Privacy Policy

Last Updated: October 11, 2025

Effective Date: October 11, 2025

Curiosity Network Technology (Fuyang) Co., Ltd ("we," "us," or "our") respects and protects your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information, including face data, when you use our AI Face Swap application (the "App").

1. Face Data Collection and Usage

1.1 What Face Data We Collect

When you use the face swap feature, we collect:

• Complete photographs containing facial images that you upload for face fusion processing
• Template images (model photos) that you select or upload for face swapping
• Processed result images generated by the face fusion feature

1.2 How We Use Face Data

Your face data (photographs containing faces) is used exclusively for the following purposes:

• Face Fusion Processing: To create face swap effects by merging facial features from your uploaded photo with template images
• Providing Service Results: To generate and display the processed face swap images to you
• History Records (Optional): To save your face swap results in your history if you choose to do so
• Service Improvement: To diagnose technical issues and improve service quality (using anonymized data only)

Entertainment Purpose Only: Our App performs face detection and face fusion for entertainment purposes only. We do NOT perform facial recognition or identity verification. This means:

• We do not identify who you are based on your face
• We do not compare your face against a database of known individuals
• We do not use your face for authentication or security purposes
• Your photos are only used to create face swap effects for your entertainment

1.3 Face Data Processing Workflow

Here's exactly what happens to your photos during the face swap process:

1. Upload (Client-Side): You select a photo from your device. The photo is encoded and prepared for processing.
2. Temporary Server Processing (7-14 seconds): Your photo is sent to our secure server (Supabase Edge Function) via HTTPS encryption. The server holds the photo in memory only, without storing it to disk or database.
3. Third-Party API Call: The server forwards your photo to Tencent Cloud Face Fusion API for processing. The photo is transmitted as base64-encoded data over HTTPS.
4. Result Return: The processed face swap image is returned to you and displayed in the App.
5. Memory Release: After processing completes (typically 7-14 seconds), the temporary photo data in server memory is automatically released and permanently deleted.
6. Optional History Storage: If you choose to save the result, the original photos and processed result are stored in your history records (see Section 1.5 below).

1.4 Third-Party Service Provider: Tencent Cloud Face Fusion API

We use Tencent Cloud's Face Fusion API as a third-party service to process face swap effects. When you use this feature:

• Your photos are sent to Tencent Cloud via HTTPS for face fusion processing
• Tencent Cloud processes the face fusion and returns the result image
• According to Tencent Cloud's publicly available privacy policy:
  • Uploaded materials are retained as long as they exist in the user's account within Tencent Cloud's management console
  • Data is deleted immediately when users remove uploaded materials
  • Log data is retained for 7 days
  • Content security checks may be performed on uploaded images to prevent misuse

Important Clarification: The retention policy described in Tencent Cloud's privacy policy primarily applies to their "Material Management" console feature. For API calls (which is how our App uses their service), photos are processed in real-time. We do not control how Tencent Cloud processes data during API calls, but based on standard cloud service practices, photos are typically processed in memory and not permanently stored.

Data Storage Location: Tencent Cloud operates data centers globally. We do not control the specific geographic location where your photos are processed during API calls.

For detailed information about Tencent Cloud's data handling practices, please refer to their Privacy Policy:
https://www.tencentcloud.com/document/product/1239/64276

1.5 Face Data Storage and Retention

Here's where and how long your face data is stored:

Data Type	Storage Location	Retention Period	User Control
Photos during processing	Server memory (Supabase Edge Function)	7-14 seconds (processing time)	N/A (automatically deleted)
History records - Original photos	Local device + Cloud (Supabase, for paid users)	Until you delete	You can delete anytime
History records - Processed results	Local device + Cloud (Supabase, for paid users)	Until you delete	You can delete anytime
Server logs	Supabase	7 days	N/A (automatically deleted)

1.6 Face Data Security Measures

We implement strict security measures to protect your face data:

• Encryption in Transit: All photo data is transmitted using HTTPS encryption (TLS 1.2+)
• Encryption at Rest: Photos stored in your history are encrypted using industry-standard encryption provided by Supabase
• Access Control: Only you can access your history records through authenticated sessions
• No Permanent Server Storage During Processing: Photos are processed in memory only and never written to disk during the face fusion process
• No Photo Logging: Our server logs do NOT contain base64-encoded photo data. Logs only contain error messages and processing metadata
• Secure Third-Party: Tencent Cloud Face Fusion API uses secure HTTPS endpoints and industry-standard security practices

2. Other Information We Collect

2.1 Account Information

When you sign in with Apple:

• Apple ID information: Name and email address associated with your Apple ID (or a private relay email if you choose to hide your email)
• User identifier: A unique identifier provided by Apple for authentication purposes

2.2 Usage and Device Information

• Device information: Device model, operating system version, unique device identifiers
• Usage data: App usage statistics, feature usage frequency, error logs
• Subscription information: App Store in-app purchase transaction records (for verifying subscription status)
• Quota records: Your remaining usage quota (number of free or paid face swaps available)

2.3 User-Provided Information

• Feedback: Comments, suggestions, or bug reports you submit through the App

3. How We Share Information

3.1 Third-Party Services We Use

The App uses the following third-party services that may process your data:

• Apple Sign In: For user authentication (managed by Apple)
• App Store In-App Purchase: For subscription management (managed by Apple)
• Supabase: For data storage, synchronization, and server-side processing
• Tencent Cloud Face Fusion API: For face swap processing (see Section 1.4 above for details)

3.2 We Do NOT Sell or Share Your Data

We commit to the following:

• No Selling: We will never sell your personal information or face data to third parties
• No Advertising: We do not use your face data for advertising purposes or share it with advertising networks
• No Training: We do not use your photos to train AI models or improve facial recognition algorithms
• Limited Sharing: We only share data with third-party service providers as necessary to provide the App's core features (face swap processing), and only under strict confidentiality agreements

3.3 Legal Disclosures

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency), including to:

• Comply with legal obligations
• Protect and defend our rights or property
• Prevent or investigate possible wrongdoing
• Protect the personal safety of users or the public

4. Your Privacy Rights

4.1 Access and Control Your Data

You have the following rights regarding your data:

• Access: View the personal information we hold about you
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal information and face data (see Section 4.2 below)
• Data Portability: Obtain a copy of your data in a commonly used format
• Restriction: Restrict how we process your information
• Objection: Object to certain data processing activities

4.2 How to Delete Your Face Data

You can delete your face data at any time:

Option 1: Delete Individual History Items

1. Open the App and go to your History section
2. Swipe left on any history item and tap "Delete"
3. This will permanently delete the original photos and processed results for that item from both your device and cloud storage

Option 2: Delete All History

1. Go to Profile > Settings
2. Tap "Clear All History"
3. Confirm deletion
4. This will permanently delete all your history records containing face data

Option 3: Delete Your Account

1. Go to Profile > Settings
2. Tap "Delete Account"
3. Confirm deletion
4. When you delete your account:
   • Immediately deleted: All face data (photos in history records), user profile, usage records, and quota information
   • Retained for up to 30 days for legal purposes: Subscription transaction records (for refund and dispute resolution), after which they will be permanently deleted

4.3 How to Exercise Your Rights

To exercise any of your privacy rights, please contact us at hqxkj@hqxwl.cn. We will respond to your request within 30 days.

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: All data transmission uses HTTPS (TLS 1.2+). Data at rest is encrypted using Supabase's encryption
• Authentication: Access to your data requires secure authentication via Apple Sign In
• Minimal Storage: We minimize data storage by processing photos in memory only and deleting them after processing completes
• Regular Security Audits: We conduct regular security assessments and vulnerability scans
• Access Controls: Strict access controls limit who can access user data within our organization

6. International Data Transfers

Your information may be transferred to and stored on servers located outside of your country or region. We take appropriate measures to ensure that your information receives adequate protection and complies with this Privacy Policy.

• Supabase: Uses data centers in multiple regions worldwide
• Tencent Cloud: Operates data centers globally (specific locations not disclosed for API calls)

7. Children's Privacy

This App is rated 17+ and is not intended for children under 17 years of age. We do not knowingly collect face data or personal information from children under 17.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at hqxkj@hqxwl.cn, and we will take steps to delete such information.

8. Biometric Data Compliance

8.1 California Residents (CCPA)

If you are a California resident, you have additional privacy rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request information about the categories and specific pieces of personal information we collect, use, and share
• Right to Delete: Request deletion of your personal information (with certain exceptions)
• Right to Opt-Out: Opt out of the sale of your personal information (we do NOT sell your information)
• Right to Non-Discrimination: You will not be discriminated against for exercising your privacy rights

Face Data as Biometric Information: Under CCPA, face data may be considered "biometric information." We collect photographs containing faces solely for the purpose of providing face swap entertainment features. We do NOT use face data for identity verification or facial recognition purposes.

8.2 Illinois Residents (BIPA)

If you are an Illinois resident, the Biometric Information Privacy Act (BIPA) applies. Here's how we comply:

• Informed Consent: By using the face swap feature, you consent to our collection and use of face data as described in this Privacy Policy
• Purpose and Duration: We collect face data solely for face swap processing and retain it as described in Section 1.5
• No Sale or Profit: We do NOT sell, lease, or trade your face data
• Security: We use reasonable security measures to protect your face data (see Section 5)
• Retention Schedule: Photos processed temporarily are deleted after 7-14 seconds. History records are retained until you delete them. Server logs are retained for 7 days.

8.3 European Residents (GDPR)

If you are located in the European Economic Area (EEA), the General Data Protection Regulation (GDPR) applies. You have the following rights:

• Access, Correction, Deletion: Access, correct, or delete your personal data
• Restriction or Objection: Restrict or object to data processing
• Data Portability: Receive your data in a structured, commonly used format
• Withdraw Consent: Withdraw consent at any time (without affecting the lawfulness of processing before withdrawal)
• Lodge a Complaint: File a complaint with a supervisory authority

Legal Basis for Processing Face Data:

• Consent: You provide explicit consent by uploading photos and using the face swap feature
• Contract Performance: Processing is necessary to provide the face swap service you requested

9. Cookies and Tracking Technologies

This App does NOT use cookies. We only use necessary local storage to save your login state and app settings on your device. No tracking technologies are used to monitor your behavior outside of the App.

10. Updates to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by:

• Displaying a prominent notice within the App
• Updating the "Last Updated" date at the top of this policy

Your continued use of the App after such changes constitutes your acceptance of the updated Privacy Policy.

11. Data Retention Summary

Here's a summary of how long we retain different types of data:

• Photos during processing: 7-14 seconds (memory only, then automatically deleted)
• History records (photos): Until you delete them
• Account information: Until you delete your account
• Server logs: 7 days
• Subscription records: Until subscription expires + 1 year (for refunds and disputes)
• After account deletion: Most data deleted immediately, subscription records retained for up to 30 days for legal purposes