For you the important part is informing us what happens to the data with a Privacy Policy, and I would also have a Terms of Service requiring uploaders to acknowledge the rights of others, including privacy and intellectual rights.
No, I mean the uploader can upload any photo and your Terms of Service should specify what constitutes misuse. You are not legally required to have a Terms of Service, and the photos people upload are not published, but it still doesn't hurt to create an agreement.
You can put a "By uploading an image you agree to our Terms of Service and Privacy Policy" text on the website with the links. This is not a legal advice of course, I cannot be sure that this makes your Terms of Service enforceable, but this is how others like Imgur do it.
I tried to upload my own face but I could not figure out how to upload a mask? Or does it need to match the existing mask?