I'm looking into how to document privacy for an RSS-based, federated service, and I'd love to see how others have handled it.
Specifically: what happens to a post once it leaves your server — syndicated over RSS, cached, crossposted to another instance, or shown by third-party readers? I'm based in Europe, so I'm especially keen on examples that aren't written purely from a US angle. Not looking for legal advice — mostly how people have actually thought about it.
A couple of decisions I ended up making, as discussion starters (and because I'd genuinely like to hear if others went a different way):
Erasure vs. federation. Once a post has been crossposted to another server, my take is that actual removal over there is up to that server (caches, archives) — we request the takedown, but can't guarantee it. How do you word this without either over-promising or scaring people off?
Traces after deletion. When an account is deleted, its old public address returns a permanent "account withdrawn" (HTTP 410) — which still reveals that a handle once existed. I chose to spell that out rather than pretend deletion is total. Does anyone handle this differently?
For context, here's where we're at right now (available in several languages; English here):
https://sofab.ch/public/legal/privacy-en.html
Genuinely interested in the RSS/federation side specifically.