OK, I understand. Let's forget the categories then.
So a user hits My Album, uploads a few pics and indicates it to be private. So where's the password? If the user doesn't set then who does? You say categories and users are totally different and the password you set for categories has no bearing on albums.
Also, you stated the link would be private, that it would have to be given out. Then why is it when I login as another user go to PhotoPost I can see the pic I just uploaded as the original user?