Yes. Your current simple privacy policy ("We will not share your email address with anyone.") is nice, but it doesn't address the privacy of users' content (i.e. the images they send you).

I don't doubt that you intend to do the right thing, but still, I was honestly a bit wigged out to not see any mention of the privacy of my data in the privacy policy.

Indeed, I really was kidding, so no offense meant. I am an info-sec professional by trade, so I'm naturally a bit cynical and paranoid when it comes to offloading certain things to third parties. It's good to know you have a privacy policy, though. It wouldn't hurt if you explain your data retention and destruction policy, though. If you'd like some ideas from me on ways to improve your handling of ephemeral data, let me know. Contact info in my HN profile.

Unless you could find a solid impression based advertising provider or are willing to spend the time finding advertisers I wouldn't add anything to the image itself except (maybe) the URL to your homepage. For the email bit you'd still have to be careful with the TOS that most pay-per-click ad agencies have regarding email.