While it's true that it may not be a legal requirement (in some jurisdictions) to post a privacy policy, it's probably not a good idea to trust a service without one, particularly if said service is designed for posting potentially private personal information.
In other words: They should post a privacy policy - not because it's a legal requirement (though it may be) - but because it's good business. And no one will trust them otherwise.
Serious question: Do people treat privacy policies any different than EULA's? (To wit: Abstruse legalese that doesn't really tell anyone anything?)
I can summarize 95% of privacy policies right here:
* We won't sell your info (directly)
* We "may" provide your info to third parties based on ill-defined criterion
* We can change this at any time without telling you first
* If we get bought (which is likely), this is all rendered invalid
* If we break our word here, your recourse is precisely jack
In other words: They should post a privacy policy - not because it's a legal requirement (though it may be) - but because it's good business. And no one will trust them otherwise.