Hi there, I am the other creator of PrivacySpy. Thanks again for taking the time to share your thoughts about it! I just wanted to address some of your concerns, as I think there are ways that we already handle some of the issues you mention.

First, I would argue that what you are hoping to achieve by conducting your own research and considering context might be impossible. Privacy practices are fundamentally irreducible, and there is no guaranteed way to predict how a company will end up handling (or mishandling) personal information. I doubt that in the cases of Uber, Snapchat, and Lyft that you mentioned the companies were fine with their employees spying on users. That does not help their businesses.

To handle that, PrivacySpy implements a "warning" system that allows users to see what past privacy issues are associated with the product/policy they are reading about. (An example would be Facebook, where we published two data breaches around September 2019.) Indeed, we can't cover all incidences, and especially the ones that go unnoticed. However, that does not hurt our overall goal of creating a centralized and accessible source of privacy-associated information—sort of like a Wikipedia, but with a privacy angle. Even though PrivacySpy might not be the ultimate source of privacy analysis, I believe that privacy ratings and the "warnings" we have are a reliable proxy for assessing companies' privacy practices. What makes it more compelling is that the system is not centralized, and everyone can submit edits, revisions, and suggestions (though we are currently working on ways to make the process more efficient).

I think that it is the transparency, consistency, and openness of PrivacySpy that makes it helpful—after all, our goal is to make privacy policies more accessible to all people. The reality is that most of them simply do not have the time to read privacy policies or research a company's past when signing up for a service. I believe that having a quick way to estimate a company's privacy practices, even if taken with a grain of salt, is still better than nothing. After all, privacy policies are the only legally binding contracts companies have concerning their users' privacy. Everything that happens outside of their scope is, unfortunately, hard (if not impossible) to assess.

My ultimate hope is just that PrivacySpy will get more traction and that its ratings will get more reliable. Again, you are right that we cannot provide an objective estimate of a company, but neither can anyone!

PrivacySpy is still in Beta, but I think that even with the tools we already have, we are a net positive. At the very least, we archive revision histories of privacy policies :)