> we will not do anything remotely creepy with your data

That is exactly what I'm trying to advocate for in my post. However, I don't agree that you should wait until you can afford a lawyer to put up a policy. Think of it this way: If a regulator comes knocking at your door accusing you of some privacy violation are you better off saying, "I couldn't afford a lawyer which is why I have no policy," or "I couldn't afford a lawyer but I did my best to comply with the law as I understood it?"

I think the later is obviously the better position. In addition you get the trust building benefits to boot.