That is exactly what I'm trying to advocate for in my post. However, I don't agree that you should wait until you can afford a lawyer to put up a policy. Think of it this way: If a regulator comes knocking at your door accusing you of some privacy violation are you better off saying, "I couldn't afford a lawyer which is why I have no policy," or "I couldn't afford a lawyer but I did my best to comply with the law as I understood it?"
I think the later is obviously the better position. In addition you get the trust building benefits to boot.
I'd love to have our privacy policy be "we will not do anything remotely creepy with your data" (in fact maybe we'll add that to our current document), but that is so ambiguous I think users will not be satisfied, and lawyers will have a field day.
For us it was a day 1 decision: we will not do anything remotely creepy with your data. We will guard what you give us carefully and collect only what we need to operate our service.
This is a fundamental and important part of our ethos.
Still, it took us more than 6 months to get an externally visible privacy policy in place, because lawyers are expensive and not displaying a policy did not kill us.