Launch Readiness: Legal and Security for AI-Built Apps

You built an app with an AI coding tool, and it works. This course is the list of things I check before an app like that takes real users and real money. It covers who can read your data, what your paperwork must say, when you need consent, what to disclose about AI features, how subscriptions and email must behave, and more. Each item links to the law, the regulator page or the vendor doc it rests on, so you can check it yourself.

What this is

It is a launch checklist, taught one stage at a time. Each stage explains one area in plain words, gives you the checklist items for that area, and gives you a prompt that makes your coding agent audit your own code against those items.

I wrote it after I ran the same checks on my own app, Ducktate. Some items passed. Some did not, and a few are still open. Stage 11 shows that audit, with the gaps, so you can see what this looks like on a real product.

Who it is for

You built a web or mobile app with Claude Code, Cursor, Codex, Lovable, Bolt or a tool like them. You do not have a legal background or a security background. You want to know what you must do before launch, and you want each claim backed by a source you can open.

You do not need to read code to use this course. Your coding agent reads the code. You read the report and decide.

How each stage works

Every stage has the same parts, in the same order:

1. The short answer. What the stage is about, in two to four sentences.
2. Why this matters. Real incidents and real numbers, each with its source.
3. Core concepts. The few ideas you need, each with one worked example. Every term is defined the first time it appears.
4. Key terms. Flashcards for the words that matter.
5. The checklist. One action per line, each with its source and a tag: Must do, Should do, or If it applies.
6. The prompt for your agent. Copy it into Claude Code, Codex or Cursor. The agent audits your code against the checklist and reports each item with the file and line. It changes nothing until you approve.
7. Common mistakes, a short quiz, and resources.

Every stage also shows the date its facts were checked. Laws and vendor rules change, so that date matters.

The eleven stages

The order follows a launch. First protect your data, then check what you load, then what you promise, then consent, then special kinds of data. Next comes build quality (accessibility), then features (AI and user content), then money (subscriptions and email). The last stage makes it all stick.

1. 18 min

   Lock down your data

   Who can read and write your database, which keys may sit in browser code, a Supabase change on 2026-10-30, and the clock that starts if data leaks.

2. 16 min

   Third parties and dependencies

   Scripts, fonts and services that see your users' data, the data processing agreements you sign with them, open-source licenses, and poisoned packages.

3. 19 min

   The paperwork

   Your privacy policy, terms and cookie notice, where templates fall short, and the rules app stores and sign-in providers check.

4. 18 min

   Consent before tracking

   Analytics, session replay and cookies: when you need consent first, the Global Privacy Control signal, and California wiretap suits.

5. 19 min

   Sensitive data: health and kids

   Health data and ad pixels, the FTC Health Breach Notification Rule, and children's data under COPPA.

6. 15 min

   Accessibility

   The WCAG AA standard, accessibility lawsuits, and the European Accessibility Act.

7. 19 min

   AI features

   Telling people they talk to an AI, the EU AI Act transparency article, California's companion chatbot law, Apple's rule on sharing data with AI, and your model provider's terms.

8. 16 min

   User content

   If users can post or upload: a DMCA agent, the TAKE IT DOWN Act, Section 230, and the EU Digital Services Act.

9. 16 min

   Subscriptions and cancellation

   Auto-renew disclosures, easy cancellation, the federal ROSCA law, California's auto-renewal law, and where the FTC click-to-cancel rule stands.

10. 18 min

    Email and texts

    Marketing email and text messages: CAN-SPAM, the Gmail and Yahoo bulk sender rules, Canada's CASL, and the TCPA.

11. 19 min

    Make your agents remember

    One audit prompt for the whole course, a rules block for AGENTS.md or CLAUDE.md, and what I found when I ran this on Ducktate.

A stage marked "Coming soon" is being written and checked. The full checklist grows as each stage is published.

One evening or one week

One evening. Read the short answer of each published stage. Open the full checklist and do the Must do items. Paste each stage's prompt into your coding agent and read its report. Fix what it finds before you take sign-ups.

One week. Do one or two stages a day. Read the core concepts, run the prompt, fix what fails, and take the quiz. Save each decision where your agents will read it on every build (Stage 11 shows how). At the end, tick through the full checklist once more.

Either way, the order matters less than the first stage. If you only have an hour, spend it on Stage 1.

Other free courses

If you run several coding agents at once, the Orchestrator Course shows how I split work between them and check what they return. After launch, GTM Engineering teaches how to find and keep customers. Every course is on the Learn page.

Questions people ask

Is this legal advice?

No. It is a starting point written by a founder, with a source for each claim. Laws differ by state and by country, and they change. Talk to a lawyer licensed where you and your users are before you rely on any of it.

Why does an app built with AI need this more than other apps?

The checks are the same for every app. The difference is speed and review. An AI tool can create a database table, a key or a tracking script in seconds, and nobody may read the change. Supabase gave this as its reason for changing how new tables are exposed: agents, scripts and AI platforms create tables too, and many of those changes have no human reviewing the diff (Supabase changelog).

My app is small. Do these rules apply to me?

Some do and some do not. Some laws apply only above a size or revenue test, and some apply only if you have users in a certain place. Other items, such as locking down your database, apply to every app that stores user data. Each stage says which items depend on your situation with the tag If it applies.

Can my coding agent do the audit for me?

It can do most of the reading. Each stage gives you a prompt that makes the agent check every item and report the file and line. The agent can still miss things or report a pass it did not prove, so read the evidence it gives you. Treat a platform's built-in security scan the same way: Lovable's own docs say its scans do not replace a thorough security review (Lovable docs).

How current is this?

Each page shows the date its facts were checked. The facts in the published stages were checked on 2026-10-09. When a law or a vendor rule changes, I update the stage and its date. Always open the linked source before you act.

Do I have to do every stage before launch?

No. Do Stage 1 first, because a leaked database hurts your users at once. Then do the stages that match what your app does: if you take payments, Stage 9; if you send marketing email, Stage 10; if users can post, Stage 8.