A method of distributing customized privacy-preserving images to a plurality of users, the method comprising employing at least one hardware processor of a privacy management server to: in response to receiving an encrypted source image decryptable with an administration key, perform an encrypted-domain image segmentation of the source image to produce a plurality of user-specific encrypted private images, wherein: a selected private image comprises a region of the source image selected to show a private item of a selected user of the plurality of users, and another private image comprises another region of the source image selected to show a private item of another user of the plurality of users; in response to the image segmentation, perform an encrypted-domain key change procedure to produce a plurality of user-specific re-encrypted images, wherein: a selected re-encrypted image comprises a result of transforming the selected private image from being decryptable with the administration key to being decryptable with a private key of the selected user, and another re-encrypted image comprises a result of transforming the other private image from being decryptable with the administration key to being decryptable with a private key of the other user; and transmit the plurality of user-specific re-encrypted images to an image distribution server for further distribution to client devices configured to reconstruct user-specific plaintext versions of the source image. in response to receiving an encrypted source image decryptable with an administration key, perform an encrypted-domain image segmentation of the source image to produce a plurality of user-specific encrypted private images, wherein: a selected private image comprises a region of the source image selected to show a private item of a selected user of the plurality of users, and another private image comprises another region of the source image selected to show a private item of another user of the plurality of users; a selected private image comprises a region of the source image selected to show a private item of a selected user of the plurality of users, and another private image comprises another region of the source image selected to show a private item of another user of the plurality of users; in response to the image segmentation, perform an encrypted-domain key change procedure to produce a plurality of user-specific re-encrypted images, wherein: a selected re-encrypted image comprises a result of transforming the selected private image from being decryptable with the administration key to being decryptable with a private key of the selected user, and another re-encrypted image comprises a result of transforming the other private image from being decryptable with the administration key to being decryptable with a private key of the other user; and a selected re-encrypted image comprises a result of transforming the selected private image from being decryptable with the administration key to being decryptable with a private key of the selected user, and another re-encrypted image comprises a result of transforming the other private image from being decryptable with the administration key to being decryptable with a private key of the other user; and transmit the plurality of user-specific re-encrypted images to an image distribution server for further distribution to client devices configured to reconstruct user-specific plaintext versions of the source image.