Privacy Policy

Memories shared. People protected.

Last updated: October 14, 2026

Summary: BlurKin blurs faces on your device. Signing in sends your email and password to the BlurKin account sync service. The password is stored only as a salted hash, not in plaintext. Photos, videos, and drafts in the in-app gallery, plus named-face records, are uploaded so you can sign in on another device and see the same account. We do not sell personal data. Log out ends the session on this device and keeps the cloud copy. Delete account removes the cloud copy and the data on this device. The free app may show Google AdMob ads and burn a visible BlurKin watermark into exports. Watching a rewarded ad can remove the watermark for that export. A $2.99/month subscription on Google Play or the App Store removes ads and the watermark.

1. Who we are

This policy describes how BlurKin (“the app,” “we”) handles information. BlurKin is a camera and gallery app that detects faces in photos and videos on your device, lets you blur the faces you choose, and can remember people you name so they can be recognized later on devices signed in to the same account.

“Memories shared. People protected.” is our product tagline. BlurKin does not encrypt your gallery with a user key, and it does not provide end-to-end encryption of photos or videos.

Developer contact: facephantomapp@gmail.com

2. Information the app uses

BlurKin uses the following information. A copy stays on the device, and the account sync service stores what is needed to restore the account on another device:

Email address. You enter an email to create or open an account. It is sent to the account sync service and stored with that account, and a copy is kept on the device.
Password. Join and later sign-in require a password. The sync service stores a salted PBKDF2 hash of the password and the salt. It does not store the password itself. The app does not keep the password after sign-in.
Photos and videos. Media you capture or import into the in-app gallery, including blurred copies and drafts, is stored on the device and uploaded to the account sync service. The system camera roll is not uploaded unless you import a file into the app.
Drafts. Unfinished edits, especially video jobs, may be saved in the in-app gallery so you can resume them. Those gallery drafts are included in the account sync.
Named-face records. If you name a person, the app stores a small photo of that face, the name you typed, a one-way hash of a numeric face descriptor, and which account it belongs to. The raw descriptor is discarded after hashing. These records are stored on the device and uploaded with the account.
Session. After you sign in, this device keeps a session token and restores that session until you log out in Settings, including after you close and reopen the app.
Subscription status. If you subscribe to remove ads, we cache that entitlement on the device so ads and the export watermark stay off. Google Play or the App Store is the source of truth for whether the subscription is active, depending on where the app was installed. Subscription status is not the account sync.

Face detection runs in memory on the device using the on-device Human machine-learning engine. Live camera frames are used to detect and match faces and are not uploaded. A photo or video is uploaded after it is saved in the in-app gallery, and a named face is uploaded when you save that name.

3. Information we do not collect

We do not collect:

Your password in plaintext
Photos or videos that stay only in the system camera roll and are never imported into the in-app gallery
Precise location, contacts, or microphone audio (the camera capture path does not record audio)
Payment card details (Google Play or Apple process subscription payments, not BlurKin)

We do not sell your personal information.

4. How we use information

To detect faces and let you choose which ones to blur or cover
To recognize people you have named, against the face book for the signed-in account
To keep photos, videos, drafts, and named faces with that account
To restore the same account on another device after you sign in with the same email and password
To keep you signed in on this device until you log out
To show ads to free users, to burn or skip the export watermark, and to hide ads and the watermark if you have an active ad-free subscription

Another email signed in on the same device cannot see your gallery or named faces. The hashing method is the same for every account; isolation is which records that email is allowed to load.

5. Face data

BlurKin uses on-device machine learning (the Human engine) to find faces and, if you have named people, to compare a live descriptor to stored hashes. When you name someone, the app saves a small photo of that face with your account so they appear in your Faces list on each device where you sign in. You can delete named faces in the app. That deletes them locally and from the cloud copy. Uninstalling BlurKin or clearing the app’s storage removes the on-device copy; the cloud copy remains until you delete the account.

6. Device permissions

Camera. To show a live preview, detect faces, and capture photos or videos.
Photos / storage. On iOS, Photo Library access to import media and save exports. On Android, storage or media library access for the same. The OS or browser may also prompt depending on how you run the app.

You can deny camera access in system or browser settings. The app cannot capture without that permission.

7. Ads, watermark, and purchases

If you have not subscribed, BlurKin may show banner ads using Google AdMob. Free exports can include a visible BlurKin watermark burned into the photo or video. You may watch a rewarded AdMob video to remove the watermark from that export. AdMob may use the device advertising ID and other identifiers described in Google’s Privacy Policy and AdMob’s guidance. On iOS, you can allow or deny tracking through the system App Tracking prompt and in Settings → Privacy & Security → Tracking. On Android, you can reset or opt out of ads personalization in your device Google settings.

The optional $2.99/month plan removes ads and the export watermark. Purchases are made through Google Play Billing on Android and the App Store (StoreKit) on iOS. BlurKin does not collect your card number. Cancel or change the subscription where you bought it: Play Store → Payments & subscriptions on Android, or Settings → [your name] → Subscriptions on iOS.

The $2.99/month subscription auto-renews until cancelled. Payment is charged to the Apple ID or Google account used at purchase. The subscription renews unless auto-renew is turned off at least 24 hours before the end of the current period.

8. Saving, sharing, and third parties

On first use, BlurKin may download publicly available face-detection model files from a content delivery network (jsDelivr) so the Human engine can run on your device. Those downloads do not include your photos, videos, email, or face hashes.

Ads are served by Google AdMob. Subscriptions and install distribution are handled by Google Play on Android and Apple on iOS. If you install BlurKin from Google Play, Google may process data under Google’s Privacy Policy. If you install BlurKin from the App Store, Apple may process data under Apple’s Privacy Policy.

If you save a file to Photos / your device gallery, or share it to another app (Messages, social apps, and so on), that destination’s policy applies to the file you send. That export is separate from the in-app gallery, which is stored with your account for sign-in on another device.

9. Retention and deletion

The in-app gallery, drafts, and named-face records are stored on the device and on the account sync service. Logging out in Settings ends the session on this device and keeps the cloud copy, so you can sign in again later, including on another device. Media already saved on this device also stays on the device.

To delete your BlurKin account, open the app, go to Settings, and tap Delete account. That removes your email login, in-app gallery, named faces, and drafts from this device and deletes the cloud copy. This cannot be undone from our side. You do not need to email us to finish deletion. Uninstalling BlurKin also removes remaining on-device data. A public description of this process is at https://jnuno03.github.io/blurkin-privacy/delete-account.html (the same page is also published at https://jnuno03.github.io/facephantom-privacy/delete-account.html for older App Store listings).

10. Children

BlurKin is not directed at children under 13. We do not knowingly create accounts for children under 13. Photos you take may include children. If those photos are saved in the in-app gallery, or a face is named, that data is stored with the account.

11. Security

Face detection and blurring run on your device. Gallery files and named faces saved in the app are then sent to the account sync service so the account can be restored on another device. The password is stored as a salted hash. Gallery files are not encrypted with a separate user-managed key. Protect your password, and protect access to your device with the screen lock provided by your operating system. No method of storage or transmission is completely secure.

12. Changes

We may update this policy if the app’s behavior changes. The “Last updated” date at the top will change when we do.

13. Contact

Questions about this policy: facephantomapp@gmail.com

To delete your account, use Settings → Delete account in the app. That removes the cloud copy and the data on this device. Details: Delete account.