Do you actually need a privacy policy?

Short answer: if your app collects anything about the people who use it, yes, and that includes far more apps than their owners think. This is not legal advice and a lawyer will tell you more than this page does. What it will do is get a small project from "I have no idea" to something honest and defensible in an afternoon.

When you need one

You need a policy if any of these are true, and for most AI-built apps at least one is:

• People can sign up, or you store an email address for any reason
• You use analytics, error tracking, or anything counting visitors
• Anyone can type something that gets saved
• You take payments
• You use Sign in with Google, Apple or GitHub. Each of those requires a published policy before they'll approve your app, and Apple and Google check

You probably don't need one for a purely static page with no forms, no accounts and no analytics. That's rarer than it sounds, because the analytics snippet often went in without anyone deciding to add it.

Find out what you're actually collecting first

This is the part people skip, and it's the only part that makes the policy true. A policy that describes an app you don't have is worse than none, because now you've made a written claim.

Read that list yourself. Two things usually surprise people: an AI feature quietly sends whatever users type to a model provider, and error tracking captures more of the page than expected.

What the policy has to say

1. Who you are, and a working email address for privacy questions. A real inbox you check.
2. What you collect, in the categories your audit produced.
3. Why you collect each one. "To run your account" is a fine reason. "For business purposes" is not.
4. Who else receives it. Name the services from your audit.
5. How long you keep it, and what happens when someone asks you to delete their account.
6. How someone contacts you to see or delete their data, and roughly how fast you'll respond.
7. Cookies, if you use any beyond the ones that keep people logged in.

Free generators from Iubenda, Termly and similar produce a reasonable draft from those answers. They're a starting point, not a substitute for reading it. The generator doesn't know your app sends user text to a model provider unless you tell it.

The two rules that catch small apps

If anyone in the EU or UK can use your app, GDPR applies to you regardless of where you live, and it's less frightening than its reputation for a small honest project: collect only what you need, say what you do with it, delete it when asked. California's rules land in a similar place. Both get difficult when you've collected things you can't explain, which is why the audit comes first.

The second rule is that the policy has to be reachable. A link in the footer of every page, and the exact same URL you gave Google or Apple when you registered the sign-in. A policy that 404s after an update is a live problem: keep the page in your project rather than in some editor you'll forget about, and make sure the version that's published is the one you can put back if an update removes it.

One thing to check before you publish it

An honest policy says you protect the data you hold. Before you promise that in writing, confirm you're not shipping a key that hands anyone your whole database. Our free key-leak scanner checks a live site in seconds. Run it before the policy goes up, not after.