Privacy

Last updated 9 October 2026

Short version: your photos never leave your device except to go straight to a friend you play online. You can play without an account, and we never sell your data.

Playing without an account

You don't need an account to play. Everything is kept in your browser's own storage on this device:

• the faces you add, their names and your recent faces;
• a random player id and the username it came with (for example SpicyPanda4821);
• coins, things you bought with coins, and your best scores;
• settings such as sound and the voice actor.

We can't see any of it. Clearing your browser's site data deletes it for good, and some browsers (Safari, for example) delete it on their own after about a week without a visit, unless you install the game to your home screen.

Photos

Photos are cropped, and the head is cut out, on your device. They are never uploaded to us. The cut-out tool downloads its model from Google's servers the first time you use it, like any web page downloading a file; your photo is not sent with it.

When you play a friend online, your face, your player name and your player id go directly from your device to theirs. They can see, and could save, the face you send. Only use photos of people who are in on the joke.

Online play

To connect two devices, the game uses a small matchmaking ("signalling") server and, on networks that block direct connections, a relay ("TURN"). Both run on Cloudflare; if ours is unavailable the game falls back to the free public PeerJS server. These services see your IP address and the room code while they connect you, and the relay passes your match traffic along without storing it. The chat in a match goes directly between the two devices, like the faces.

Accounts (coming soon)

Free accounts will let you keep your progress forever, play on any device, pick your own username, add friends and play online. When they arrive, this page will be updated before anything changes, and the account will keep everything you earned as a guest. An account will store:

• your email address, or your Google sign-in if you choose that. A mobile number is optional;
• your date of birth. Accounts are for people aged 18 and over;
• your username, friends, coins, purchases and scores.

Keeping rewards fair

Invite rewards only work if one person can't pose as many. To spot repeat sign-ups, we will keep:

• a fingerprint of your device and browser (screen, settings and similar signals, the kind any website can read);
• your IP address, and your network as a whole (the part of the address your internet provider shares across a home or building, and the provider itself).

We never store these as they are. Each is turned into a keyed hash: a scrambled code made with a secret key only our server holds. The same device or home always gives the same code, so we can tell that two accounts share one, but the code can't be turned back into your IP address or device details. We use them only to count accounts per device and per home and to stop invite and reward abuse, never for advertising, and we don't share them.

Analytics

We may count anonymous events, such as which games are played and for how long, to make the game better. They are tied to a random id, not your name, and never include your photos.

Ads

There are no ads now. If we add them, they will be optional: you choose to watch one for a reward. This page will say which ad network is used before they appear.

What we never do

• sell or rent your data;
• upload your photos to our servers;
• use faces to recognise or identify anyone.

Your choices

You can delete your guest data at any time by clearing this site's data in your browser. When accounts arrive you'll be able to see, download, correct or delete your account and everything linked to it.

Contact

Questions, a request about your data, or a complaint: write to [contact email]. Face Off is run by [operator name and address].