Your privacy policy must match the code, not your intentions. It describes what you actually collect, not what you intended to. A lying policy is legally worse than none.