A web developer who sparked concerns about a popular photo-editing app has admitted he was wrong.
FaceApp this week saw an upsurge in activity thanks to the viral FaceApp challenge, which saw millions - including celebrities - use the app's aging feature to see what they might look like when they're old.
But earlier this week developer Joshua Nozzi claimed it was uploading "all your photos", not just the one you thought might make a hilarious post on Instagram.
"As soon as I granted access to my photos it started listing them slowly a row at a time... It immediately uploads all your photos without asking, whether you chose one or not", he said.
The tweet was picked up by several major tech and mainstream news sites, some noting FaceApp is based in St Petersburg, Russia.
"FaceApp: Is The Russian Face-Aging App A Danger To Your Privacy?" asked Forbes in its headline.
"FaceApp goes viral with old-age filter, but spurs privacy concerns with Russian roots," reported Good Morning America.
FaceApp chief executive and founder Yaroslav Goncharov told TechCrunch the fears were unfounded.
"We only upload a photo selected by a user for editing. We never transfer any other images from the phone to the cloud," he said.
Images are only stored on their servers, he said, for up to 48 hours - this is to stop users from having to upload it again and again every time they wanted to make a change. And those servers aren't in Russia - they're run by Amazon - "like almost everyone else" as Wired put it - and hosted in places like the US and Singapore.
"All FaceApp features are available without logging in, and you can log in only from the settings screen," added Goncharov. "As a result, 99 percent of users don't log in; therefore, we don’t have access to any data that could identify a person."
He said anyone with the knowhow could check their claims about what's uploaded and where it's stored, so some did - and found he was telling the truth.
While some modern powerful phones do have the processing power to run filters like these on the device without the need for a server, most don't. One expert said the panic over FaceApp is because its developers are based in Russia.
"People give photos to lots of different apps. I think this is probably getting attention because it's Russian developers," Christine Bannan of the the nonprofit Electronic Privacy Information Center told Wired.
"But this is definitely not a unique FaceApp problem. FaceApp is part of a larger privacy problem."
Wired also pointed out FaceApp's policy of keeping the rights to anything you upload is virtually the same as Facebook's - which has more than 2.5 billion users.
Goncharov, who used to work for Microsoft in the US, said no data collected by FaceApp was given to third parties. Facebook was reportedly fined €5 billion over its data-sharing with Cambridge Analytica, a firm used by the Trump campaign in 2016.
Nozzi deleted his original tweet "to stop the spread of my disinformation", but acknowledged he was guilty of being "wrong on the internet" in a blog post.
"I was wrong about what I thought the app was doing (uploading all pics once granted access), and I was wrong to have posted the accusation without testing it first. Full stop," he wrote.
He also lashed out at writers who tried to spark a "red scare" by linking the problem to Russia.
"You shit-stirring, sensationalist assholes, where in my warning did I mention the Russians? ... F**k you."
FaceApp is no stranger to controversy. In 2017 it hit the headlines after users noticed its 'hot' filter lightened skin - the implication being lighter skin is more attractive. FaceApp said it was a problem with the artificial intelligence behind the transformations, which had been primarily trained on white faces.