Launch Readiness glossary and flashcards

Drill the terms

Read the term. Say the definition out loud before you flip, then be honest. A card you know moves up a box and comes back less often. A card you miss goes back to the first box. Ten minutes a day beats an hour on Sunday. Your boxes stay in this browser only.

Every term, A to Z

Search terms

Accessibility

Making an app usable by people with disabilities, including those who use a keyboard, a screen reader or large text. Stage 6

Accessibility statement

A public page that says which standard you aim for, known gaps, and how to report a problem. Stage 6

Actual knowledge

Knowing a user is under 13, for example because a parent told you, which brings a general app under COPPA. Stage 5

ADA Title II

The part of the US disability law that covers state and local governments. Stage 6

ADA Title III

The part of the US disability law that covers businesses open to the public. Stage 6

AGENTS.md

The instruction file Codex reads from your project. Cursor reads it too. Stage 11

AI coding agent

A tool such as Claude Code, Codex or Cursor that reads and writes code in your project for you. Stage 11

Alt text

A short text description of an image that a screen reader reads aloud. Stage 6

Analytics

A tool that counts visits and actions so you can see how people use your app. Stage 4

ANPRM

An advance notice of proposed rulemaking, the first step where an agency asks questions before writing a rule. Stage 9

Article 50

The EU AI Act article on transparency: tell people about AI chat, mark AI output, and label deepfakes. Stage 7

Audit

A check of your code and settings against a list, where every result comes with evidence. Stage 11

Authentication

Checking who someone is, usually with a login. Stage 1

Authorization

Deciding what a known person may read or change. Stage 1

Auto-renewal

A subscription that starts a new term and charges again unless the customer cancels. Stage 9

Autocapture

A setting that records every click and form interaction without you choosing which. Stage 4

Automated testing tool

A scanner such as axe, WAVE or Lighthouse that finds rule breaks a machine can detect. Stage 6

Automatic Renewal Law

California's subscription law, Business and Professions Code sections 17600 to 17606. Stage 9

Broken access control

A bug where a user can see or do something they should not, number one on the OWASP Top 10. Stage 1

Browsewrap

Terms behind a footer link that users never actively agree to, which courts often refuse to enforce. Stage 3

Bulk sender

A sender of more than 5,000 messages a day to Gmail accounts, under Gmail's rules. Stage 10

CalOPPA

California's online privacy law: any app that collects PII from Californians needs a posted policy, at any size. Stage 3

CAN-SPAM

The US federal law that sets the rules for commercial email. Stage 10

CASL

Canada's anti-spam law, which requires consent before most commercial messages. Stage 10

CC0

A license that lets you use and change a work with no conditions, not even credit. Stage 3

CCPA

California's consumer privacy law, which only covers businesses that pass a revenue or data-volume test. Stage 3

CIPA

The California Invasion of Privacy Act, an old wiretap law used in suits over replay, chat and pixels. Stage 4

CLAUDE.md

The instruction file Claude Code reads from your project. Stage 11

Clear and conspicuous

Easy to notice and easy to understand, not hidden in small print or a link. Stage 9

Click-to-cancel rule

The FTC's 2024 nationwide cancel rule, vacated by a federal appeals court in July 2025. Stage 9

Clickwrap

Terms the user accepts with a clear click or checkbox next to a link to them. Stage 3

Commercial email

An email whose main purpose is to sell or promote a product or service. Stage 10

Companion chatbot

Under California SB 243, a human-like AI that meets social needs and keeps a relationship across chats. Stage 7

Consent banner

A notice that asks visitors to accept or reject tracking before it starts. Stage 4

Consequential decision

A decision about hiring, lending, housing, insurance, health care, education or public benefits. Stage 7

Contrast ratio

How different text and background colors are; AA needs 4.5:1 for normal text. Stage 6

Controller

Under the GDPR, the business that decides why and how personal data is used: you. Stage 2

Cookie

A small file a website stores in the browser, often used to recognize a visitor later. Stage 4

Cookie notice

A page that says which cookies and similar storage your site uses and why. Stage 3

COPPA

The US Children's Online Privacy Protection Act and the FTC rule that carries it out, for children under 13. Stage 5

Copyleft

A license rule that changed versions must stay under the same open terms, as in the GPL and AGPL. Stage 2

Covered platform

Under the TAKE IT DOWN Act, a public site or app that mainly hosts user content. Stage 8

Cursor rules

.mdc files in the .cursor/rules folder. One applies to every chat only with alwaysApply: true in its frontmatter. Stage 11

Customer portal

A hosted page, such as Stripe's, where customers update billing or cancel. Stage 9

Data breach

Personal data reaching someone who should not have it, which can start legal notice deadlines. Stage 1

Data inventory

A list of every piece of personal data your app collects, where it goes, why, and for how long. Stage 3

Data processing agreement (DPA)

The contract GDPR Article 28 requires between you and each processor. Stage 2

Data safety form

Google Play's required questionnaire about what data your app and its SDKs collect. Stage 3

Deepfake

Image, audio or video made or changed by AI that would falsely look real. Stage 7

Deny by default

The safe starting point: anything a rule does not allow is refused. Stage 1

Dependency

A package your app needs to run, which may pull in many more packages of its own. Stage 2

Deployer

In the EU AI Act, a company that uses an AI system in its own product or work. Stage 7

Designated agent

The person or role you register with the Copyright Office to receive copyright notices. Stage 8

Digital Omnibus on AI

A 2026 EU change package that moved some AI Act dates but not the Article 50 start date. Stage 7

Digital Services Act (DSA)

The EU law that sets duties for online hosts and platforms. Stage 8

DKIM

A digital signature on each email that receivers check against a key in your DNS. Stage 10

DMARC

A DNS record that tells receivers what to do with mail that fails SPF and DKIM checks. Stage 10

DMCA

The Digital Millennium Copyright Act, the US law with the copyright notice-and-takedown system. Stage 8

Drift

The gap that grows between what your policy says and what your code does as features are added. Stage 11

Effective date

The date a version of your policy took effect, which CalOPPA requires you to show. Stage 3

EU AI Act

The European Union's law on artificial intelligence, with duties that depend on what an AI system does. Stage 7

European Accessibility Act

An EU law that sets accessibility duties for some consumer products and services. Stage 6

Explicit permission

Consent the user gives by an action, such as tapping a clearly labeled button. Stage 7

Express informed consent

A clear yes to the charge, given while the terms are in view. Stage 9

Focus indicator

The visible outline that shows which item a keyboard user is on. Stage 6

GDPR

The EU privacy law, which also reaches non-EU businesses that offer services to people in the EU. Stage 3

Global Privacy Control (GPC)

A browser setting that tells every site the person opts out of the sale or sharing of their data. Stage 4

Grant

A database permission that lets a role reach a table at all, before RLS filters the rows. Stage 1

Hash matching

Finding copies of an image by comparing a digital fingerprint instead of the image itself. Stage 8

Health Breach Notification Rule

An FTC rule that makes health apps outside HIPAA notify people when health data gets out. Stage 5

Health data

Information about a person's body or mind, such as a condition, a drug, a symptom, fertility or mood. Stage 5

HIPAA

The US health privacy law for health care providers, insurers and the companies that work for them, which does not cover most consumer apps. Stage 5

Host

A service that stores content for users and often shows it to others. Stage 8

Instruction file

A plain text file in your project that an agent loads at the start of every session. Stage 11

IP address

The network address of a visitor's device, sent to every server their browser contacts. Stage 2

Legal representative

A person or company in an EU country that acts for a non-EU business under the DSA. Stage 8

Level AA

The middle WCAG level, the one laws, courts and buyers usually ask for. Stage 6

Lockfile

A file that records the exact version of every package your app installed. Stage 2

Machine-readable marking

A mark on AI output, such as metadata or a watermark, that software can detect. Stage 7

Material terms

The facts a buyer needs to decide, such as price, frequency, renewal and how to cancel. Stage 9

Microenterprise

Under the EU Act, a business with fewer than 10 people and no more than EUR 2 million turnover or balance sheet. Stage 6

My Health My Data Act

A Washington state law on consumer health data, enforced through the state consumer protection law. Stage 5

Negative option

A deal where silence means yes, so the customer keeps paying until they act to stop. Stage 9

Neutral age gate

An age question that does not hint at the answer needed to get in. Stage 5

Non-consensual intimate image

An intimate photo or video of a person shared without their consent. Stage 8

Notice-and-action

A DSA form that lets anyone report illegal content and get a decision. Stage 8

One-click unsubscribe

Two email headers that let the reader's mail app unsubscribe them with one button. Stage 10

Open-source license

The legal terms that say what you may do with someone else's code. Stage 2

Operator

Under SB 243, anyone who offers a companion chatbot platform to a user in California. Stage 7

Opt-in

A model where you may not track until the person agrees, as in the EU. Stage 4

Opt-out

A model where you may collect until the person tells you to stop, as in most US law. Stage 4

Opt-out

A request to stop getting marketing messages, which US law says you must honor. Stage 10

Opt-out preference signal

The legal name in California's rules for a signal like GPC, which a covered business must honor. Stage 4

Package hallucination

When an AI tool suggests a package name that does not exist, which an attacker can then register. Stage 2

Pen register theory

The claim that a tracker collecting IP or device data is an illegal pen register, limited by SB 690 from 2027. Stage 4

Persistent identifier

An ID that recognizes a user over time, such as a cookie number, IP address or device ID. Stage 5

Personal data (PII)

Information that identifies a person, such as a name, email address or phone number. Stage 3

Policy

One RLS rule that lets some rows through for one kind of action, such as select or insert. Stage 1

Postal address

A street address, registered PO box or registered private mailbox, required in US marketing email. Stage 10

Prior express written consent

A signed agreement to receive marketing texts that names the number and is not a condition of buying. Stage 10

Privacy policy

A public page that says what personal data your app collects, why, and who receives it. Stage 3

Processor

A company that handles personal data on your behalf, such as your database host or email sender. Stage 2

Provider

In the EU AI Act, the company that builds an AI system or puts it on the market under its name. Stage 7

Public env prefix

A name prefix such as NEXT_PUBLIC_ or VITE_ that copies the value into browser code. Stage 1

Publishable key

A Supabase key that is safe in browser code, but only because RLS protects the tables. Stage 1

Push protection

A GitHub check that blocks a push when it finds a known secret format. Stage 1

Repeat infringer policy

Your written rule to end accounts of users who keep posting infringing content. Stage 8

ROSCA

The Restore Online Shoppers' Confidence Act, the federal law for subscriptions and trials sold online. Stage 9

Row Level Security (RLS)

Postgres rules that decide, row by row, who may read or change data in a table. Stage 1

Rules block

A short list of one-line orders, pasted into an instruction file, that records your legal and security decisions. Stage 11

Safe harbor

A rule that protects you from enforcement if you meet its conditions. Stage 7

Safe harbor

Protection from liability that you keep only while you meet the law's conditions. Stage 8

Save offer

A discount or "are you sure?" screen shown when a customer tries to cancel. Stage 9

SB 690

A 2026 California law that ends private pen register suits over websites and apps from 1 January 2027. Stage 4

Screen reader

Software that reads the screen aloud, such as VoiceOver, TalkBack or NVDA. Stage 6

SDK

A vendor library built into your app, such as a payments or analytics library. Stage 2

SDK

A software development kit, a library added to an app, which can send events and identifiers to the company that made it. Stage 5

Secret key

A Supabase key (older name: service_role) that skips RLS and must stay on the server. Stage 1

Section 230

The US law that says a platform is not the publisher of what its users post, with exceptions. Stage 8

Security headers

Instructions a server sends with each page that tell the browser to block some common attacks. Stage 1

Session replay

A tool that records clicks, scrolling and what is on screen so you can replay a visit. Stage 4

Soft opt-in

The EU and UK exception that lets you email existing customers about your similar products. Stage 10

SPF

A DNS record that lists the servers allowed to send email for your domain. Stage 10

Statutory damages

Set amounts per work a court can award for copyright infringement without proof of loss. Stage 8

Strictly necessary

Storage a service needs to do what the user asked, such as a login session, which needs no consent in the EU. Stage 4

Subprocessor

A processor that one of your processors brings in to help it. Stage 2

Success criterion

One testable WCAG rule, with a number such as 1.4.3 and a level. Stage 6

Supply-chain attack

An attack that poisons a package so every app that installs it runs the attacker's code. Stage 2

TCPA

The US law on calls and texts, with $500 to $1,500 per violation in private suits. Stage 10

Template

A ready-made policy or contract you edit to fit your own app. Stage 3

Terms of service

The contract between you and your users. Stage 3

Third party

Any company other than you and your user, such as a font host, analytics vendor or payment provider. Stage 2

Third-party script

Code your page loads from another company's server, which can send that company your visitor's data. Stage 2

Tracker inventory

A one-page list of every script, SDK and vendor, the data each one gets, and its consent gate. Stage 11

Tracking pixel

A tiny image or script from an ad company that reports a visit back to that company. Stage 4

Tracking pixel

A small piece of ad platform code on a web page that reports what each visitor does. Stage 5

Transactional email

An email that does a job for a customer, such as a receipt, a password reset or an account notice. Stage 10

UNKNOWN

An audit result that means the agent could not prove the item either way, so you treat it as open. Stage 11

Usage policy

The rules your AI model provider sets for what you may build with its models. Stage 7

User-generated content (UGC)

Anything users create and put into your app, such as posts, comments, photos or files. Stage 8

Verifiable parental consent

Consent from a parent, collected in a way that gives real reason to believe it is the parent. Stage 5

Visual proximity

Shown on the same screen, close to the button the customer presses to agree. Stage 9

WCAG

The Web Content Accessibility Guidelines, the W3C standard most laws and courts point to. Stage 6