What “on-device” really means
We use that phrase a lot. It is not a synonym for “we see nothing.” It means specific checks never leave the phone as images.
When you are in a call, two different paths exist. One is the live video itself: it is sent to the other person, encrypted, because that is the product. The other is safety software sitting on each phone, looking at the video that phone is receiving.
Face detection, not face recognition
The receiving phone asks a small on-device model a yes/no question: is there a face in this frame? If the answer stays no, the picture can be blurred so you are not suddenly looking at an empty or unexpected scene. There is no gallery of faces on our servers, no “is this the same person as last Tuesday,” and no biometric template we could search later. Detection is not recognition. We keep those words separate on purpose.
What still goes to our servers
We need signalling: who matched, who hung up, ICE candidates so WebRTC can connect. We store account data you typed at sign-up. We store coarse call metadata (that a call happened, how it ended) to run the product and to investigate abuse. We do not keep the movie of the call.
The exception is a report. If you tap Report, your phone may upload a handful of stills from the video you just saw. Moderators cannot review a he-said-she-said report with zero evidence. Those stills are kept for a limited time and are not used to train ads or to build a face database. The Privacy Policy is the binding version of this paragraph.
Ads are separate
The Android app shows AdMob ads. This website shows AdSense ads. Those products are Google’s, and they have their own cookies and identifiers. They do not get your call video. On the website we mention cookies in the banner and in the privacy policy so that is not a surprise.
What you can still control
You can deny camera or microphone and you simply will not have a video call. You can hang up. You can delete the account. You can turn off ad personalisation in Android settings. On-device processing is a design choice to shrink how much sensitive imagery we would otherwise have to hold. It is not a promise that a random person on the other end is kind. For that, use the habits in stay safe.