Picsart

Is Picsart safe?

Picsart is safe enough for everyday photo and video edits, as long as you accept that it is an ad-funded app. The company has no known breach and no regulatory fine, and its security page lists the audits a careful buyer would want to see. What holds the score back is privacy: Apple's label says Picsart tracks you across other companies' apps, its policy allows identifiers to be sold or shared for targeted ads, and it scans face geometry with no retention period or consent step of its own. We score it 55/100, just below Canva (58) and ahead of ByteDance's CapCut (53).

What Picsart collects

Apple's privacy label puts identifiers in the "used to track you" section. Purchases, contact info, photos and other content you upload, search history, identifiers, usage data and diagnostics are all linked to your identity. On Android, Picsart's data safety form goes further. It says the app may collect your list of installed apps and, if you allow it, your contacts, and that device IDs, names, email addresses and user IDs are shared with other companies, including for advertising.

The privacy policy is plain about the ad business. Through digital ad networks, Picsart may sell or share identifiers, browsing and app activity, and purchase information. US residents can opt out at privacy.picsart.com, and the company says it does not knowingly sell or share data of anyone under 16. Its systems do not honour "Do Not Track" signals.

Face data and AI tools

Picsart's AI tools, from background removal to face swaps and image generation, are now the core of the product. Its press kit says the AI Playground offers more than 150 AI models. The privacy policy has not kept pace: last updated on 16 November 2023 and served unchanged in Europe and the US, with a section for EU and UK residents, it never mentions artificial intelligence, machine learning or model training.

The rules sit in separate Generative AI terms, last updated on 30 April 2026. Using the AI tools gives Picsart a perpetual, irrevocable, sublicensable licence to your inputs, both to run the tools and to improve the services of Picsart and its third-party AI providers. Prompts and images in the AI image generator can be public and open for others to remix by default. Features that process face geometry, such as AI avatars, are for users aged 18 and over.

What the policy does cover is face data. When you apply face effects or generate images of a face, "Picsart scans your face geometry in the images you upload", and the policy sometimes calls this biometric data. Yet it gives face data no retention period of its own, and it says nothing about asking your consent for it. The general rules apply instead: data stays until you delete your account, some is kept for up to three years after that for legal or law-enforcement reasons, and some indefinitely if you broke Picsart's policies or "to update and improve our services". Face tracking through the iPhone's TrueDepth camera is handled differently: Picsart says that data is used in real time only, never leaves the phone, and is not stored or shared.

Subscriptions and refunds

Picsart's paid plans renew automatically, and its terms say all payments are non-refundable, including any unused part of a billing period. Trials that ask for card details convert to a paid plan the day after they end. In the US App Store, Pro costs $11.99 a week or $83.99 a year, so a weekly plan left running for a year costs more than seven times the annual price.

The terms also send disputes to individual arbitration in San Francisco and waive class actions, with a 30-day window to opt out in writing. If you subscribed through Apple or Google, cancel and request refunds there.

Security record

We found no breach. Have I Been Pwned has no record for picsart.com, and US federal court records show only website accessibility suits against the company. Picsart's security policy, updated in May 2026, says it encrypts stored data with AES-256 and traffic with TLS 1.2 or higher, hires an outside firm for yearly penetration tests, holds ISO 27001 certification and has a SOC 2 Type 2 audit each year. It runs a public vulnerability disclosure programme on HackerOne that pays no bounties. We found no two-step login in its help centre, so a strong, unique password matters. As with any cloud editor, your images are not end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary.

How to use Picsart more safely

1. Deny the tracking request on an iPhone, and turn off the advertising ID on Android.
2. In the US, use privacy.picsart.com to opt out of the sale and sharing of your data.
3. Give the app access to selected photos only, and refuse contacts access.
4. Keep photos of children and of other people's faces out of the AI tools, since Picsart keeps a licence to everything you put in.
5. Do not post with #freetoedit or #freeforbusiness unless you are happy for strangers to reuse the image for good.
6. Pick a monthly or annual plan rather than weekly, and set a reminder before a trial ends.

How we scored it

Regulatory record (86) is Picsart's strongest factor: no fines or orders, though no major regulator has looked closely either. Security (60) rests on audits and a clean breach record, held back by the lack of two-step login. Privacy (38) is the weakest, because of ad tracking, data sales, face-geometry scans without a consent step and AI terms that reach its suppliers, and transparency and control (46) loses points for broad licences, open-ended retention and a privacy policy that is silent on AI. For a ByteDance alternative, see Hypic.