Ideas for policies to protect Suggested Tiles users' data

[ For context around Suggested Tiles, please read http://ed.agadak.net/2015/04/whys-and-hows-of-suggested-tiles ]

I've blogged about how we've been careful in our initial approach of showing suggestions to existing users with Suggested Tiles. Some of that care is built into Mozilla policies that users need to trust are correctly followed when creating suggestions and running services.

I'm curious about what people think would be appropriate policies for Suggested Tiles that help protect user data. Below are some initial ideas some reasoning that people can discuss and provide feedback:

- suggestions are made to groups of at least 5 sites to allow deniability of which site the user visited
- these groupings will include as many popular sites relevant to the topic to avoid having one site be clearly dominant
- disallow complex targeting that would match on multiple aspects at a time to limit what can be inferred
- show only one suggestion at a time to restrict triangulation possibilities
- continue the aggressive data deletion policy of existing Tiles services
- focus on uncontroversial topics, so exclude adult content, drugs/alcohol/tobacco, illegal gambling, weapons, politics, religion

As I mentioned, these are ideas and not necessarily set in stone, so please provide your thoughts on what could be added, removed, or tweaked.

Ed Lee