Is a "policy" is a "contract"? What does the user agree to by reading a policy? Why is the privacy stuff separated out into a "policy" instead of being part of the Terms of Service? How does the user (cf. the company) "enforce the policy"? Do companies ever violate their own policies? Do they announce this to the public when it happens? How do we determine when a company has violated their own policy?

These are meant to be rhetorical questions but I am curious how people would answer.