Build a privacy-first photo transfer product that imports only photos explicitly chosen through the device photo picker. Each transfer receives a visible manifest showing selected, uploaded, verified, failed, and retried files, while cloud deletion is clearly separated from deletion of local originals. Start with invitation-based shared albums and verified delivery between iPhone, Android, and a browser.

The signals show sustained frustration with forced full-library access, unreliable synchronization, storage lock-in, and ambiguous deletion. Mixed-device photo sharing remains common, while platform privacy controls make a selective-access alternative practical.