It would only be a member uploading privates. Or, if somehow a site (or model/member computer) was compromised that privates could be uploaded. Same as Skype, Duo, etc.
Regarding Skype, Duo, etc. have them pay in token via whatever site you're on. CB, MFC, etc. and not through Paypal, Google Wallet, etc. this way they can't do chargebacks. I'm not familiar enough with it. But, SkyPrivate is a third party method of getting paid for Skypes. There's been quite a few mentions of it on ACF, so if you do a search might learn more about it.
I'm not sure what your per minute rate is, nor tipping during privates etiquette because I'm not overly familiar with CB as I'm on MFC. But, the models I know who do Skypes charge the same as, or more than, a TruePrivate which is 80 tokens per minute. This is because they have to stop the cam, switch over to Skype do thing there, monitor the time, etc. all while losing people in their room. If you think about it, it's also much more than an exclusive/TruePrivate. MFC doesn't allow a model to adjust her rates. It's either 60/min for spyable private or 80/min for TruePrivate (exclusive and not spyable).
If you're only planning to do offline sessions with regulars who tip during a show for extra things, it'd be worthwhile to come up with an equivalent pricing of what your average per minute is for those privates and then add some extra. Everyone is different. But, IMO, it'd be a lot easier to just charge a higher rate and not deal with tips during a private. The guarantee is what your per minute rate is, tips are just a bonus and not guaranteed. Also, if you're at a low rate where you charge extra for things during, if it's a regular who says they didn't get enough tokens when they ask to do something would you still do it or would you say no only to find they ran the private longer than normal?