The whole story
What happens to your photo
Last updated 20 September 2026
This is a party game, not a product with a growth team, and the data handling matches: photos live in memory for the length of one game and are never written to a disk. Here is the rest of it, in the order you would ask.
Your photo
You crop it on your own phone, so the original is never uploaded — only the square you framed. That crop is held in the server's memory for as long as the game runs, is used to make the blended pictures the room guesses at, and is never written to disk. It is deleted the moment the host ends the game, and automatically if the game is abandoned: at most four hours from the start, or one hour after the room goes quiet. There is no backup, no export and no archive, because there is no file.
The name beside it
Whoever adds a face types a name for it, and that is the name the room picks from when guessing. It lives in memory with the photo and goes at the same moment, the same way. It does not have to be a legal name — a nickname works just as well for the game.
Faces of people who aren't in the room
The host can add a photo of someone who isn't at the party — a flatmate, a colleague, somebody's dog. Those people never see this app, so they cannot be told anything by it, and there is nothing technical that can ask them. If you add someone else's face, that is a thing you are doing and their agreement is yours to get.
The rating at the end
The card after the final scoreboard is the one thing here that outlives the game. If you send it, the star rating and your comment are stored in a database and kept for twelve months, then deleted automatically. The row is filed under a one-way code worked out from the game and your place in it — the same person in two games leaves two unrelated codes, and no code can be turned back into a name or a phone. That also means a comment cannot be traced to you, so please don't put anything in it you would mind a stranger reading.
Counts, and only counts
Every game writes a handful of numbers: how many players, how many faces, how many blends, how long it ran, and whether it finished. They are filed under a random id that has nothing to do with the join code, and they contain no names, no images and no IP addresses. The totals are on the public stats page. This is how the game gets better at being a game.
What sits on your own device
Your place in the game is kept in your browser's local storage: the token that says which player you are, the language, the host's screen layout, and whether you've already been offered the rating card. None of it is a cookie, none of it is sent anywhere, and none of it follows you to another site — which is why this page has no cookie banner to click away. Clearing your browser data removes all of it.
Getting here over the internet
Traffic to face-shuffle.com passes through Cloudflare, which provides the network and the protection against floods and scanners. Being in that position means Cloudflare's machines handle the traffic in the clear, photos included, and keep short-lived network logs that include IP addresses; this can happen on servers outside the EU under the standard safeguards for that. The game server itself uses your IP address only in memory, to count requests and stop somebody guessing at join codes, and never stores it. If you want a game with nobody at all in the middle, run the code on your own network — it is open source and works offline.
Why this is allowed
Your photo, your name and your feedback are all there because you chose to add them, which is consent — and you can take it back: remove your face during the game, or don't send the card. The counts and the rate limiting rest on a legitimate interest in knowing whether the game works and in keeping the server standing, and neither of them describes a person.
Your rights, and where one of them stops
For photos and names, erasure is not a request you have to make: remove the face, or end the game, and it is gone within the hour — everything is gone within four regardless. For feedback, the pseudonymisation that protects you also works against you, because a code that cannot be turned back into a person cannot be used to find your row either, and I am not going to start collecting something that would make it possible. If you want a comment removed, write to me with roughly when you played and what you said, and I will find it by hand. You can also complain to Integritetsskyddsmyndigheten (IMY), the Swedish data protection authority.
Children
The game isn't aimed at children and isn't built for them. Under 13, a parent should be the one deciding whether a photo goes in — and that applies to the host adding a child's face just as much as to the child adding their own.
Who is responsible
face-shuffle.com is a side project run by one person, Ture Hassler, in Sweden. For data protection purposes that makes me the controller for everything on this page, and the person to shout at if any of it is wrong. The party's host runs the room, but they don't run the service — that is me.
Questions, corrections, or a comment you want deleted: [email protected]. The code behind all of this is public on GitHub.