Sounds like either they’re just being lazy and trying to avoid generating a privacy policy, or they’re up to no good and trying to be vague on purpose. I lean towards the former.
If they don’t have ads, that means there would be no cookie tracking which is what I think they’re trying to explain. But if they have login available, they might still use cookies to remember who you are.
Privacy policies can be generated in a few minutes online. And nowadays with GDPR, you would think it’s a no brainer to properly let your users know what you’re collecting.