A privacy policy is a promise. A missing upload endpoint is a fact. The difference matters when you are handling someone else's media.