Privacy Policy

The moments you love. The privacy they deserve.

Last updated: September 28, 2026

Summary: Smudge blurs faces on your device. We do not operate a cloud backend for this app, and we do not sell personal data. Photos, videos, drafts, named-face records, and the email you use to sign in stay in local storage on this device (IndexedDB and related app storage) unless you save or share a file yourself. The free app may show Google AdMob ads and burn a visible Smudge watermark into exports. Watching a rewarded ad can remove the watermark for that export. A $2.99/month subscription on Google Play or the App Store removes ads and the watermark.

1. Who we are

This policy describes how Smudge (“the app,” “we”) handles information. Smudge is a camera and gallery app that detects faces in photos and videos on your device, lets you blur the faces you choose, and can remember people you name so they can be recognized later on the same device.

“The moments you love. The privacy they deserve.” is our product tagline. “Secure Memories Using Data Guarding & Encryption” is the expansion of the Smudge name — it is marketing, not a description of how files are stored. Smudge does not encrypt your gallery with a user key, and it does not provide end-to-end encryption of photos or videos.

Developer contact: facephantomapp@gmail.com

2. Information the app uses

Smudge may use the following information, stored locally on your device:

Email address. You enter an email to keep this device’s gallery and named faces tied to that sign-in. It is stored on the device (IndexedDB and local storage). It is not sent to a Smudge server — we do not operate an application server for accounts.
Photos and videos. Media you capture or import, including blurred exports you save in the in-app gallery, is stored on the device as local files/blobs.
Drafts. Unfinished edits, especially video jobs, may be saved in the in-app gallery as drafts so you can resume them later. Drafts stay on this device until you finish, delete them, clear app storage, or uninstall.
Named-face records. If you name a person, the app stores a small photo of that face, the name you typed, a one-way hash of a numeric face descriptor, and which account it belongs to. The raw descriptor is discarded after hashing. These records stay on this device.
Session state. After you sign in, the app restores that local session on this device until you log out.
Subscription status. If you subscribe to remove ads, we cache that entitlement on the device so ads and the export watermark stay off. Google Play or the App Store is the source of truth for whether the subscription is active, depending on where the app was installed.

Face detection runs in memory on the device using the on-device Human machine-learning engine. Live camera frames and temporary face descriptors are used to detect and match faces and are not uploaded to us.

3. Information we do not collect

We do not collect, on Smudge servers:

Your original, draft, or blurred photos or videos
Face images, face embeddings, or face hashes
Precise location, contacts, or microphone audio (the camera capture path does not record audio)
Payment card details (Google Play or Apple process subscription payments, not Smudge)

We do not sell your personal information.

4. How we use information

To detect faces and let you choose which ones to blur or cover
To recognize people you have named, only against the face book for the email signed in on this device
To keep photos, videos, drafts, and named faces for that email on this device
To restore your local session until you log out
To show ads to free users, to burn or skip the export watermark, and to hide ads and the watermark if you have an active ad-free subscription

Another email signed in on the same device cannot see your gallery or named faces. The hashing method is the same for every account; isolation is which records that email is allowed to load.

5. Face data

Smudge uses on-device machine learning (the Human engine) to find faces and, if you have named people, to compare a live descriptor to stored hashes. When you name someone, the app also saves a small photo of that face on this device so they appear in your Faces list. You can delete named faces in the app. Uninstalling Smudge or clearing the app’s storage in your device settings removes remaining local data.

6. Device permissions

Camera. To show a live preview, detect faces, and capture photos or videos.
Photos / storage. On iOS, Photo Library access to import media and save exports. On Android, storage or media library access for the same. The OS or browser may also prompt depending on how you run the app.

You can deny camera access in system or browser settings. The app cannot capture without that permission.

7. Ads, watermark, and purchases

If you have not subscribed, Smudge may show banner ads using Google AdMob. Free exports can include a visible Smudge watermark burned into the photo or video. You may watch a rewarded AdMob video to remove the watermark from that export. AdMob may use the device advertising ID and other identifiers described in Google’s Privacy Policy and AdMob’s guidance. On iOS, you can allow or deny tracking through the system App Tracking prompt and in Settings → Privacy & Security → Tracking. On Android, you can reset or opt out of ads personalization in your device Google settings.

The optional $2.99/month plan removes ads and the export watermark. Purchases are made through Google Play Billing on Android and the App Store (StoreKit) on iOS. Smudge does not collect your card number. Cancel or change the subscription where you bought it: Play Store → Payments & subscriptions on Android, or Settings → [your name] → Subscriptions on iOS.

The $2.99/month subscription auto-renews until cancelled. Payment is charged to the Apple ID or Google account used at purchase. The subscription renews unless auto-renew is turned off at least 24 hours before the end of the current period.

8. Saving, sharing, and third parties

On first use, Smudge may download publicly available face-detection model files from a content delivery network (jsDelivr) so the Human engine can run on your device. Those downloads do not include your photos, videos, email, or face hashes.

Ads are served by Google AdMob. Subscriptions and install distribution are handled by Google Play on Android and Apple on iOS. If you install Smudge from Google Play, Google may process data under Google’s Privacy Policy. If you install Smudge from the App Store, Apple may process data under Apple’s Privacy Policy.

If you save a file to Photos / your device gallery, or share it to another app (Messages, social apps, and so on), that destination’s policy applies to the file you send. Smudge does not upload that file to us.

9. Retention and deletion

Local data — including the in-app gallery, drafts, named-face records, and session state — stays on the device until you delete it in the app, clear the app’s storage in your device settings, or uninstall the app. Logging out keeps media and named faces on the device but stops using that email until you sign in again.

To delete your Smudge account on this device, open the app, go to Settings, and tap Delete account. That wipes your email login, in-app gallery, named faces, and drafts. We do not keep a cloud backup, so this cannot be undone from our side. You do not need to email us to finish deletion. Uninstalling Smudge also removes remaining on-device data. A public description of this process is at https://jnuno03.github.io/smudge-privacy/delete-account.html (the same page is also published at https://jnuno03.github.io/facephantom-privacy/delete-account.html for older App Store listings).

10. Children

Smudge is not directed at children under 13. We do not knowingly collect personal information from children on a Smudge server. Photos you take may include children; that media remains on your device unless you export it.

11. Security

Because processing is on-device, your media is not transmitted to us. Photos and videos in the in-app gallery are stored as ordinary local blobs; they are not encrypted with a password or user-managed key. Protect access to your device with the screen lock provided by your operating system. No method of storage is completely secure.

12. Changes

We may update this policy if the app’s behavior changes. The “Last updated” date at the top will change when we do.

13. Contact

Questions about this policy: facephantomapp@gmail.com

To delete your on-device account, use Settings → Delete account in the app. Details: Delete account.

Technical identifiers

The public product name is Smudge. Store and OS identifiers still use values from before the rename and are listed here only so listings stay accurate — they are not a different app: Android application ID com.base69a32a3844c12fd57e701f88.app; iOS bundle ID com.jasleennuno.facephantom; ad-free subscription product facephantom_adfree_monthly. Local storage keys on the device may also still use an older internal name.