The basic rule: you own your data. This includes the design of your application and the data that your users upload (pursuant to your own agreement with them, of course).