Another point that I think is important to mention is that the privacy policy needs to refer to "user account" in such way that it'll be clear that it's talking about accounts for contributors (FAS) and not a user account on your system or an online account you add via GOA, to make it clear Fedora doesn't scrape your name (or other identifying details) from Google / Facebook accounts added via GOA, nor the "Full Name" field of user accounts on your computer.

-Elad Alfassa.