IANAL, but at minimum you should have a clear privacy policy that outlines what you do collect, why you collect it, and how you use it. You should also offer, to the best of your ability, a way for the user to opt-out if possible.