Unless you're based in some lawless jurisdiction, a privacy policy absolutely does protect users. If you believe otherwise, it's probably not a good idea to verbalise that opinion, especially if you are offering mailbox services :)