them in our training data, are kept until you withdraw (by turning Help us improve off or deleting your account) and are then permanently destroyed. They are also destroyed when they are no longer needed for the purpose above, and in any case never kept longer than 3 years after they were uploaded.
Record of your choices. So that we can show that we had your consent, we keep a record of it linked to the keyed hash of your device's key: when you agreed, which version of the consent text you agreed to and where in the App, the App version, the identifiers of the uploads sent, when you withdrew and your uploads were destroyed, and, if you were signed in, the keyed hash of your account identifier. It contains no photos, facial landmark points, names or contact details. We keep it after you withdraw or delete your account, and delete it 6 years after the last event it records (an agreement, an upload or a withdrawal).
On your account. If you are signed in, your account also keeps your answers from the consent page, so that a new device does not have to ask again: whether you confirmed you are 13 or older, or 18 or older (never your date of birth), which version of the consent page you agreed to and when, and whether Help us improve is on, with the version of its text and when. They are deleted when you delete your account. Each change is also added to the record above, under a keyed hash of your account identifier, with the same contents and retention.
4. How we collect Personal Data
- Directly from you, when you create an account, sign in, subscribe on the Site, send Harmon training uploads, or contact us.
- Automatically, when the App communicates with our servers (Usage Data, and log and security data).
- From third parties: Apple and Google provide your account identifier with them, your verified email address and, if you choose to share it, your name, when you use them to sign in. We do not request access to any other data in your Apple or Google account. Stripe provides your customer and subscription identifiers, the status and period of your subscription, and a card fingerprint when you subscribe on the Site. Apple sends us signed records of App Store purchases, renewals, cancellations and refunds, and tells us when you ask it to refund one, with the reason you gave. Apple also tells us when you stop using Sign in with Apple with FaceMorphs, turn email forwarding from your hidden Apple address off or on, or delete your Apple Account: we then sign you out everywhere and drop the token Apple issued, stop or resume sending email to that hidden address, or, if your Apple Account was deleted and Sign in with Apple was your only way to sign in, delete your account (Section 8). While Usage Data is on, Apple tells us which Apple Ads campaign, if any, led to your install, and sends us copies of its anonymous ad reports (Section 5).
5. Cookies and similar technologies
The Site does not use cookies, pixels, scripts, analytics or advertising technologies, and we do not keep access logs for the Site's pages. The only exception is the two addresses on the Site where Apple sends its ad reports (under facemorphs.com/.well-known/): our servers receive those reports and log them like any other request (Section 7). The App stores its settings, your On-Device Content and its random installation identifier in its own storage on your device.
The App does not use the advertising identifier, does not ask to track you, does not track you across apps or websites owned by other companies, and contains no third-party advertising, analytics or attribution software. It does use Apple's own privacy-preserving ad attribution, and only while Usage Data is on (Section 8):
- Apple Ads (AdServices). The App asks Apple for an attribution token and sends it to us with its random installation identifier. We send the token to Apple, which tells us which Apple Ads campaign, ad group, keyword and country, if any, led to the install. Apple never tells us who you are.
- Ads on other apps and websites (AdAttributionKit and SKAdNetwork). The App tells Apple how far the install has got (for example, that a free trial started). Apple then reports this, without naming you or your device and after a delay it chooses, to the ad network whose ad led to the install, and sends us a copy.
6. Data sharing
We share Personal Data only with the categories of recipients below. Data stored only on your device is never shared, because we never receive it. Harmon training uploads are stored for us by Amazon Web Services and are seen only by our team.
| Category | Recipient | Purpose of sharing |
|---|---|---|
| Hosting and infrastructure | Amazon Web Services, Inc. (United States) | Hosting, database storage, storage of Harmon training uploads, delivery of sign-in code emails and the emails about your subscription, logging and security, for all Personal Data we hold |
| Google LLC (Google Workspace) | Receiving and storing the emails you send us | |
| Payment processing | Stripe, Inc. | Processing subscriptions bought on the Site. We provide your account identifier and email address so your payment is linked to your account; if you buy without logging in, Stripe gives us the email address you enter at checkout instead. Stripe collects your payment details directly. If you dispute a payment, we send Stripe the Payment-dispute records described above so it can respond to your bank. Stripe keeps its customer record for us (Section 7) |
| Platform and sign-in providers | Apple Inc.; Google LLC | Sign in with Apple and App Store purchases (Apple); when you ask Apple to refund an App Store purchase and you agreed on the App's consent page, we tell Apple that the purchase was delivered, that the App offers free features, and whether a refund fits our Terms of Service (for example, that you already pay for the same plan on the Site), so Apple can decide your request (we send no usage history or face data); Apple Ads attribution, while Usage Data is on: we send Apple the attribution token from your device, and Apple reports anonymous install and conversion stages to the ad network whose ad led to the install (Section 5); Sign in with Google (Google), including Google's App Check, which the App may contact before you sign in so that Google can confirm, through Apple's App Attest, that sign-in requests come from our App; notifications we send you go through Apple's push notification service, with your device's push address and the message. When you delete your account, we ask Apple to revoke your Sign in with Apple token |
| Professional advisers | Our lawyers, accountants and auditors | Legal, financial and compliance advice, under duties of confidentiality |
| Legal and safety | Courts, regulators, law enforcement and other parties | Where we believe in good faith that disclosure is required by law or legal process, or necessary to protect the rights, property or safety of Invictan, our users or others, including to prevent fraud |
| Corporate transactions | A buyer, successor or investor | In connection with a merger, acquisition, financing, reorganization or sale of all or part of our business, subject to this Policy |
Our service providers process Personal Data on our behalf under contracts that limit their use of it. We may also share Personal Data with your consent or at your direction. We do not sell Personal Data, and we do not share it for cross-context behavioral advertising or targeted advertising.
7. Data retention
We retain Personal Data only for as long as needed for the purposes in this Policy, as follows. Stripe and Apple retain their own records of transactions as their legal obligations require.
| Data | Retention period |
|---|---|
| Face Data, setup information and other data on your device | Not held by Invictan. Remains on your device until you delete it or delete the App |
| Harmon training uploads, and any copies in our training data | Until you withdraw consent (by turning Help us improve off or deleting your account), they are no longer needed for training Harmon, or 3 years after upload, whichever comes first. A version of Harmon already trained using them cannot be un-trained |
| Record of your training consent choices (when you agreed and to which text, the upload identifiers, when you withdrew, and the keyed account reference if you were signed in) | 6 years after the last event it records, including after you withdraw or delete your account (Section 3, Record of your choices) |
| Your consent-page answers on your account (the age you confirmed as 13 or older, or 18 or older; the consent page version and when; Help us improve and when) | Until you delete your account. The record of each change: 6 years, as above |
| The links between your device key and your uploads, and between your device key and your account | Device key to uploads: until the uploads are destroyed. Device key to account: until you delete your account. A record that an upload was withdrawn, with no personal data, is kept so that it is never used again |
| App Attest security keys for a device that sends Harmon training uploads (a public key and the keyed hash of the device's key) | No fixed end date; they contain no other personal data |
| Account data | Until you delete your account, or until Apple tells us your Apple Account was deleted if Sign in with Apple was your only way to sign in. An account created for a purchase without logging in that never completes the purchase: 24 hours after its last checkout |
| Sign in with Apple token | Until you delete your account, when it is revoked with Apple and deleted, or until Apple tells us you stopped using Sign in with Apple with FaceMorphs |
| Sign-in sessions | Up to 180 days after you last used the App on that device, until you log out there (which deletes the session from our servers), or until you delete your account |
| Email sign-in codes | 10 minutes, or until first use |
| Notification data (your device's push address and its settings) | Until you turn notifications off for the App, Apple tells us the address no longer works, or 180 days after the App last sent it (it sends it again at most daily while you use the App). The link to your account goes when you log out on that device or delete your account |
| A note that a hidden Apple email address has stopped forwarding (a keyed hash of the address) | Until Apple tells us forwarding is back on |
| Subscription data | Until you delete your account. App Store purchase records that were never linked to an account: no fixed end date (they hold Apple's purchase details, not your name or email address) |
| A note that we sent you an email about a subscription (which email, for which subscription, and when) | Up to 3 years, as a record that we sent it (for example, in a payment dispute) |
| Billing records at Stripe (your email address, the payments, and our account identifier for you) | Kept by Stripe for us after you delete your account, for tax, accounting and dispute purposes, with no fixed end date |
| Usage Data | 120 days from receipt |
| Sales records | 3 years from the event, including after you delete your account (they hold no name, email address or account identifier) |
| Crash and diagnostic reports | 90 days from receipt |
| IP addresses and email addresses used to limit abuse of the Services | About two hours for most limits and up to two days for daily ones; expired records can take a few days to be removed |
| Server logs | 14 days |
| Logs of our team's review site for Harmon training uploads and its clean-up jobs (which team member opened or saved which upload, by upload identifier) | 90 days |
| Security audit records of access to stored Harmon training uploads (the IP address and type of device an upload came from, or which of our systems read it, the upload identifier and the time) | Up to 400 days, including after the upload is withdrawn or deleted |
| Database backups | Up to 35 days, on a rolling basis |
| Record of an account deletion | Retained to show that the request was completed. Filed under a keyed hash, with no name or email address |
| Free-trial markers | Retained after account deletion, solely to prevent repeat free trials, with no fixed end date |
| Payment-dispute records | The records sent to Stripe stay with Stripe and your bank under their own retention. Keyed hashes of the email address and card blocked after a dispute or fraud report are retained after account deletion, solely to prevent repeat fraud, with no fixed end date |
| Communications | As long as reasonably needed to respond and to keep a record of our response |
8. Your choices and controls
Usage Data
Usage Data is on when you first open the App. To turn it off, go to Settings → Your Data → Face Data → Share Usage Data. The App then stops sending Usage Data and crash reports, stops the ad attribution described in Section 5, and deletes any Usage Data it has not yet sent. Settings → Storage → Clear data also replaces the random installation identifier.
Harmon training uploads
To stop sending Harmon training uploads and have the ones from your device deleted, turn off Settings → Your Data → Face Data → Help us improve on that device. Settings → Storage → Clear data does the same. At 18 and over the App then returns to its consent page and cannot be used until you agree again. See Section 3.
Setup information
View or change your setup answers in Settings → Your Data → Your Details.
Data on your device
Delete individual scans, looks, drafts and measurements in the App; clear groups of them in Settings → Storage; or remove all of it by deleting the App. Settings → Your Data → Data Export creates a copy of the data the App keeps on your device.
Your account
Settings → Account → Delete account deletes your account data and all sign-in sessions from our servers, cancels any subscription bought on the Site, revokes Sign in with Apple, and removes the account reference from your Usage Data. A subscription bought on the Site ends right away, and the unused part of the period you paid for is not refunded (Terms of Service, Section 3.3). It also deletes your Harmon training uploads made while signed in to that account or from the device you delete it on (Section 3). Deleted data may remain in backups for up to 35 days, and the records listed in Section 7 as kept after deletion stay for the periods shown there. Deleting your account does not delete data on your device. App Store subscriptions must be cancelled in your Apple account settings. You can also stop the App's access to your Apple or Google account from your Apple Account or Google Account settings.
If Apple tells us that the Apple Account you used with Sign in with Apple was deleted, and that was your only way to sign in (no email address of your own that you can sign in with), nobody can sign in to the account again, so we delete it in the same way. In that case we refund the unused part of any subscription bought on the Site, in proportion to the time left (Terms of Service, Section 12.3). If you stop using Sign in with Apple with FaceMorphs, we sign you out everywhere and keep the account.
Device permissions
The App asks before it uses your camera (for the live camera and face scans), your microphone (to record sound with videos, if you turn sound on), your photo library (to display your photos and videos so you can choose one to edit, and to save your edits; with limited access the App sees only the items you select) and notifications (for reminders the App schedules on your device, such as a nudge if you haven't opened it for a few days or a monthly reminder to rescan, which are not sent to us; and for messages from us: a notice when a payment for a subscription bought on the Site fails, and announcements only if you turn on News and announcements in Settings > Preferences, which is off until you turn it on). You can change these at any time in your device's Settings, and turn News and announcements off in the App.
Emails
We send sign-in codes and messages about your account and subscription:
- when a subscription or free trial bought on the Site starts, a confirmation with the plan, its price and billing period, that it renews automatically until you cancel, when a free trial ends and what is charged then, and how to cancel;
- a reminder before a free trial ends, on the Site or, if you are signed in, in the App Store;
- for a yearly subscription bought on the Site, a reminder at least 30 days before each renewal, with the date, the price and how to cancel.
We send them to the email address on your account or, for a purchase on the Site made without logging in, the one you entered at checkout. We do not send marketing emails without your permission.
9. Your rights
Depending on where you live, you may have the right to access your Personal Data and receive a copy of it; to correct it; to delete it; to restrict or object to certain processing; to withdraw consent at any time, without affecting processing that took place before; to data portability; and to opt out of the sale or sharing of Personal Data or its use for targeted advertising or profiling (we do none of these).
Many of these rights can be exercised in the App (Section 8). For anything else, including a copy of the Personal Data our servers hold, email privacy@facemorphs.com. To protect your account, we may ask you to write from the email address associated with your account or to confirm the request in the App. You may use an authorized agent; we may ask for proof of the agent's authority and ask you to verify your identity directly. We will respond within the time required by applicable law. If we decline your request, you may appeal by replying to our decision with "Appeal" in the subject line. We will not discriminate against you for exercising any of these rights.
10. Security measures
We use administrative, technical and physical safeguards designed to protect Personal Data, including encryption in transit and at rest, storing sign-in sessions and codes only in hashed form, and limiting access to production systems to authorized personnel. Our cloud accounts require multi-factor authentication. Our team's review site for Harmon training uploads signs in with a one-time code sent to an approved team member's email address (it does not use a second factor), and we keep it switched off when no review is under way. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We limit what we hold by design: Face Data stays on your device unless you choose to send Harmon training uploads, which are encrypted with a dedicated key, kept out of Harmon's training data until reviewed, and reviewed only by our team. We store, transmit and protect Harmon training uploads using the reasonable standard of care within our industry, and in a manner at least as protective as the way we store, transmit and protect other confidential and sensitive information.
If we learn of a security incident that affects your Personal Data, including biometric data, we will notify you and the relevant authorities as the law requires.
11. International data transfers
Invictan is located in the United States, and Personal Data held on our servers is stored and processed in the United States by Amazon Web Services. If you use the Services from outside the United States, your Personal Data will be transferred to the United States, where data protection laws may differ from those in your country. Where our service providers transfer Personal Data internationally, they rely on safeguards such as the European Commission's Standard Contractual Clauses and the UK equivalents.
12. Eligibility and children's privacy
You must be at least 13 years old to use the Services, and the App asks for your date of birth during setup. The Services are not directed to children under 13, and we do not knowingly collect Personal Data from them. If you believe a child under 13 has provided us Personal Data, contact us and we will delete it. Harmon training uploads are only for users aged 18 or over; if we learn that someone under 18 has sent them, we delete them.
13. Do Not Track
Because we do not track users across third-party websites or services, the Services do not change their behavior in response to Do Not Track signals. We treat a Global Privacy Control signal as a request to opt out of the sale or sharing of Personal Data, which we do not engage in.
14. Third-party services and links
Subscriptions on the Site are completed on pages operated by Stripe, which may use its own cookies. App Store purchases and Sign in with Apple are provided by Apple, and Sign in with Google by Google. The Services may also link to websites we do not operate. Information you provide directly to these companies is governed by their own privacy policies, not this one.
15. Jurisdiction-specific notices
I. Additional notice to California residents
This notice is provided under the California Consumer Privacy Act, as amended ("CCPA"). In the preceding 12 months we have collected the following categories of personal information:
| Category | Examples | Collected |
|---|---|---|
| Identifiers | Account identifier, email address, name, installation identifier, Stripe identifiers, IP address | Yes |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Name, email address | Yes |
| Characteristics of protected classifications | Sex, date of birth, ethnic background | Only in the Harmon training uploads you consent to (Section 3). Otherwise stored only on your device |
| Commercial information | Subscription status and period, free-trial use | Yes |
| Biometric information | Facial geometry | Only the Harmon training uploads you consent to (Section 3). Otherwise processed only on your device |
| Internet or other electronic network activity | Usage Data, ad attribution results, server logs, security audit records | Yes |
| Geolocation data | Precise location | No |
| Audio, electronic or visual information | Photos, videos, recordings | Only the scan photos in Harmon training uploads you consent to. Otherwise stored only on your device |
| Professional, employment or education information | None | No |
| Inferences | Profiles of preferences or characteristics | No |
| Sensitive personal information | Account sign-in credentials (sign-in sessions); biometric information and ethnic background in Harmon training uploads | Yes. Sign-in credentials are used only to sign you in; Harmon training uploads only to train and test Harmon, with your consent |
We collect these categories from the sources in Section 4, for the purposes in Section 2, and disclose them for business purposes to the recipients in Section 6. We have not sold or shared personal information in the preceding 12 months, including that of consumers under 16 years of age. We use sensitive personal information only to sign you in and, with your consent, to train and test Harmon; you can stop the second use at any time by turning off Help us improve, which also deletes your uploads (Section 8). We do not disclose personal information to third parties for their own direct marketing purposes. California residents may exercise the rights to know, delete and correct, and the right to non-discrimination, as described in Section 9.
II. Additional notice to residents of other U.S. states
Residents of states with comprehensive privacy laws, including Colorado, Connecticut, Oregon, Texas, Utah and Virginia, may have the rights described in Section 9, including the right to appeal our decision on a request. If we deny your appeal, you may contact your state's Attorney General.
III. Additional notice to users in the EEA and the United Kingdom
The lawful bases we rely on are set out in Section 2. Where we rely on legitimate interests, you may object at any time. In addition to the rights in Section 9, you have the right to lodge a complaint with your local data protection supervisory authority.
IV. Consumer health data (Washington, Nevada and other states)
FaceMorphs is a cosmetic tool. We do not collect, use or share information about anyone's physical or mental health, health conditions, treatments or health care. Some state laws, such as Washington's My Health My Data Act and Nevada's consumer health data law, treat certain biometric data as "consumer health data." The only such data we hold is in Harmon training uploads, which we collect only with your consent, use only for the purpose described in Section 3, share only with Amazon Web Services, which stores them for us, and never sell. You can access or delete them, or withdraw your consent, as described in Sections 8 and 9, and appeal our decision on a request as described in Section 9. Our Consumer Health Data Privacy Policy sets this out on its own page.
16. Updates and amendments
We may update or change this Policy at any time. We will post the updated Policy on this page and change the "Last Modified" date above. If we make a material change, including any change that would cause Face Data to leave your device, we will notify you in the App and, where required by law, obtain your consent before the change takes effect.