I'm building an app that works across mobile devices and browsers. There is a chat component and I will be showing the profile photos that I find on the user's phone book (not from the image folders). To make these images visible on the web if the user works on a browser, I upload the profile photos from the user's phone to a server, and deliver them to the web app.
To support OTHER users, if they do not have a profile photo on their phone, I intend to display the first one that was uploaded, which came from somebody else's phone.
The app asks for permission to use the users phone book. And there is fine print that the profile photos will be used in this manner.
Irrespective of the fine-print, is this 'acceptable use'? Am I opening my company to some risk?