A privacy policy is basically a short statement of two things:

• The kind of information you collect from your visitors
• What you or your business will do with that information

Every website collects something, from IP addresses that give you some good info on your site visitors in your Squarespace or Google analytics, to blog comments who record emails with the submission.

That said, a privacy policy is necessary for anyone that has their own self-hosted website regardless of whether they’re selling anything yet (for example, you would not need one if your only business web presence was a Facebook page).