[dead]
The graph has an AND-OR structure. Each node (circle) is a theorem statement, and each directed hyperedge (square) is an implication. To prove a theorem statement, all of the children of one implication must be proved.
- How long you retain it
- Who (which human, name and email) to contact when you have questions
- Which third parties get the data (if you use Google fonts, Google would be one of those, since it gets the users IP), etc.
That's the sort of default stuff that must be in a privacy policy, there are a few more things that you'd need to comply with GDPR and the UK's equivalent, but that's the kind of thing you need. :)