Google's Marissa Meyer posted an essay on Google's privacy policy a couple days ago. In it, she also notes that Google's policy is to keep the home page at 28 words, so she had to delete the word "Google" after the copyright symbol in order to add a link to the privacy policy. Larry and Sergey made her do it.
(Yahoo's home page is incredibly busy, but its dedicated search page has just 16 words. Does anyone actually go to search.yahoo.com?)
There is so much paranoia over Google's increasing power, that it's worth going through the privacy policy. There's even a page on Wikipedia titled "Criticism of Google." Copyright violations, privacy, PageRank bias, keeping your search queries too long, etc. And, of course, governments could always subpoena data.
Most of the criticism tends to focus on what Google "could" or "might" do with all the data it collects. At least Google spells out its policy in clear terms. You may choose not to believe it, but I'd like to hear of any specific example of a violation of its policy.
It uses the data to deliver ads to you and to "improve" Google's services, including your search results. It provides "aggregated non-personal info" to outsiders to give advertisers (presumably) demographic data without identifying individuals. And it notes that some data is held on servers outside the country, implicitly acknowledging that some data might be more prone to break-ins. (Google employee data was recently stolen from an outside firm that Google used to use to store data.)
Personally, I'm completely comfortable with Google's practices. More companies should follow its example of clearly spelling out their privacy policies -- and of keeping their damn sites easier to use.