/legal
Generate privacy policy and terms of service tailored to the project's stack, features, and data handling. Aligned with manifesto privacy-first principles (templates/principles/manifest.md): on-device processing, local storage, no accounts when possible, user owns their data.
Disclaimer: Generated documents are templates, not legal advice. Review with a lawyer before publishing, especially for regulated industries (health, finance, children).
Steps
- Parse project from
$ARGUMENTS.
- Read docs/prd.md — features, ICP, data handling - Read CLAUDE.md — stack, services used - Read stack YAML from templates/stacks/{stack}.yaml if available - If empty: ask via AskUserQuestion
- Data audit — determine what data the product collects: Scan PRD and codebase config for: Data Type Collected? Stored Where Purpose Email/name — Local / Supabase Account Usage analytics — PostHog (EU) Product improvement Payment info — Stripe (not stored locally) Billing User content — On-device / local DB Core feature Location — — — Device info — — — Cookies — — — Third-party SDKs — — — For each "yes": note the legal basis (consent, legitimate interest, contract). Manifest alignment check:
- Data stored locally? (offline-first principle) - Can user export all their data? - Can user delete all their data? - Any data sent to third parties without explicit consent? - Does the app work without an account?
- Detect applicable regulations: Regulation Applies When Key Requirements GDPR EU users or EU-based business Consent, right to access/delete/port, DPA with processors CCPA/CPRA California users, >$25M revenue or >100K consumers Right to know/delete/opt-out, "Do Not Sell" App Store iOS app Privacy nutrition labels, ATT framework Play Store Android app Data safety section, deletion policy COPPA Users under 13 Parental consent (flag if ICP includes children) Most solo projects: GDPR + App Store/Play Store is sufficient.
- Generate Privacy Policy: Structure (adapt to product):
# Privacy Policy **Last updated:** {YYYY-MM-DD} **Effective date:** {YYYY-MM-DD} ## What we collect {table from step 2 — only "yes" rows, in plain language} ## How we use it {purpose for each data type — be specific, not "to improve our services"} ## Where data is stored {local device / specific cloud service + region} {for offline-first apps: "Your data stays on your device. We cannot access it."} ## Third-party services {list each service: PostHog (EU), Stripe, Supabase — with links to their privacy policies} ## Your rights - **Access:** request a copy of your data - **Delete:** delete your account and all associated data - **Export:** download your data in {format} - **Opt-out:** disable analytics in app settings ## Data retention {how long data is kept, what triggers deletion} ## Children {if product is not for children under 13: "This product is not intended for children under 13."} ## Changes We may update this policy. Changes will be posted here with an updated date. ## Contact {email address for privacy questions}Rules:
- Plain language, no legalese — users should understand what they're agreeing to - Be honest about what you collect — don't hide tracking behind vague language - Offline-first products get a simpler policy (less data = less to explain) - If the app collects nothing: say so explicitly ("We collect no personal data")
- Generate Terms of Service: Structure:
# Terms of Service **Last updated:** {YYYY-MM-DD} ## What this is {product name} is {one-line description}. By using it, you agree to these terms. ## Your account {if accounts exist: account rules. If no accounts: "No account is required."} ## Your data You own your data. We do not claim any rights to content you create. {for offline-first: "Your data is stored on your device. We have no access to it."} ## Acceptable use Do not use {product} to: {short list of prohibited uses relevant to the product} ## Payments {if paid: pricing, refund policy, billing terms} {manifest alignment: "No hidden fees. What you see is what you pay."} {if one-time purchase: "One-time purchase. No recurring charges."} {if subscription: explain what justifies the recurring cost} ## Availability We aim to keep {product} available but cannot guarantee 100% uptime. {for offline-first: "Core features work without internet connection."} ## Limitation of liability {standard limitation clause — product provided "as is"} ## Changes We may update these terms. Continued use after changes means acceptance. ## Contact {email} - Generate App Store privacy labels (if iOS or Android): iOS (App Store Connect): Android (Play Store):
- Privacy nutrition label categories based on data audit - Tracking: yes/no (ATT required if yes) - Data linked to identity: list - Data not linked to identity: list - Data safety form responses based on data audit - Data shared with third parties: list - Data collection purposes: list - Security practices: encryption, deletion available
- Write legal documents:
- legal/privacy-policy.md — privacy policy - legal/terms-of-service.md — terms of service - legal/app-store-privacy.md — app store labels (if mobile) - Create legal/ directory in project root if needed
- Output summary:
- Data types collected (count) - Regulations applicable - Manifest alignment (all principles met or violations flagged) - Files generated - Reminder: "Review with a lawyer before publishing"
Notes
- Documents are templates — always review before publishing
- Offline-first apps need simpler policies (this is a feature, not a limitation)
- Update legal docs when adding new data collection, third-party services, or features
- For EU-based products using PostHog: confirm EU hosting (eu.posthog.com)
- Stripe handles PCI compliance — never store card data yourself
Common Issues
Product collects more data than expected
Cause: Third-party SDKs (analytics, crash reporting) collect data automatically. Fix: Audit all SDKs in package.json/Podfile/build.gradle. List each one in the privacy policy.
Offline-first but still needs some cloud
Cause: Sync, backup, or auth requires cloud. Fix: Be explicit: "Core features work offline. Optional sync requires {service}." List exactly what syncs.
App Store rejection for missing privacy policy
Cause: No privacy policy URL in app metadata. Fix: Host privacy-policy.md as a web page (GitHub Pages, project website, or static hosting). Add URL to App Store Connect / Play Console.