You should probably put this in the disclaimer. These days I assume all toys like this are data gathering tools in disguise. And I'm right more often than not.
Could he do that though? I mean, hypothetically. I'm based in the EU so GDPR applies, and a picture of my face is definitely personally identifying info. So, unless I clicked something saying I consent to the data be stored/sold, I assume it would be illegal to do so.
