It all depends on who stores it and how. I use FaceID on my iPhone.

The data to match the FaceID doesn’t leave my phone although I need to trust Apple on that. If you don’t want to place that trust on Apple then it would be better to use something like Graphene.