While it is true that FaceApp uploads images to its servers for the application to be able to apply the effects, the company only uploads the specific images that are being modified, not the entire camera rolls of users. The company’s CEO behind FaceApp, Yaroslav Goncharov, also told The Verge back in 2017
(when the app had hit viral fame) that while the company sometimes stores pictures for performance purposes for a short time, most pictures will be deleted shortly afterwards; the company also told TechCrunch
that “most pictures will be deleted from our servers within 48 hours of the upload date.”
Democrats are being overly cautious here, it might seem, by banning FaceApp simply because the developers are based in Russian, but they may have reason to be cautious: after being hacked just weeks before the 2016 election, the organization appears to be looking for security.