It's a valid point, but do you know of any companies which meet this standard? Perhaps if they were dealing with highly sensitive information then it makes sen

It's a valid point, but do you know of any companies which meet this standard? Perhaps if they were dealing with highly sensitive information then it makes sense to make those kinds of disclosures, but for novelty headshot generator app? I'm not sure it makes sense to require that level of detail or expect it. But to your point, I hate uploading anything private or personal anywhere for this exact reason. Even if you trust the company has good intentions, you also have to trust every employee at the company with privileged access, that their cyber security is adequate, and that all of their infrastructure providers can all be trusted. And given that you basically have to assume your information could be misused regardless of the company's intent.