“Face recognition” carries a lot of baggage, most of it earned by companies that scraped the internet and sold the results. Roll's face match is a different animal, and the difference is worth spelling out.
When you scan your face once, the app turns it into a mathematical signature, a vector of numbers. That's it. There is no stored photo of your face sitting on a server waiting to be leaked. The signature can't be reversed into a portrait.
When a roll opens, any frame you appear in is checked against your signature. If the match clears a 90% confidence bar, that frame is filed into your private album. If it doesn't, nothing happens. No maybes, no guessing at strangers.
Scan it, and the shots of you find you. Delete it, and every one of those links disappears.
You never have to scan your face. Skip it and you still see the entire roll. Face match only adds a private album on top. It exists so you never have to stand in a group chat asking “can someone send me that photo?” again.
Your signature is yours to remove at any time. Delete it and the matches unwind with it. That's the deal: the convenience is real, and so is the off switch.