You'd have to act on the privacy trigger to reliably do that or try grabbing the POST data yourself for the privacy rule.

I tried to copy the system privacy autoaction for gallery and move it above mine, same thing for the privacy plugin above the gallery plugin. This still gives privacy : null

Are they both acting on the same trigger? It's still entirely possible the privacy store hasn't happened yet when your auto action is processing. I'm sorry, I just don't have a solution for you in this regard. The only way to guarantee you can get the privacy rule after it has properly processed is to act on CB Privacy trigger, which is privacy_onAfterCreatePrivacyRule.

Can you tell me if an item inherits the privacy settings of an album ? Uploading a new file in a private album still shows the file as public for instance.

Album privacy doesn't override media privacy at this time. It only controls access to the album itself. Media privacy is separate. That will change in a future CB Gallery release where the integration will be more tightly coupled to CB Privacy instead of relying on CB Auto Actions to handle it as it will be easier to set media default privacy to album privacy then.