/privacy-policy

name: privacy-policy
description: Generate privacy policies, terms of service, and EULAs for Apple platform apps. Detects data collection patterns, third-party SDKs, and generates region-specific legal documents with Apple Privacy Nutrition Label mapping. Use when user needs legal documents or data collection disclosure for App Store submission.
allowed-tools: [Read, Write, Edit, Glob, Grep, AskUserQuestion]
last_verified: 2026-07-16
review_by: 2027-06-22

Privacy Policy & Legal Document Generator

Generate ready-to-use privacy policies, terms of service, and EULAs tailored to your app's data practices, third-party services, and target markets.

> **Disclaimer:** This skill generates template legal documents based on common indie app scenarios. Consult a qualified lawyer for apps handling sensitive data (health, financial, children's data), apps with complex data sharing arrangements, or apps operating in highly regulated industries. These templates are a strong starting point -- not a substitute for legal counsel.

When This Skill Activates

Use this skill when the user:

• Needs a privacy policy for their app
• Needs terms of service or EULA
• Apple requires a privacy policy for App Store submission
• Is adding analytics, ads, or crash reporting and needs to update their privacy policy
• Asks about data collection disclosure or privacy compliance
• Mentions GDPR, CCPA, DPDP, or COPPA requirements for their app
• Wants to know what to declare in Apple's Privacy Nutrition Labels

Pre-Generation Checks

Before generating documents, gather context from the project.

1. Look for Existing Legal Documents

Glob: **/privacy*.md, **/privacy*.html, **/privacy*.txt
Glob: **/terms*.md, **/terms*.html, **/terms*.txt
Glob: **/eula*.md, **/eula*.html, **/eula*.txt
Glob: **/legal/**

If existing documents found, ask user whether to replace or update them.

2. Check for Third-Party SDK Usage

Grep: "Firebase" or "GoogleAnalytics" or "Crashlytics"
Grep: "Mixpanel" or "Amplitude" or "PostHog"
Grep: "AdMob" or "AppLovin" or "UnityAds"
Grep: "FacebookSDK" or "GoogleSignIn" or "SignInWithApple"
Grep: "Sentry" or "Bugsnag" or "DataDog"
Grep: "RevenueCat" or "Adapty" or "Qonversion"
Grep: "TelemetryDeck" or "Plausible" or "CountlySDK"

Note detected SDKs to auto-populate data collection sections.

3. Detect Data Collection Patterns in Code

Grep: "UserDefaults" -- Local preferences storage
Grep: "CoreData" or "SwiftData" or "NSPersistentContainer" -- Local database
Grep: "CloudKit" or "CKContainer" -- Cloud sync
Grep: "URLSession" or "Alamofire" -- Network calls
Grep: "HealthKit" or "HKHealthStore" -- Health data
Grep: "CLLocationManager" or "CoreLocation" -- Location data
Grep: "AVCaptureSession" or "PHPhotoLibrary" -- Camera/photos
Grep: "Contacts" or "CNContactStore" -- Contacts access
Grep: "ATTrackingManager" -- App Tracking Transparency
Grep: "ASAuthorizationAppleIDProvider" -- Sign in with Apple

4. Check Info.plist for Permission Usage Descriptions

Grep: "NSCameraUsageDescription" or "NSPhotoLibraryUsageDescription"
Grep: "NSLocationWhenInUseUsageDescription" or "NSLocationAlwaysUsageDescription"
Grep: "NSHealthShareUsageDescription" or "NSHealthUpdateUsageDescription"
Grep: "NSContactsUsageDescription" or "NSMicrophoneUsageDescription"
Grep: "NSUserTrackingUsageDescription"

Configuration Questions

Ask the user via AskUserQuestion:

1. What documents do you need?

• Privacy Policy only
• Terms of Service only
• EULA only
• All three (recommended for App Store apps)

2. What data does your app collect?

• No user data (fully offline, no accounts)
• Anonymous analytics only (usage events, crash data)
• Account with email (sign-in required)
• Account with personal info (name, email, profile, preferences)
• Health or financial data (triggers additional compliance sections)

3. What third-party services does your app use?

• None
• Analytics only (e.g., TelemetryDeck, Firebase Analytics)
• Analytics + crash reporting (e.g., Sentry, Crashlytics)
• Advertising (e.g., AdMob, AppLovin)
• Social login (e.g., Sign in with Apple, Google Sign-In)
• Multiple of the above (list them)

4. Does your app target or allow children under 13?

• No
• Yes (triggers COPPA section and stricter data practices)

5. Where will you host these documents?

• GitHub Pages (free, Markdown to HTML)
• In-app (Settings screen with WKWebView or Text view)
• Personal/company website
• All of the above (recommended -- Apple requires a publicly accessible URL)

Generation Process

Step 1: Select Template Sections

Read `templates.md` for the document templates.

Based on configuration answers, include or exclude sections:

| Answer | Sections Added | |--------|---------------| | No user data | Minimal privacy policy (no collection, no sharing) | | Anonymous analytics | Analytics disclosure, third-party services list | | Account with email | Account data, authentication, data retention | | Personal info | Full data collection, user rights, data portability | | Health/financial | Sensitive data handling, enhanced security, additional consent | | Children under 13 | COPPA section, parental consent, limited data collection |

Step 2: Fill in App-Specific Details

Replace template placeholders with detected or user-provided values:

• `[APP_NAME]` -- App display name
• `[DEVELOPER_NAME]` -- Developer or company name
• `[CONTACT_EMAIL]` -- Privacy contact email
• `[EFFECTIVE_DATE]` -- Document effective date
• `[WEBSITE_URL]` -- Developer website or privacy page URL

Step 3: Add Region-Specific Sections

Include sections based on target markets:

**GDPR (European Union users):**

• Data controller identification
• Lawful basis for processing (consent, legitimate interest, contract)
• Data subject rights (access, rectification, erasure, portability, objection)
• Data Protection Officer contact (if applicable)
• Data retention periods
• Right to lo