Since the developer is also said to be running the website where screen shots to be edited are stored, and is resident in the UK, it would seem that the GDPR-UK applies. (The EU version may also apply when a user is in the EU.) This means that the Data Controller (DC) must have a lawful basis under Article 6
The most plausible basis would seem to be point (b) of article 6 paragraph 1. That reads:
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
For this to apply, the DC would need to include in a ToS document or in some other relevant document that a user must accept, contractual language in which the Data Subject (DS) agrees to submit data for processing, and the DC agrees to recive, process, and return it. There would probably be other provisions as well. One of them might be that the content could not itself be unlawful, another that the DS has all needed rights to submit the content for creation of a modified version, yet another that the service could not be used for any unlawful purpose.
However, other GDPR provisions would also apply. In particular, Article 5, paragraph 1 point (e) reads in relevant part
[Personal data shall be] kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ...
this suggest that such screen shots should not be retained indefinitely, but rather deleted securely as soon as the modified versions have been transmuted to ther users who have requested them. While 5. (b) does permit retention for archiving purposes, it is better practice to retain no more thasn needed. Furthermore, if such information is to be retained as an archive, that should be disclosed to the user under Article 13 specifically 13.1(c) and 13.2(a). Those require disclosing the purpose and lawful basis of procession, and the expected time of retention or the criteria used to determine the retention period.
Othre disclosures liosted in article 13 would also apply.
The idea of consent on the basis of "by using this app/site you consent to ..." is not valid consent under the GDPR. Specifically Article 7 requires that consent can be withdrawn at any time, and be easy to withdraw. Recital 32 states:
Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. ... Silence, pre-ticked boxes or inactivity should not therefore constitute consent.
Thus contractual language, explicitly agreed to by the DS, is a much better basis than such implied consent.
