Privacy

About

Privacy

UFM is a local-first tool. Your camera frames, recorded takes, source videos, project names, and blendshape data are processed on your machine and stored on your disk. None of it is uploaded anywhere by the app.

What UFM itself sends

UFM collects no analytics, no usage data, and no telemetry. There’s no analytics SDK and no crash reporter in our code.

The only network call UFM makes is an optional update check: on launch it reads a small version file to see if a newer build exists. It sends no identifiers and no usage data. You can turn it off completely in Settings → Privacy, after which UFM makes zero network connections.

The face-tracking model ships inside the app, so nothing needs to be downloaded to start tracking.

Third-party: MediaPipe

Face tracking uses Google’s MediaPipe. Its native library contains Google’s “clearcut” logger, which may attempt to send anonymous framework-level metrics (e.g. which model ran) to a Google endpoint.

Key facts:

  • It does not send your video, your face, your takes, or any file you create.
  • It’s best-effort and rate-limited, and on a short desktop session typically never completes an upload.
  • All UFM inference is local, so the app works fully offline. If you want to guarantee nothing leaves your machine, you can block the app’s outbound network at the OS/firewall level and nothing breaks.

We’re evaluating, for shipped builds, either a telemetry-free MediaPipe build or an alternative local tracking backend.

Your data on disk

Takes are plain files under your library folder (configurable — see Projects & Takes). Delete the folder and the data is gone. Nothing is synced to any server.

Next Steps