Stage 3: The paperwork

The short answer

You need a privacy policy, terms of service and, if you use cookies, a cookie notice, and each one must describe the app you actually run. A template is a fine place to start, but a policy that promises things your app does not do can be a violation in itself, so edit every sentence against your real code and vendor list. Show your terms with an "I agree" step at sign-up, not only as a footer link. Then meet the rules that Apple, Google Play, Google sign-in and Stripe check before they let you launch.

Why this matters

These are real cases. Each one has a source you can open.

• A policy that said one thing. In March 2026, the FTC, the US consumer protection agency, took action against Match Group over OkCupid. OkCupid's policy said it did not share personal information "with others except as indicated in this Privacy Policy". The FTC alleges that OkCupid gave an unrelated third party nearly three million user photos plus location and other data, with no notice or opt-out. The proposed order bars OkCupid from misrepresenting its privacy practices. The FTC lists the case as pending, so these are allegations (FTC press release, FTC case page).
• An app with no policy at all. In December 2012, California's Attorney General sued Delta Air Lines because its mobile app had no privacy policy. I could not open the complaint, so this comes from a law-firm summary, and I did not confirm the outcome (law-firm summary). Apps count, not only websites.
• Terms nobody agreed to. In Nguyen v. Barnes & Noble (2014), a federal appeals court refused to enforce the arbitration clause in website terms that were reachable only through a link at the bottom of each page. The user was never asked to take a step that showed agreement (Ninth Circuit opinion).
• My own policy was wrong. The July 2026 version of my privacy policy for Ducktate said the app had no analytics or tracking. PostHog analytics was on by default. My own audit found it on 2026-07-25, and I corrected the policy on 2026-08-25: it now names the analytics tool and the other vendors, and I added a public subprocessor page. Then the same gap opened again. I added Google Analytics to the website on 2026-09-14 and a Google Cloud AI feature on 2026-09-24, and neither is in the public policy. Both are still open as of 2026-10-09. A policy you write once goes out of date the next time you add a tool.

Core concepts

Which privacy laws reach a small app

A privacy policy is a public page that tells people what personal data your app collects, why, and who receives it. Personal data, or personally identifiable information (PII), is information that identifies a person. California's list includes a name, address, email and phone number (Cal. Bus. & Prof. Code Sec. 22577, copy).

Four sets of rules matter most for a small app.

CalOPPA, the California Online Privacy Protection Act, applies to any operator of a commercial website or online service that collects PII from California consumers. You do not have to be in California, and there is no size test (Sec. 22575, copy). The official California site blocked my tools, so these links go to a copy of the statute. CalOPPA has no penalty clause of its own. Prosecutors enforce it through California's Unfair Competition Law, which allows a civil penalty of up to $2,500 per violation (Sec. 17206, copy).

The CCPA, the California Consumer Privacy Act, only covers a for-profit business that does business in California and meets any one of three tests: annual gross revenue above $26,625,000; buying, selling or sharing the personal information of 100,000 or more California consumers or households; or earning 50% or more of its revenue from selling or sharing personal information (CPPA threshold table, California Attorney General). Fines are up to $2,663 per violation, or $7,988 if intentional. Many solo founders fall below all three tests. My reading of the two laws is that an app can be outside the CCPA and still inside CalOPPA, because CalOPPA has no threshold.

The GDPR, the EU's privacy law, reaches businesses outside the EU too. Article 3(2) applies it when you offer goods or services to people in the EU, "irrespective of whether a payment of the data subject is required", or when you monitor their behaviour in the EU (GDPR Art. 3, copy). The link is gdpr-info.eu, a copy of the law; the official text is on EUR-Lex. Fines for the notice rules go up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher. Those are ceilings.

Other US states. About 20 or more states have their own privacy laws, with their own thresholds, and the list keeps growing. Check the IAPP state tracker for the states where you have users.

Worked example. Three small apps, one question each: which of these rules apply?

Notice the first row. "Too small for the CCPA" is not "too small for a privacy policy".

What the policy must say

CalOPPA Sec. 22575(b) lists what your policy must contain (copy):

1. The categories of PII you collect, and the categories of third parties you may share it with.
2. How a user can review and ask to change their PII, if you offer a way.
3. How you tell users about material changes to the policy.
4. The policy's effective date.
5. How you respond to a browser's "Do Not Track" signal.
6. Whether other companies may collect PII about a user's activity over time and across sites.

You must post it conspicuously, which means where people can find it.

If the GDPR applies, Article 13 adds more: who you are and how to contact you; the purpose and legal basis for each use; who receives the data; transfers outside the EU; how long you keep it; the user's rights, including the right to withdraw consent and to complain to a data authority; and any automated decision-making (GDPR Art. 13, copy).

Worked example. Write the policy from a list of what your code does, not from memory. Start with a data inventory: one row per thing you collect.

Each row becomes a sentence in the policy. On Apple, the last row needs extra care: guideline 5.1.2(i) says to disclose sharing "with third-party AI" and get explicit permission first (App Review Guidelines). Stage 2 shows how to build the vendor half of this table.

A policy that lies is worse than none

Having no policy breaks CalOPPA. Having a policy that is false can be worse, because now you have made a promise. CalOPPA Sec. 22576 says an operator violates the law if it fails to comply with its own posted policy, knowingly and willfully, or negligently and materially (Sec. 22576, copy). At the federal level, the FTC has treated a broken privacy promise as deceptive, as in the OkCupid case. In another case, the FTC alleged that Flo Health, a fertility app, told users their health data would stay private and then shared it with outside analytics providers; the final order came in June 2021 (FTC on Flo Health).

That is the risk with templates. A template is a ready-made policy or contract that you fill in. Good free ones exist:

• General Legal's legal-templates on GitHub: 12 templates drafted by General Legal attorneys, including a US privacy policy, a GDPR privacy policy, Terms of Use, a cookie notice and two data processing addenda. They are released under CC0, which means you may use and change them with no attribution, though the README asks you to keep the General Legal credit footnote. It was last updated on 2026-09-22 (General Legal templates). The README has no "not legal advice" note, and one recent change names a specific arbitration provider in the arbitration clause, so read that clause before you keep it.
• Basecamp's policies, under CC BY 4.0, which lets you reuse them if you credit Basecamp. The repository is archived, so parts may be out of date (basecamp/policies).
• Automattic's Legalmattic, WordPress.com's legal documents, under CC BY-SA 4.0. "SA" means share-alike: your adapted version must use the same license (Automattic/legalmattic).

Worked example. A template says: "We do not share your personal information with third parties, except our payment processor." Your app also sends page views to an analytics company and note text to an AI provider. Publish that sentence and you have published a false statement about your own app. The fix is to make the sentence true: "We share personal information with these service providers: Stripe for payments, our analytics provider to count visits, and our AI provider to run the summarize feature." Then search the template for "never", "only" and "do not", check each against your inventory, and remove every placeholder such as "[Company Name]".

Terms of service: clickwrap, not browsewrap

Terms of service (or terms of use) are the contract between you and your users. They set limits on your liability, acceptable use, your right to close accounts, which law applies, and refund and cancellation terms.

A contract only binds people who agreed to it. Courts look at how you asked.

• Browsewrap means the terms sit behind a link, usually in the footer, and using the site is supposed to count as agreement. In Nguyen v. Barnes & Noble, the Ninth Circuit held a footer link like that did not give users enough notice, and refused to enforce the terms (opinion).
• Clickwrap means the user takes a clear step, such as ticking a box or clicking a button, that says they agree, with the terms linked right there. Courts enforce this far more readily. Even then, the wording matters. In Berman v. Freedom Financial Network (2022), the same court found no agreement on a sign-up page where the button did not make clear that clicking it meant agreeing to the terms. I read law-firm summaries of Berman, not the full opinion (CourtListener record, law-firm summary).

Worked example. Two sign-up screens:

Weak:    [ Create account ]
         (Terms and Privacy links in the page footer)

Better:  [ ] I agree to the Terms of Service and Privacy Policy
             (both linked, right next to the box)
         [ Create account ]

On the better screen, the button stays disabled until the box is ticked, and your server saves who agreed, when, and to which version. On Ducktate, the sign-up step has a required Terms checkbox, and the acceptance is stored in the database.

Cookie notice

A cookie is a small file a website stores in the browser. A cookie notice tells visitors which cookies and similar storage your site uses and why. In the EU, the ePrivacy Directive Article 5(3) allows storing or reading information on a user's device only with consent, given after clear information. The exceptions are storage needed only to carry out the communication, and storage strictly necessary for a service the user asked for (ePrivacy Art. 5, UK-hosted copy). So a login cookie is fine without consent, and an analytics cookie is not. Each EU country enforces this through its own law, which differs in detail. Stage 4 covers consent banners in full.

What app stores, Google sign-in and Stripe check

Platforms can block your launch, so their rules often bite first.

A Google OAuth app that shows the "unverified app" screen is limited to 100 new users in total. On Apple and Google, you are responsible for the accuracy of your data answers, SDKs included. If a store form and your policy disagree, one is wrong.

Apple's deletion rule covers guest accounts too, and with Sign in with Apple you must revoke the user's tokens through Apple's API. My own audit in July 2026 found Ducktate had no way to delete an account. I added it the same day.

Key terms

The checklist

• Write a data inventory from your real code: every field, SDK, analytics tool, AI provider and log, where each one sends data, and for how long you keep it.Must doSource: Apple App Review Guidelines 5.1.1, GDPR Art. 13
• Start from a template, then edit it to match what your app really does.Should doSource: General Legal templates (CC0), Basecamp policies
• Make sure your privacy policy covers the six CalOPPA items: PII and third-party categories, how a user can review and request changes to their own PII if you offer that, how you announce changes, the effective date, your Do Not Track answer, and whether third parties may track users over time and across sites.Must doSource: Cal. Bus. & Prof. Code Sec. 22575
• If people in the EU can use your app, add the GDPR Article 13 items: who you are, purposes and legal basis, recipients, transfers, retention, rights, and the right to complain.If it appliesSource: GDPR Art. 13, GDPR Art. 3
• Read the finished policy against your inventory and delete or fix every promise the app does not keep.Must doSource: FTC on OkCupid, Cal. Bus. & Prof. Code Sec. 22576
• Post the privacy policy as a public web page, not a PDF, and link it from your app and your store listing.Must doSource: Cal. Bus. & Prof. Code Sec. 22575, Google Play User Data policy
• If you use Google sign-in or list on Google Play, host the policy on your own domain and link it from the OAuth consent screen.If it appliesSource: Google OAuth verification, Google Play User Data policy
• Show your terms at sign-up with an unticked "I agree" box or a button that says it means agreement, with the terms linked next to it, and save who agreed to which version.Should doSource: Nguyen v. Barnes and Noble, Berman v. Freedom Financial
• Put a cookie notice on your site that lists each cookie or similar storage and why, and get consent first for anything not strictly necessary if you have EU visitors.If it appliesSource: ePrivacy Directive Art. 5
• If users can create an account, let them delete it inside the app, and on Google Play also give a web link for deletion.If it appliesSource: Apple account deletion, Google Play account deletion
• Fill in Apple's App Privacy answers and Google Play's Data safety form, including your SDKs, and redo them when your data use changes.If it appliesSource: Apple App Privacy details, Google Play Data safety
• If you offer Google sign-in, put a homepage that describes the app on your own verified domain and get OAuth verification, because an unverified app is capped at 100 new users in total.If it appliesSource: Google OAuth verification, Google unverified apps
• If you take payments with Stripe, show what you sell, the currency, contact details beyond a form, your refund and cancellation policy, your privacy policy and your business address.If it appliesSource: Stripe website checklist
• Update the policy and its effective date every time you add a vendor, SDK, analytics tool or AI provider.Must doSource: Cal. Bus. & Prof. Code Sec. 22575
• Check once a year whether you now pass the CCPA tests or another state's privacy law threshold.Should doSource: CPPA thresholds, IAPP state tracker

The prompt for your agent

Copy this into Claude Code, Codex or Cursor from the root of your project. Give it the URL or file of your privacy policy and terms if they live outside the repo.

Audit this project for Stage 3 of a launch checklist: privacy policy, terms,
cookie notice, and platform paperwork.
Do not change any code, copy, or policy text until I approve a plan.

For each item below, report PASS, FAIL, or UNKNOWN, with the file and line that
proves it. If you cannot prove an item from the code or the policy text, report
UNKNOWN. Never report PASS without evidence.

1. Build a data inventory from the code: every personal data field stored, every
   SDK, analytics tool, AI provider, email service, and log that receives
   personal data. Give the file and line for each.
2. Find the privacy policy. Compare it with the inventory. List every tool or
   data flow the code has that the policy does not mention, and every promise
   in the policy ("never", "only", "do not") that the code breaks.
3. Does the policy have: categories of personal data, categories of third
   parties, how users review or change their data, how changes are announced,
   an effective date, a Do Not Track statement, and a statement on third-party
   tracking across sites?
4. If the app can reach EU users: does the policy name the controller and
   contact, purposes and legal basis, recipients, transfers, retention, user
   rights, and the right to complain?
5. Is the policy a public web page on the app's own domain (not a PDF)? Is it
   linked inside the app and on the sign-in or sign-up screen?
6. At sign-up, is there an unticked "I agree" checkbox or a button that states
   agreement, with the terms linked next to it? Is acceptance stored, with the
   date and version?
7. Is there a cookie notice? List every cookie or local storage key the app
   sets, and say which ones are set before any consent.
8. Can a user delete their account from inside the app? Does deletion remove
   the data, not only deactivate it? Is there a web deletion link?
9. If the app uses Stripe or Google sign-in: is there a public page with what
   you sell, contact details, refund and cancellation terms, and a business
   address? Is the privacy policy on the same domain as the homepage?
10. Search the policy and terms for template leftovers: brackets, "Company
    Name", sample addresses, or services the app does not use.

End with a table: item, status, evidence (file and line), and the smallest fix you
suggest. Then stop and wait for my approval.

Item 2 is the one that matters most. Read every line it lists, and fix the policy, not the code, unless you meant to stop collecting that data.

Common mistakes

• Copying a template and leaving in promises your app does not keep, or placeholders such as "[Company Name]".
• Thinking "we are too small for privacy law". The CCPA has size tests, but CalOPPA, the GDPR and the app store rules do not protect a tiny app.
• Writing the policy once and never updating it after adding analytics, a new SDK or an AI feature. This happened to me twice.
• Putting the terms only in the footer, or using a sign-up button that does not say it means "I agree".
• Filling in Apple's or Google's data forms without counting what your SDKs collect.
• Offering "deactivate account" and calling it deletion.

Check yourself

Resources

• General Legal: legal-templatesTemplateFree

  12 attorney-drafted templates under CC0, including a US privacy policy, a GDPR privacy policy, Terms of Use and a cookie notice; last updated 2026-09-22.

• Basecamp: policiesTemplateFree

  Real terms and privacy policies under CC BY 4.0; archived, so check for outdated parts and keep the credit.

• Automattic: LegalmatticTemplateFree

  WordPress.com's legal documents under CC BY-SA 4.0; share-alike applies to your changes.

• CalOPPA, Cal. Bus. & Prof. Code Sec. 22575 (copy)LawFree

  The six things a California privacy policy must contain.

• GDPR Art. 13 (copy of the official text)LawFree

  The full list of what an EU privacy notice must tell people.

• IAPP: US State Privacy Legislation TrackerResearchFree

  Which states have their own privacy law and when each takes effect.

• Apple: App Review GuidelinesDocsFree

  Read 5.1.1 and 5.1.2 for the privacy policy, deletion and AI-sharing rules.

• Google Play: User Data policyDocsFree

  What your Play privacy policy must cover and where to link it.

• Google Cloud: OAuth app verificationDocsFree

  Homepage and privacy policy rules for apps that use Google sign-in.

• Stripe: website checklistDocsFree

  What Stripe asks your public site to show: contact details, refund and cancellation terms, and more.

• FTC: action against Match and OkCupidArticleFree

  A 2026 case about a privacy policy that did not match what the company did.

Next stage

Your policy now says what you collect. Stage 4 covers the part regulators and plaintiffs test most often: whether your analytics, session replay and cookies wait for consent, and whether "reject" really means reject.