RFC: draft of new privacy policy