Privacy disclosures should occur in more than just privacy policies. Conceptually, here’s how I think of where a disclosure should go (subject to applicable law of course). In many cases, significant features will end up in several locations in this stack.