Everything happens on your device.

The extension makes no network request of its own. Face detection runs in your browser (ONNX Runtime, WebAssembly) on images the page has already loaded. No image data, no face data, no browsing history and no telemetry leave the browser. There is no account, no login and no tracking inside the extension; its manifest declares data_collection_permissions: none.

One exception, and only if you choose it. To unlock the paid effects you open your account page on ungaze.eu and press "unlock". The page hands the extension a licence token; the extension hands back the public half of a device key it generated itself. That key is a random value and identifies no person. Nothing else is exchanged, and it happens only on ungaze.eu.

The website and the account are a separate matter and are covered by their own policy:
https://ungaze.eu/en/datenschutz/