There's a thread in the webmaster's issue queue that has had some sporadic traffic over the last couple of years about creating a privacy policy for *.drupal.org. Currently, the last post is a draft proposal that IMO needs a lot of work before it could be submitted to an attorney or proposed to the community for use on the site. I know that one of the things holding this up has been the lack of a dedicated attorney for the Drupal Association, but IMO there's no reason that this group couldn't continue to work on this up until such time as one is retained and can review any proposed policy. Even if changes end up having to be made to it, being able to provide the attorney with a well-developed draft will give him or her a much better sense of what the community is looking for, which in turn will save both time and money for the Drupal Association. To that end, I've also invited Crell into this group.
Another potential resource to look at is the WordPress.org privacy policy, which is available under a CC Attribution-Share Alike license: http://wordpress.org/about/privacy/ - given how much WordPress has (lovingly) borrowed from Drupal over the years, I see no reason why we shouldn't consider looking at this policy, which has been vetted by Matt Mullenweg's very expensive attorneys, as a reference for Drupal.org.