Translates as "We don't use encryption because it would cost too much, but we have ACLs so only our staff can look at your personal data"
Hmm, I read it more as "We actually have no idea what we're doing with any of this stuff and we're not giving you any more reasons to trust us with ANY data".
Written by their CEO => icing on the cake.
Agreed. That specific sentence reminded me all too much of snake-oil and charlatanry, and it coloured my reading of the rest of the apology.
Yep that sentence, and ones like it always worry me when I see them in companies' documentation about security. If the best thing you can say about your system and application security programme is that you use a firewall, that wouldn't fill me with a lot of confidence...
Yeah, that was kinda jarring, especially keeping their earlier claim about how silently stealing the address book was "industry best practice" fresh in mind.