In general there is an entire category of the majority of users who don't care enough about their privacy, and then a second group who want to know that it's been considered but appreciate the convenience of relying on a third party. (I think the Signal app is good example of a tool attempting to cater to these first two categories.)
A slightly overlapping but mostly separate third group is not going to be satisfied by just about anything a third party claims to do (often in part due to nation-state level considerations) and typically doesn't use off-premises tools like this one. It is hard to justify attempting to meet the needs of this small but vocal group of users since it reduces the level of convenience (and thus mass-market appeal) that can be offered to the other groups.
It is, however, very much worth documenting where the line is drawn because doing so can alleviate legitimate concerns of the privacy-conscious but busy second group and avoid public outcry (caused by speculation/proof of incompetence and/or indifference) being picked up by the majority of potential users.
https://dnslearning.org/privacy
The wording isn't perfect yet and we have to be careful how we say things, but we don't sell any data to a third party. We don't use Google Analytics either or anything like that.
We automatically delete the data after 30 days and we actually have this implemented so the user can decide how long they want data to be kept, but when I cleaned up the UI the ability for users to modify this setting got lost.
I don't see a privacy policy or other page which makes it clear what information you collect and how that information is stored.
How is session management handled from the point of view of administering the service, how does the service track users and for how long is that information stored?