Witness — Privacy Policy

Effective Date: May 15, 2026 · Last Updated: July 12, 2026

Introduction

Witness (“we,” “us,” or “our”) is a mobile application that lets you have a short, voiced conversation with a simulation of yourself at age 80. The app takes a single selfie, ages it via AI image models, and synthesizes spoken replies through a third-party text-to-speech service using a premade older voice. The app also offers to record about ten seconds of your voice during onboarding; as explained in Section 1.2, that recording is not transmitted anywhere and never leaves your device.

Because Witness processes facial imagery — which can constitute biometric or special-category personal data under GDPR (Article 9) and several US state laws (notably the Illinois Biometric Information Privacy Act) — this Privacy Policy is written with extra care. Before Witness sends any personal data to an AI service, the app shows a dedicated disclosure naming every recipient and data category below and requires you to check an agreement box. Read Sections 1, 4, and 5 carefully before you decide whether to consent.

If you have questions or concerns, contact us at: cankatsarac@gmail.com

1. What Witness processes, and where it goes

1.1 Selfie photograph

After you separately consent to AI data sharing and accept the camera permission, the app takes a single still photograph of your face. The photograph is sent, encoded inline in the request, to AI models hosted by fal.ai:

• Face/gender check: a vision model — currently Google’s Gemini Flash 1.5, hosted on fal.ai — looks at the photo to confirm a human face is visible and estimate perceived gender, so the app can pick an appropriately gendered premade voice. No result of this check is stored beyond the current session.
• Aging: the app tries, in order, a rotation of image-editing models hosted on fal.ai: Google’s Gemini 2.5 Flash Image edit model, then Black Forest Labs’s FLUX.1 Kontext [pro], then a FLUX-based age-progression edit. The first one that succeeds produces your aged portrait.

If every fal.ai aging route fails, the app falls back to relaying the selfie through the Rork Toolkit to a Google Gemini image model. A retry can repeat these requests once after a total failure. The aged portrait is downloaded back to your device and cached locally; the original selfie is not stored on our own servers (we do not operate any). The models above run on fal.ai’s infrastructure; where fal.ai serves a request through the model owner’s own API, that owner (Google or Black Forest Labs) also processes the image. Provider-side transient processing and retention are governed by the provider safeguards confirmed in Section 5.

1.2 Voice recording — not transmitted

When you accept the microphone permission, the app records approximately ten seconds of your voice. That recording is never sent off your device. It is not transmitted to fal.ai, Google, OpenRouter, OpenAI, ElevenLabs, Rork, or anyone else, and it is not uploaded to us (we operate no servers). The file is written to the app’s private cache on your phone and stays there until you uninstall the app or clear its storage.

The premade voice you hear is chosen from the selfie (the face/gender check in 1.1), not from the audio. The recording is captured on-device and is not read by any network request. You may skip it entirely; skipping changes nothing about what is sent.

The selected gender picks a premade older voice from ElevenLabs (accessed via fal.ai) — a stock voice that belongs to ElevenLabs. Witness does not clone your voice. The synthesized replies you hear are spoken by ElevenLabs’s stock older-voice library, not by an imitation of you.

If a future version ever transmits the recording, or performs voice cloning, we will update this Privacy Policy to disclose it and require your explicit, separate consent before any such request is made.

1.3 Talking-portrait video

For the opening reply of each session, your aged portrait image and the synthesized voice audio (both already AI-generated, per 1.1 and 1.2) are sent to a lip-sync model hosted on fal.ai, which combines them into a short talking-head video clip. The app tries, in order: Kling AI Avatar v2 (a model of Kuaishou), then Creatify Aurora, then SadTalker (an open-source model run on fal.ai). Your original selfie and your voice recording are not sent to this step — only the already-generated portrait and the synthesized speech.

The finished clip is not downloaded to your device. fal.ai returns a temporary URL and the app streams the clip from fal.ai’s servers for the current session only; the link is held in memory, is discarded when you close or restart the app, and no copy is written to your phone. Later replies in the same session reuse an on-device animation instead of generating a new video.

1.4 Conversation text

The text of your conversation (your messages and the replies the future self produces) is sent to a large language model so that the future self can answer in context. The primary provider is OpenRouter, which passes the request to whichever model is currently available from an ordered list. That list currently comprises models from OpenAI (gpt-oss), Alibaba (Qwen), NousResearch (Hermes), Meta (Llama), and OpenRouter’s own auto-router, which selects any free model available at the moment of the request — including, for example, Google’s Gemma. Because the auto-router chooses at request time, we cannot name in advance the single model that will answer a given message; the request is always restricted as described in Section 5.6. If OpenRouter is unavailable, the app falls back to OpenAI’s GPT-4o through our Rork Toolkit relay.

If you use Pro personalisation, we collect the bio you type and any LinkedIn, X, or Facebook profile URLs you paste; the app stores those entries locally and appends them as text to the same AI request, so they reach the same recipients as your messages. Witness does not sign in to, scrape, or independently retrieve data from those social platforms. We do not store the conversation transcript on our servers — see Section 6 for what is held on your device.

1.5 Reply text sent for speech synthesis

The text of the future self’s reply (not your own message) and the name of the selected premade voice are sent to fal.ai, which runs ElevenLabs’s text-to-speech model and returns an audio file. If fal.ai fails, the app falls back to reaching ElevenLabs through the Rork Toolkit relay. The returned audio is cached on your device for replay.

1.6 Subscription state

If you subscribe to Witness Pro, RevenueCat receives transaction identifiers, subscription status, platform identifiers (Apple App Store or Google Play), and an anonymous RevenueCat user identifier so that your entitlement can be restored across reinstalls. RevenueCat does not receive your selfie, voice recording, aged portrait, conversation text, or any other in-app content.

1.7 What Witness does not collect

• We do not require you to create an account; the app has no login screen.
• We do not collect your name, email address, phone number, or contacts.
• We do not collect precise or coarse location. The expo-location library is bundled with our build but the app does not call any location APIs.
• We do not use advertising SDKs, advertising identifiers (IDFA / GAID), or any cross-app tracking.
• We do not use analytics SDKs (Firebase Analytics, Mixpanel, Amplitude, PostHog, etc.).
• We do not sell, rent, or share your data with data brokers.

2. How your data is stored

What is kept on your device (in app-private local storage and the cache directory):

• The aged portrait image (a cached file URI).
• The synthesized reply audio (cached files).
• Your ten-second voice recording, which is never transmitted (see 1.2).
• The selected premade voice ID (a string).
• The date of your last conversation (for the “return visit” experience).
• Your data-sharing consent record.
• Optional bio and social-handle context if you have shared them for the Pro contextual mode.
• Notification opt-in flag.

These items remain on your device until you uninstall the app, clear its storage, or use an in-app reset, whichever happens first.

The talking-portrait video is not stored on your device — it is streamed from fal.ai for the current session only (see 1.3).

What is not kept on our servers (we operate none): your selfie, your voice recording, your conversation transcripts, or any identifier tied to you.

3. Legal basis for processing (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process data on the following legal bases:

We act as the controller for the design of these data flows. The third parties named in Section 5 act as our processors in respect of the personal data Witness sends them: they are bound by their terms to process that data only on our instructions and only to deliver the requested service, and they are not permitted to repurpose it, sell it, or use it for their own independent ends. We do not authorise any of them to act as an independent controller of the personal data Witness transmits.

4. Biometric data — special notice

The selfie photograph and the voice recording can constitute biometric data under several frameworks:

• GDPR / UK GDPR Article 9 — special category if used “for the purpose of uniquely identifying a natural person.” Witness does not use the selfie or the voice recording to identify or authenticate you; we use the selfie only as the input to a generative aging transformation and to a face-presence/perceived-gender check, and the voice recording is not transmitted or analysed at all. We treat the processing as falling within Article 9 out of an abundance of caution and obtain explicit consent.
• Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14 — if you are an Illinois resident, additional statutory rights apply.
• Texas Capture or Use of Biometric Identifier Act (CUBI) — if you are a Texas resident, similar protections apply.
• Washington’s biometric law, RCW 19.375 — applies to Washington residents.

What you are consenting to:

• Capture: a single selfie and a ten-second voice recording on your device.
• Use: the selfie is sent to fal.ai for a face-presence/perceived-gender vision check (a Google Gemini model) and for image aging (Google Gemini and Black Forest Labs FLUX models), with a Rork → Google Gemini relay used only if every fal.ai route fails. The resulting aged portrait and the synthesized speech audio are then sent to fal.ai-hosted lip-sync models from Kling (Kuaishou) and Creatify to produce the opening talking-portrait video. The voice recording is not used for any of this and is not transmitted anywhere.
• Storage: the aged portrait, the synthesized reply audio, the untransmitted voice recording, and the selected voice ID persist on your device. The talking-portrait video does not — it is streamed from fal.ai and never written to your phone. The original selfie is not retained after processing.
• Disclosure: the selfie travels off-device to fal.ai (and to Google and Black Forest Labs as the owners of the models that process it), and on a total-failure fallback through Rork to Google. Your aged portrait and the synthesized speech travel to fal.ai and to the Kling (Kuaishou) and Creatify lip-sync models. Your voice recording travels nowhere. Every recipient is named on the in-app consent screen and in Section 5.
• Retention: until you uninstall the app, clear its storage, or reset in-app, the aged portrait, reply audio, and voice recording stay on your device. We retain nothing on any server of ours — we operate none.
• Withdrawal: uninstall or reset at any time.

If you do not consent, leave the agreement box unchecked. The continue control remains disabled and Witness sends no personal data to an AI provider.

5. Third parties

Same or equal protection — confirmation. Witness shares personal data with the following third parties, and with no others: fal.ai, Google, Black Forest Labs, ElevenLabs, Kling (Kuaishou), Creatify, OpenRouter, OpenAI, Meta, Alibaba, NousResearch, Rork, RevenueCat, and the app stores (Apple, Google Play). We confirm that each of these third parties provides the same or equal protection of your data as is described in this Privacy Policy. Before adopting any of them we reviewed their binding terms and published privacy and security commitments and satisfied ourselves that each requires safeguards consistent with, or equal to, the protections stated here: they may process the data only to provide, secure, and support the service we request; they may not repurpose it, sell it, or disclose it except as needed to deliver the service or to comply with law. Each is named on the in-app consent screen before any data is sent. We will not add a third party that receives a new category of personal data without updating this policy and obtaining fresh consent.

5.1 fal.ai (AI infrastructure: aging, face check, speech, video)

fal.ai is our primary AI infrastructure provider and hosts four separate functions, each described in Section 1: (a) the vision check that confirms a face is present and estimates perceived gender, (b) the aging models that produce your aged portrait, (c) ElevenLabs’s text-to-speech model (fal.ai hosts ElevenLabs inference on our behalf, so the reply text and selected voice name are sent to fal.ai, which forwards them to ElevenLabs), and (d) the lip-sync models that produce the talking-portrait video from your aged portrait and synthesized speech. fal.ai therefore receives your selfie, your aged portrait, the reply text, and the synthesized speech. It does not receive your voice recording or your conversation messages.

Equal protection: fal.ai’s terms bind it to process customer input solely to deliver the requested inference, prohibit selling it, and commit to security measures consistent with this policy — the same or equal protection as described here. See https://fal.ai.

5.2 Google (Gemini vision and image models)

Google’s Gemini models perform two functions on your selfie: the face-presence/perceived-gender check (Gemini Flash 1.5) and the primary aging transformation (Gemini 2.5 Flash Image edit). Both run through fal.ai. In addition, if every fal.ai aging route fails, the app relays your selfie through Rork to a Google Gemini image model as the final fallback. Google’s Gemma model may also answer a conversation request when OpenRouter’s auto-router selects it (see 5.6). Google does not receive your voice recording.

Equal protection: Google’s API terms bind it to process submitted content only to provide the service, prohibit using paid API content to train its models, and prohibit selling it — the same or equal protection as described in this policy. See https://policies.google.com/privacy.

5.3 Black Forest Labs (FLUX aging models)

Black Forest Labs’s FLUX.1 Kontext [pro] and FLUX-based age-progression models are the fallback aging models. They run on fal.ai and receive your selfie when the primary aging model is unavailable. Black Forest Labs receives nothing else — no voice recording, no conversation text.

Equal protection: the FLUX models are licensed to and served through fal.ai under terms that restrict use of submitted images to delivering the requested edit and prohibit resale or repurposing — the same or equal protection as described in this policy. See https://blackforestlabs.ai.

5.4 ElevenLabs (Text-to-Speech, via fal.ai or Rork)

Receives the text of the future self’s reply (not your message) and the selected premade voice name, relayed through fal.ai or, as a fallback, through Rork. Returns an audio file that is played back and cached on your device. ElevenLabs receives no biometric audio or imagery from you — we never transmit your voice recording or your selfie to them, and we do not clone your voice.

Equal protection: ElevenLabs’s terms bind it to process submitted text only to synthesize the requested audio, prohibit selling it, and commit to security measures consistent with this policy — the same or equal protection as described here. See https://elevenlabs.io/privacy.

5.5 Kling (Kuaishou) and Creatify (talking-portrait lip-sync, via fal.ai)

The lip-sync models that animate your aged portrait are Kling AI Avatar v2 (a model of Kuaishou) and, as a fallback, Creatify Aurora; a third fallback, SadTalker, is an open-source model run on fal.ai. They receive your aged portrait and the synthesized speech audio — never your original selfie, never your voice recording, never your messages. The clip they return is streamed from fal.ai and not stored on your device.

Equal protection: these models are served through fal.ai under terms that restrict use of submitted media to producing the requested clip and prohibit resale or repurposing — the same or equal protection as described in this policy. Note that Kuaishou is headquartered in the People’s Republic of China; where a request is served by its own infrastructure, processing may occur outside the EEA / UK (see Section 9). See https://klingai.com and https://creatify.ai.

5.6 OpenRouter (Conversational AI) and its model providers

OpenRouter is the primary provider for generating the future self’s conversational replies. It receives your conversation text (your messages and, for Witness Pro users who have shared optional context, that bio and those profile URLs) and passes the request to whichever model is available from our ordered list: models from OpenAI (gpt-oss), Alibaba (Qwen), NousResearch (Hermes), Meta (Llama), and OpenRouter’s auto-router, which can select any free model available at that moment — for example Google’s Gemma. Because the auto-router chooses at request time, the specific model that answers a given message is not fixed in advance. OpenRouter receives no selfie, no voice recording, and no imagery.

Equal protection: Witness sets OpenRouter’s per-request data_collection control to deny, which restricts routing to model providers that OpenRouter identifies as not collecting or training on user data. This constraint is applied to every request, including auto-router requests, so every downstream model provider that can receive your conversation text is one that meets that bar — the same or equal protection as described in this policy. See https://openrouter.ai/privacy.

5.7 Rork Toolkit (relay) → OpenAI, Google, ElevenLabs — fallback only

The Rork Toolkit is a relay service we use only as a fallback, in three situations: (a) conversation text, when OpenRouter is unavailable — Rork forwards it to OpenAI’s GPT-4o; (b) your selfie, when every fal.ai aging route fails — Rork forwards it to a Google Gemini image model; and (c) reply text for speech, when fal.ai’s text-to-speech fails — Rork forwards it to ElevenLabs. Rork itself is therefore a recipient of whatever it relays. We have a service relationship with Rork; we do not have a direct contractual relationship with OpenAI.

Equal protection: Rork’s terms bind it to relay content solely to fulfil the request, and OpenAI’s API data-use policies (current at the time of writing) provide that API inputs and outputs are not used to train OpenAI’s models and are not sold — the same or equal protection as described in this policy. See https://rork.com and https://openai.com/policies/api-data-usage-policies.

5.8 RevenueCat (Subscription Management)

Processes subscription transactions and entitlement records: transaction identifiers, subscription status, platform identifiers, and an anonymous RevenueCat user identifier. Does not receive your selfie, voice recording, aged portrait, or conversation content.

Equal protection: RevenueCat acts as our processor under a data-processing agreement that restricts use of the data to providing the subscription service and prohibits selling it — the same or equal protection as described in this policy. See https://www.revenuecat.com/privacy.

5.9 Apple App Store / Google Play

Distribution and platform billing only. They receive purchase and platform data in their capacity as the app stores; they receive no selfie, voice recording, aged portrait, or conversation content from the app.

Equal protection: both operate under published privacy commitments and billing terms that provide protection equal to that described in this policy for the purchase data they handle. See Apple Privacy and Google Privacy.

5.10 No other third parties

The parties named in 5.1–5.9 are the complete list of third parties that receive personal data from Witness. The one qualification is stated openly in 5.6: OpenRouter’s auto-router selects a free model at request time, so the individual model provider that answers a given message may vary within the constraint described there. Beyond that, we do not use advertising networks, advertising identifiers, third-party analytics SDKs, social login providers, or third-party crash reporters that transmit identifiable data externally, and we do not sell, rent, or share your data with data brokers.

6. Data retention

7. Your rights

7.1 Rights for all users

• Access: all in-app data is visible to you in the app. We do not hold a server-side copy.
• Delete: uninstall the app, or use the in-app reset, to permanently delete the cached aged portrait, the cached reply audio, and all local preferences. Uninstalling or clearing app storage also removes the untransmitted voice recording.
• Correct: edit any bio or social-handle entries directly in the app.
• Withdraw consent: use the in-app reset or uninstall. Reset deletes the saved consent record, local content, and preferences; the app will require a new affirmative choice before any later AI transmission.

7.2 EEA / UK residents (GDPR / UK GDPR)

You additionally have the right to object to processing, receive a portable copy of any data we hold about you, and lodge a complaint with your local supervisory authority (ICO, CNIL, BfDI, AEPD, KVKK, etc.).

7.3 California residents (CCPA / CPRA)

California residents have the right to know, delete, correct, opt out of the sale/sharing of personal information (which we do not do), limit the use of sensitive personal information, and non-discrimination for exercising these rights.

7.4 Illinois, Texas, Washington residents (biometric laws)

You have the additional rights described in Section 4. To exercise them, contact us at the address in Section 11.

8. Children’s privacy

Witness is not directed at children under 13 years of age, and the EEA minimum is 16. We do not knowingly process biometric data of children. If you are a parent or guardian and believe your child has used the app, contact us; uninstalling the app permanently removes any locally cached content.

9. International data transfers

The selfie, the aged portrait, the synthesized speech, and the conversation text may be processed in jurisdictions other than your country of residence (typically the United States and the European Union). Your voice recording is never transferred anywhere, because it is never transmitted.

One recipient warrants specific mention: the primary talking-portrait lip-sync model, Kling, is a model of Kuaishou, a company headquartered in the People’s Republic of China. The model is served through fal.ai; where fal.ai routes a request to Kuaishou’s own infrastructure, your aged portrait and synthesized speech may be processed outside the EEA / UK, including in China. If you would rather this did not happen, do not consent on the data-sharing screen.

Where transfers from the EEA / UK to a country without an adequacy decision occur via our service providers, we rely on those providers’ transfer mechanisms — including the European Commission’s Standard Contractual Clauses where applicable, and their participation in the EU–US Data Privacy Framework where applicable.

10. Changes to this policy

We may update this Privacy Policy. Material changes — particularly any change that would broaden what biometric data is transmitted off the device, or any change in the AI provider that processes the selfie — will be communicated via an in-app notice on next launch. The “Last Updated” date at the top reflects the most recent revision.

If a future update introduces voice cloning of your real voice or any other materially new biometric processing, we will obtain fresh, explicit consent before performing it.

11. Contact

Controller: Cankat Saraç (sole proprietor)
Email: cankatsarac@gmail.com
Postal address: Hull, HU9 4BX, United Kingdom

We aim to respond to verified requests within 30 days.

This Privacy Policy applies to the Witness mobile application available on the Apple App Store and Google Play Store.