3 ms·

For a very early stage startup caring about privacy does not immediately translate to displaying a privacy policy. For us it was a day 1 decision: we will not

by tworats 15y ago

For a very early stage startup caring about privacy does not immediately translate to displaying a privacy policy. For us it was a day 1 decision: we will not do anything remotely creepy with your data. We will guard what you give us carefully and collect only what we need to operate our service. This is a fundamental and important part of our ethos. Still, it took us more than 6 months to get an externally visible privacy policy in place, because lawyers are expensive and not displaying a policy did not kill us.

jnorthrop 15y ago
> we will not do anything remotely creepy with your data That is exactly what I'm trying to advocate for in my post. However, I don't agree that you should wait until you can afford a lawyer to put up a policy. Think of it this way: If a regulator comes knocking at your door accusing you of some privacy violation are you better off saying, "I couldn't afford a lawyer which is why I have no policy," or "I couldn't afford a lawyer but I did my best to comply with the law as I understood it?" I think the later is obviously the better position. In addition you get the trust building benefits to boot.
- tworats 15y ago
  The issue is that the Privacy Policy is (or certainly can be viewed as) a legal document. Therefore I'm strongly inclined to believe you're better off with a lawyer approved document. I'd love to have our privacy policy be "we will not do anything remotely creepy with your data" (in fact maybe we'll add that to our current document), but that is so ambiguous I think users will not be satisfied, and lawyers will have a field day.