Privacy-first photo management