Privacy & your data
How to read a privacy policy in ten minutes
Nobody reads privacy policies, and the documents are written knowing it. Here is how to extract the five things that actually matter, and the specific phrases that should slow you down.
Privacy policies are written to be legally complete, and legal completeness is the enemy of readability. The result is a document that technically discloses everything and practically communicates nothing.
You do not need to read one end to end. You need five answers, and they are almost always in predictable places. This guide is about finding them quickly.
The ten-minute policy scan
Set a ten-minute timer and record yes or no for each test. Do not award partial credit for language that only says the company may explain something elsewhere.
| Time | Test | A clear "yes" looks like | If the answer is "no" |
|---|---|---|---|
| 0-2 min | Are collected data categories named? | Location, contacts, purchases, device identifiers, and similar categories are listed plainly. | Assume the collection scope is unclear and ask for the category list. |
| 2-4 min | Are recipients and purposes specific? | Each recipient category is paired with a purpose, such as payment processing or fraud prevention. | Treat broad references to "partners" as unresolved sharing. |
| 4-6 min | Is retention measurable? | The policy gives a duration or an event plus a fixed window. | Ask what deletion actually removes and when. |
| 6-8 min | Can you exercise your rights digitally? | A working form, email address, or account control is provided with a response timeline. | Do not assume the rights process is usable. |
| 8-10 min | Will material changes be brought to you? | The company promises direct notice before important changes take effect. | Save the dated policy yourself and expect to re-check it. |
Quick decision rule: four or five yes answers indicate a policy that is reasonably inspectable. Two or three mean you should resolve the missing answers before sharing sensitive data. Zero or one is a strong signal to choose a less intrusive service where possible.
Read it out of order
Skip the introduction entirely. It is scene-setting and it is never where the substance lives. Use the document's own navigation or your browser's find function and go straight to the sections that matter.
The five questions, in order of how much they should influence your decision:
1. Who else receives my data?
Look for a heading containing Sharing, Disclosure, Third parties, or Recipients. This is the single most important section in the document, and the one most likely to contain something you did not expect.
What you want is a specific, categorised list: which recipients, and for what purpose. Good policies name categories precisely — payment processing, fraud prevention, cloud hosting, customer support tooling — and many publish a live list of subprocessors.
What should concern you is a list of purposes so broad that it covers everything: "partners", "affiliates", "service providers", and "third parties we work with", with no indication of what they do. A list that cannot be narrowed is not a disclosure.
Pay particular attention to whether advertising or analytics partners appear here, and whether data is shared with them in a form that can be linked back to you.
2. Is it sold, or "shared" for advertising?
This has become a term of art. Several privacy laws define "sale" and "sharing" much more broadly than the everyday meaning — broadly enough that disclosing data to an advertising network in exchange for anything of value can qualify, even without money changing hands.
Search the document for sell, sale, and share. In policies covering certain jurisdictions you will find an explicit statement one way or the other, because the law requires one. If the answer is yes, there is normally an opt-out mechanism named in the same section. Use it.
3. How long is it kept?
Look for Retention, How long, or Storage period.
A meaningful answer gives you either a duration or a rule that resolves to one: deleted 30 days after account closure, kept seven years for tax records, retained for the life of the account plus a stated window.
A meaningless answer is "as long as necessary for the purposes described in this policy". That is circular — it means as long as we decide. It is unfortunately common and, on its own, not proof of bad behaviour. But a company that has actually thought about retention will usually tell you the number.
Check specifically for whether deletion of your account actually deletes anything, and what survives it. Backups, logs, and legally-mandated financial records typically do survive, and a good policy says so plainly instead of implying that everything vanishes.
4. What rights do I have, and how do I use them?
Look for Your rights, Choices, or Controls.
Depending on where you live, you may have rights to access a copy of your data, correct it, delete it, port it elsewhere, and object to certain processing. What you are checking is not whether the rights exist — largely they are set by law, not by the company — but whether the company has made them usable.
Concrete signals of a usable process:
- A named route: a specific email address, a form, or an in-product setting.
- A stated response time.
- An appeal or escalation path if a request is refused.
- The identity of the data controller and, where applicable, a data protection officer or representative.
If exercising a right requires you to send a letter to a postal address in another country, the rights are technically present and practically discouraged. Exercising your data rights covers the process end to end.
5. What happens if the company is acquired?
Search for merger, acquisition, or business transfer. Nearly every policy states that your data may transfer to an acquirer.
This clause is normal and almost universal, so its presence is not a warning sign. What is worth noticing is whether the company commits to anything at all around such a transfer — for example, notifying users, or requiring that the acquirer honour the existing policy. Many say nothing. The ones that make a commitment are telling you something about how they think.
The practical consequence: the privacy promises you are reading are made by the current owner, and companies change hands.
Phrases that should slow you down
Some formulations carry more weight than their length suggests.
- "We may..." — describes what is permitted, not what happens. A policy written entirely in may reserves maximum freedom and commits to nothing.
- "Including but not limited to" — the list you are reading is illustrative, not exhaustive.
- "Anonymised" or "de-identified" without explanation — these words carry specific legal meanings and are sometimes used loosely. Re-identification from supposedly anonymous datasets is a well-documented problem, particularly with location traces.
- "Aggregated data may be shared" — often reasonable, but worth understanding, because aggregate is a spectrum.
- "We use industry-standard security" — content-free. It tells you nothing about encryption, access control, or anything else.
- "By continuing to use the service, you accept the updated policy" — the policy can change unilaterally. Check whether they commit to notifying you of material changes.
Silent-risk clauses to search for
Some high-impact permissions are easy to miss because they appear in a definitions section, product-improvement paragraph, or general legal clause rather than under "Sharing".
Model training. Search for train, machine learning, artificial intelligence, and improve our models. Check whether private content, voice, images, or support conversations can be used; whether the data is de-identified first; and whether an opt-out applies to future use only or also to material already collected.
Broad partner sharing. Search for commercial partners, business partners, and jointly offered services. A partner category should still state what the recipient receives and why. "To provide offers that may interest you" is advertising language even when the advertising section is silent.
Retroactive consent. Search for continued use, effective immediately, and without further notice. A reasonable change clause identifies material changes, gives advance notice, and preserves a route to delete or export data before the new terms apply. Continued use alone is not meaningful consent when the user is never shown the change.
Copy-paste privacy clarification request
Send this to the privacy contact listed in the policy. Replace the bracketed line with the clause or data type you are asking about.
Subject: Privacy policy clarification request
Hello,
I am reviewing your privacy policy dated [effective date] and could not find a clear answer about [specific data, recipient, retention period, or model training use]. Please confirm:
- whether you collect or use this data;
- the purposes and legal basis for that use;
- every category of recipient that receives it;
- how long it is retained, including backups; and
- how I can opt out, delete it, or object to the processing.
Please also link the policy section or control that governs this use. I would prefer a written response by email.
Thank you.
Keep the reply with a dated copy of the policy. If the response introduces a purpose or recipient that the policy does not disclose, ask the company to identify when the public policy will be corrected.
Clause-comparison matrix: standard vs. protective vs. red-flag
Use this side-by-side matrix to decode boilerplate clauses and spot hidden risks:
| Privacy area | Common boilerplate | Protective clause standard | Red-flag formulation |
|---|---|---|---|
| Data sharing | "We share data with trusted third parties to support operations." | "We only share required technical telemetry with named vendors under binding data processing agreements that prohibit secondary use." | 🔴 "We may share your information with commercial partners and affiliated entities to provide relevant offers and advertising." |
| Model training & AI | "We use platform data to improve our services and algorithms." | "We do not train generative models on customer private communications, media, or file uploads without affirmative opt-in consent." | 🔴 "You grant us a perpetual, irrevocable license to use any submitted content for machine learning training and product synthesis." |
| Location tracking | "We collect location information to customize your experience." | "Precise GPS coordinates are collected only while actively using location features and discarded after session completion; coarse IP geo is retained for 30 days." | 🔴 "We collect continuous background location and Bluetooth beacon signals to provide geographically relevant sponsored content." |
| Retention & deletion | "We retain information as long as necessary for business purposes." | "User profiles and messages are purged 30 days after account deletion; encrypted database backups roll off after 90 days." | 🔴 "We retain certain account information indefinitely in archived form for analytical and fraud-prevention purposes." |
| Policy amendments | "We reserve the right to modify this policy at our sole discretion." | "We will provide at least 30 days' advance email notice of material policy changes and maintain a public version change log." | 🔴 "Your continued use of our platform constitutes unconditional acceptance of any modified terms without prior notice." |
Two things outside the policy itself
The change log. Better policies publish a version history or an effective date with a summary of what changed. A policy that quietly rewrites itself with no record is worth less than the same text with a record, because you cannot tell what you originally agreed to.
The cookie or tracking disclosure. Often a separate document, and often where the advertising and analytics detail actually lives. If the main policy is unexpectedly clean on tracking, this is usually why.
What good looks like
A policy worth trusting tends to share a few traits: it is written in plain sentences rather than defensive ones, it gives numbers where numbers exist, it names categories of recipients instead of gesturing at them, it makes rights easy to exercise, and it does not require a second document to understand the first.
None of that guarantees good behaviour — a policy is a statement of intent, not evidence of practice. But a company that has taken the trouble to be comprehensible has usually taken the trouble elsewhere too, and a company hiding straightforward facts behind unreadable prose is telling you something you should hear.