I'll immediately agree to that but in the spirit of the GDPR which allows you some screwups, isn't that still better than keeping non-encrypted personal data on a small VPS you have no idea if other people have no unlimited access to?

I shut down my hobby projects because I didn't want to rework them. Deleted everything, never sold info to anyone, never served ads and had exactly zero external JS snippets on them.

If I am to open a business, I'll however work a lot to be GDPR-compliant. I believe it was about damn time for something like that to emerge.