Privacy expert Ann Cavoukian says that while most apps have problematic policies, FaceApp's potential sharing of photos and other information with third parties are especially concerning.
"Most apps are really bad, there's no question. But this one captures your facial image, it's the most sensitive information out there," said Cavoukian, executive director of the Global Privacy and Security by Design Centre.
"You don't want this compromised and used in ways that you never intended."
Along with the ability to share data with affiliates, users of FaceApp grant the company the right to use user content for commercial purposes.
"They speculate that the data that they collect as you use their services will be useful to some party at some time in the future," said Whitson.
"What they do is they collect it all, as much as they can gather and store it, because storage is cheap, and hope that they can figure out some way in the future of how they can use it to make them rich."
"Always remember, if it's free, think about how is this company making their money."
For its part, FaceApp said in a statement Wednesday that it limits the use of user data.
"We don't sell or share any user data with any third parties," said Yaroslav Goncharov, the Russia-based developer of the app.
The company's terms, however, allow that it might sell some assets, including user data, to other organizations, and share data with affiliate companies.
The app, launched in 2017, recently raised concerns after a Twitter user claimed it had started to upload all of the photos on their phone, but Goncharov said the app doesn't do that.
"We only upload a photo selected by a user for editing. We never transfer any other images from the phone to the cloud."
He said the app does upload selected images to the cloud for editing and may store them there to speed up processing, but that most photos are deleted from the servers within 48 hours.
Data is not transferred to Russia, and users can also request to have all their data deleted though the support team is currently overloaded, he said.
FaceApp features can also be used without logging in to avoid transferring identifying personal information, said Goncharov.
The app had previously drawn criticism for offering the ability to change the ethnicity of users' photos, an option the company removed.
Cavoukian, a three-term Ontario privacy commissioner, said everyone should be concerned about data privacy, not only because of issues like data theft, but also because privacy is so crucial to an open society.
"Privacy forms the foundations of our freedom. You can't have open societies without the foundations of privacy," she said.
"You can't have brilliant ideas and all kinds of things taking place without the freedom to think wild, crazy thoughts without someone looking over your shoulder."