Legal

Face Information Handling Rules

Last updated: September 2026

Everyone on Gravity is a real person. To make that true rather than a slogan, we ask every account to complete a one-time camera check. This page explains exactly what that involves. Questions: [email protected]

What we collect

A short sequence of camera frames, captured while you follow a few on-screen prompts (for example, turning your head). During the check the screen briefly flashes a few colours and we measure how the light falls on your face — this is how we tell a live person in front of the camera from a recording. No audio is recorded — the microphone is never used for this check.

From those frames we compute a face template: a list of numbers derived from the geometry of your face. It is not a picture and cannot be turned back into one.

What we keep, and for how long

If the check succeeds, we keep two things: the face template, and one small cropped image of your face, 192 by 192 pixels. We keep that crop so that when we improve the matching software we can recompute your template from it, instead of asking you to do the check again. Everything else — the full camera frames — is discarded immediately and never written to disk.

If the check does not succeed, the frames are kept for up to 30 days so a person can review the case, and are then deleted automatically. The decision itself is retained as a record.

Both the template and the crop are stored encrypted, with a key held only by the region that captured it. Deleting your account deletes both.

Why we need it

To confirm a living person is present when an account is created — this is what stops fabricated and automated accounts.

To confirm that a profile photo you upload is a photo of you. Uploading a photo is optional; if you upload one, it is compared against your template and refused if it does not match.

To detect one person holding several accounts.

Where it is stored, and where it is not

Your face template stays in the region your account belongs to and never crosses a border. Accounts homed in the mainland-China region are stored in mainland China; accounts on hplab.dev are stored outside it.

If your account moves between regions, the template is deleted rather than transferred, and you complete the check again at your new home region.

We never share face information with any third party, and never use it for advertising, profiling, or any purpose other than the three above.

If you would rather not use the camera

You can ask a person to review your case instead. The option is offered on the verification screen itself, not only after a failure, and it does not require any biometric processing.

Deleting your face data

You can have your face template deleted at any time. Because the real-person check is a condition of using Gravity, deleting it means closing your account — so the control is the account-deletion flow in Settings, and it removes the template along with everything else.

Age

Gravity is for adults. We do not knowingly process face information from children.