I have had this concern for a few days and adapted the Mastodon privacy policy (adapted from the Discourse policy) and published it https://github.com/BanzooIO/federated_policies_and_tos/blob/main/lemmy-privacy-policy.md
Discussion on this has been started: https://lemmy.ml/post/1431759 and https://lemmy.ml/post/1431930. Open to any recommendations