IMHO, they should allow the user to generate the hash without surrendering the sensitive material. Use an open standard that can’t be reversed. It’s utter insanity to give the most intimate photos you have to any company, but especially this company.