So, good observation in the abstract, but: 1) you're responding to someone who said "some jurisdictions" 2) siavosh's Twitter profile suggests that they're in San Francisco.

While it's true that it may not be a legal requirement (in some jurisdictions) to post a privacy policy, it's probably not a good idea to trust a service without one, particularly if said service is designed for posting potentially private personal information.

In other words: They should post a privacy policy - not because it's a legal requirement (though it may be) - but because it's good business. And no one will trust them otherwise.

Serious question: Do people treat privacy policies any different than EULA's? (To wit: Abstruse legalese that doesn't really tell anyone anything?)

I can summarize 95% of privacy policies right here:

    * We won't sell your info (directly)
    * We "may" provide your info to third parties based on ill-defined criterion
    * We can change this at any time without telling you first
    * If we get bought (which is likely), this is all rendered invalid
    * If we break our word here, your recourse is precisely jack

I trust no privacy policy. Once something is online, it's no longer under my control. So it's either for public use, or it's securely encrypted.