I have a small website that's publicly accessible, but isn't really anything other than some things I'm working on, and as such isn't really noticed. I don't care, it's my outlet to keep track of what I'm doing and show some like minded people.
There's a privacy policy. It basically says that yes, data about you is collected by the host. Some of it can identify you. They'll probably give it away if someone comes asking.
That's what most websites and companies should have because that's the truth of the matter.
I completely stopped using 3rd party hosting solutions when I discovered how easy it was to deploy tiny SBCs like Raspberry PI and Libre computers. My sites receive little traffic. I don't even bother posting a privacy policy. So far, no one has cared or noticed.
I don't want people hitting my home network for that. Hosting is $54 a year, it's worth that to have someone else take the abuse. Mine receives a decent amount, as in maybe 60-100 hits per post, and the remote host has better uptime than my home service.
I post the policy mostly because it's anti- everyone else. Mine says "Yeah, someone is going to fuck you. Too bad."
I do have some stuff running on my home network, but that's mostly just some crap that I use for testing ideas.