No location tracking — ever.
At least 8 characters. Avoid common passwords — for your safety we block ones found in known data breaches.