I made this and can assure you I'm not doing anything with the images. This is just a silly side project of mine (along with Doron). I'm certainly not hoping to gain any money or data from it!
You should probably put this in the disclaimer. These days I assume all toys like this are data gathering tools in disguise. And I'm right more often than not.
Could he do that though? I mean, hypothetically. I'm based in the EU so GDPR applies, and a picture of my face is definitely personally identifying info. So, unless I clicked something saying I consent to the data be stored/sold, I assume it would be illegal to do so.
Because right now you say you're not doing anything with the images, that doesn't rule out collecting face data and storing that instead.