The Information Commissioner’s Office (ICO) is considering allegations that FaceApp, the face-ageing photo app that has gone viral, is misusing personal data.

“We are aware of stories raising concerns about FaceApp and will be considering them,” a spokesperson for the information watchdog said on Thursday. “We would advise people signing up to any app to check what will happen to their personal information and not to provide any personal details until they are clear about how they will be used.”

The app, which can run on iPhone and Android devices, allows users to place an AI-powered ageing filter over uploaded pictures of their faces.

The tool went viral this week with the hashtag #faceappchallenge, but as people pointed out that the developer’s company is based in Russia, a flurry of stories about potential data harvesting emerged.

FaceApp subsequently denied storing the photo libraries of users without their permission, a concern that was raised by various development and data security experts. FaceApp’s chief executive, Yaroslav Goncharov, said it did not sell or share any user data with any third parties.

“FaceApp performs most of the photo processing in the cloud,” Goncharov said. “We only upload a photo selected by a user for editing. We never transfer any other images from the phone to the cloud.

“We might store an uploaded photo in the cloud. The main reason for that is performance and traffic: we want to make sure that the user doesn’t upload the photo repeatedly for every edit operation. Most images are deleted from our servers within 48 hours from the upload date.”

Goncharov said the company accepted requests from users to remove all their data from its servers.

A US senator, Chuck Schumer, has called for the FBI to investigate FaceApp over fears about “national security and privacy risks”.

He said: “Given the growing popularity of FaceApp and these national security and privacy concerns, I ask that the FBI assess whether the personal data uploaded by millions of Americans on to FaceApp may be finding its way into the hands of the Russian government, or entities with ties to the Russian government.”

FaceApp claims that only its research and development team is located in Russia, and user data is not transferred to the country.