At least 8 characters.
The Privacy Policy says what we do with your data. We record which version of the Terms you agreed to, and you can read it back in your data export.