I suggest starting with the Jackrabbit project's policy, which many old
threads show was discussed with the ASF Legal team:
https://jackrabbit.apache.org/privacy-policy.html
A wide number of Apache projects use Google Analytics, which is fine in
general as long as you're careful to comply with the relevant Analytics
policies. A few projects use other methods of tracking users; in those
cases you should check with legal-discuss@ to see what sort of policy is
needed.
In general, note that Apache has a very strong history of respecting
user privacy - both of people who browse our websites, as well as our
contributors (within the limits of ensuring we have clean IP to our
projects!). The main apache.org homepage doesn't have a privacy policy,
mainly because we don't track anything about users there.
A number of other projects use Analytics on parts of their websites and
not on other parts, so this isn't necessarily so unusual. However I
wouldn't be surprised if our future hosting of things like forums and
content on the openoffice.org domain means that this project will need
to have some more thorough privacy and other policies in the future.
- Shane
