TIME WARP SCAN: Face Scanner

"Call log and Contacts: As part of our dialer feature which is provided to certain Apps of ours, you will be required to provide us permissions to your call log and contacts. List of Installed App: When you install our App, we may collect information from your device, that may include a list of your installed Apps. Bluetooth and Network: We may collect through your Bluetooth and network permissions list of devices and networks your device "see" and connection history of your device."

For a face scanner app, collecting installed app lists, call logs, contacts, Bluetooth device lists, network connection history, calendar data, and health data is vastly disproportionate to the app's core functionality.

"Certain features may require access to your GPS location permissions. In addition, in certain features we will use your "Access Fine Location" permission in the background while you are using the App so that we are able to locate the wifi networks and connection to provide the Services. Please note that this information can run in the background of your mobile device, and show you an applicable list of WIFI networks."

The app requests fine GPS location running in the background, ostensibly for WiFi network features — which is unrelated to a face scanner app's core purpose and represents excessive location tracking.

"Advertisers: AdMob, AdColony, Applovin, Chocolate Platform, Facebook Audience Network, Index Exchange, Media.net, Mobfox, OpenX, PubMatic, Rubicon, Sharethrough, Yieldmo. And as may be updated from time to time (collectively "Advertisers"). Their targeted advertising SDKs collect information about your browsing activity across multiple websites and online services in order to provide you with relevant advertisements."

The app embeds at least 13 advertising SDKs that directly collect user browsing activity data from users' devices, creating extensive third-party data collection well beyond what a face scanner requires.

"Their targeted advertising SDKs collect information about your browsing activity across multiple websites and online services in order to provide you with relevant advertisements on the App and Services of third parties. Our partners will process this data to manage and deliver advertisements more effectively and personally, including contextual, behavioral and interests-based advertising based on your activity, preferences or other data available to us or to our business partners."

Multiple advertising SDKs track user activity across websites and services to build behavioral profiles for cross-contextual interest-based advertising and retargeting.

"We reserve the right to amend this Policy from time to time, at our sole discretion. The most recent version of the Policy will always be posted on the website. Any amendments to the Policy will become effective within 30-days upon the display of the modified Policy. We recommend you review this Policy periodically to ensure that you understand our most updated privacy practices."

The company can unilaterally change the privacy policy at its sole discretion, with changes taking effect automatically after 30 days of posting — placing the burden on users to periodically check for changes.

"In general, we retain the Personal Data we collect for as long as it remains necessary for the purposes set forth above, all under the applicable regulation, or until you express your preference to optout, where applicable. Please note that except as required by applicable law, we will not be obligated to retain your data for any particular period, and we may delete it for any reason and at any time, without providing you with prior notice."

No specific retention timelines are provided, data is kept indefinitely for vague purposes, and broad exceptions (legal, regulatory, tax, litigation) allow retention well beyond account closure.

"If you would like to delete your Personal Data please fill in this form: link. You do not need to create an account with us to submit a request to know or delete. We may deny your deletion request, in full or in part, if retaining the information is necessary for us or our service provider(s) for any of the following reasons: Complete the transaction for which we collected the Personal Data... Detect security incidents... Debug products... Exercise free speech..."

Deletion requires submitting a separate Data Subject Request form via email rather than offering in-app self-service, and the company lists eight broad exceptions under which it can deny deletion requests entirely.