It doesn't matter that it theoretically all happen in the browser. You can serve different versions to different IPs etc. Every heuristic in me would be screaming don't use that if I would have a need for such tool.
Users are disclosing to the website what they hope has not been discovered by someone else -- e.g., usernames and email addresses, or in this case photos, they hoped to keep private. Unfortunately, the website is "someone else".