The Camera Roll
In short, no, your camera roll is not being uploaded. Numerous independent researchers have been looking into the app and have come to the conclusion that the only thing uploaded, is the photo that you are modifying. This is a good thing, although many people may not realise that the processing is not being done on their phones, but instead up in the cloud. Which brings me to the next point.
Is it all going to Russia?
No. It is, however, heading to Amazon’s AWS cloud. Processing on a phone would not have the same speed and flexibility as leveraging Amazon’s services for the same, and as such your photos are uploaded for photos. And although the developers are based in Russia, there is no cause to say there are nefarious motives behind this. Unfortunately, given international politics, the public court of opinion does paint Russia (and by proxy its constituents) in a bad light.
“You grant FaceApp a perpetual, irrevocable, nonexclusive, royalty-free, worldwide, fully-paid, transferable sub-licensable license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, publicly perform and display your User Content and any name, username or likeness provided in connection with your User Content in all media formats and channels now known or later developed, without compensation to you. When you post or otherwise share User Content on or through our Services, you understand that your User Content and any associated information (such as your [username], location or profile photo) will be visible to the public.
You grant FaceApp consent to use the User Content, regardless of whether it includes an individual’s name, likeness, voice or persona, sufficient to indicate the individual’s identity. By using the Services, you agree that the User Content may be used for commercial purposes.”
This is a scary clause, even though further down they do state that they will not use it in a harmful way. Either way, any photo you upload may be used for whatever purpose they deem necessary – including commercial use such as endorsing things you personally may not like. This clause is one of the reasons I haven’t installed the app, although the main reason is because I pretty much couldn’t be bothered; I figure I’ll find out what I look like in a few years time anyway, and I know it will be more accurate. That aside, the reason I find some humour in the anger around this clause, is that people are posting their complaints about it on their Facebook pages. If you haven’t read the Facebook Terms of Service, allow me to bring a clause to your attention:
“Specifically, when you share, post or upload content that is covered by intellectual property rights (e.g. photos or videos) on or in connection with our Products, you grant us a non-exclusive, transferable, sub-licensable, royalty-free and worldwide licence to host, use, distribute, modify, run, copy, publicly perform or display, translate and create derivative works of your content (consistent with your privacy and application settings). This means, for example, that if you share a photo on Facebook, you give us permission to store, copy and share it with others (again, consistent with your settings) such as service providers that support our service or other Facebook Products that you use.
You can end this licence at any time by deleting your content or account.”
To be clear, you’re giving very similar rights to Facebook when you have an account, a company with a way worse track record of privacy violations than that of FaceApp (at this stage at least).
The moral of the story
You need to do your homework regarding any app that accesses your data. Be sure to read privacy policies and terms of service, and then decide for yourself as to whether you are comfortable with the service having your data. Is the concern for privacy valid? Most certainly, but no more than for other services that folks use on a regular basis. In this case, I feel that the furore generated by this is way overblown, especially when the countless controversies (and downright gross violations of privacy) Facebook has faced in the last few years have received comparably little attention.