For external uploaders (API usage), Virtual AutoGrant forces added virtual categories as 'private', grants access only to creator, and set "Who can see these photos?" to creator's privacy level at least (except webmaster).