Here's an article with a little more technical detail.
https://www.buzzfeednews.com/article...faceapp-photos
Basically folks ran a network packet sniffer and found that the application does nothing nefarious. But they own the rights to any photo you upload via their application, meaning they can use, resell, etc. That's nothing considering the data mining that Google, Apple and Facebook are doing. I understood the risk and I choose to use it occasionally. And besides I'd be really flattered if they do decide to use my fugly face. Just because the company is based in Russia does not automatically make them bad, or any based in USA automatically make them good as evidenced by the above mentioned three US based company. Ultimately you have to decide if the risk is worth the little fun.