> we will not do anything remotely creepy with your data
That is exactly what I'm trying to advocate for in my post. However, I don't agree that you should wait until you can afford a lawyer to put up a policy. Think of it this way: If a regulator comes knocking at your door accusing you of some privacy violation are you better off saying, "I couldn't afford a lawyer which is why I have no policy," or "I couldn't afford a lawyer but I did my best to comply with the law as I understood it?"
I think the later is obviously the better position. In addition you get the trust building benefits to boot.
The issue is that the Privacy Policy is (or certainly can be viewed as) a legal document. Therefore I'm strongly inclined to believe you're better off with a lawyer approved document.
I'd love to have our privacy policy be "we will not do anything remotely creepy with your data" (in fact maybe we'll add that to our current document), but that is so ambiguous I think users will not be satisfied, and lawyers will have a field day.
That is exactly what I'm trying to advocate for in my post. However, I don't agree that you should wait until you can afford a lawyer to put up a policy. Think of it this way: If a regulator comes knocking at your door accusing you of some privacy violation are you better off saying, "I couldn't afford a lawyer which is why I have no policy," or "I couldn't afford a lawyer but I did my best to comply with the law as I understood it?"
I think the later is obviously the better position. In addition you get the trust building benefits to boot.