privacy-policy

What this skill does

# Privacy Policy & Legal Document Generator

Generate ready-to-use privacy policies, terms of service, and EULAs tailored to your app's data practices, third-party services, and target markets.

> **Disclaimer:** This skill generates template legal documents based on common indie app scenarios. Consult a qualified lawyer for apps handling sensitive data (health, financial, children's data), apps with complex data sharing arrangements, or apps operating in highly regulated industries. These templates are a strong starting point -- not a substitute for legal counsel.

## When This Skill Activates

Use this skill when the user:
- Needs a privacy policy for their app
- Needs terms of service or EULA
- Apple requires a privacy policy for App Store submission
- Is adding analytics, ads, or crash reporting and needs to update their privacy policy
- Asks about data collection disclosure or privacy compliance
- Mentions GDPR, CCPA, DPDP, or COPPA requirements for their app
- Wants to know what to declare in Apple's Privacy Nutrition Labels

## Pre-Generation Checks

Before generating documents, gather context from the project.

### 1. Look for Existing Legal Documents

```
Glob: **/privacy*.md, **/privacy*.html, **/privacy*.txt
Glob: **/terms*.md, **/terms*.html, **/terms*.txt
Glob: **/eula*.md, **/eula*.html, **/eula*.txt
Glob: **/legal/**
```

If existing documents found, ask user whether to replace or update them.

### 2. Check for Third-Party SDK Usage

```
Grep: "Firebase" or "GoogleAnalytics" or "Crashlytics"
Grep: "Mixpanel" or "Amplitude" or "PostHog"
Grep: "AdMob" or "AppLovin" or "UnityAds"
Grep: "FacebookSDK" or "GoogleSignIn" or "SignInWithApple"
Grep: "Sentry" or "Bugsnag" or "DataDog"
Grep: "RevenueCat" or "Adapty" or "Qonversion"
Grep: "TelemetryDeck" or "Plausible" or "CountlySDK"
```

Note detected SDKs to auto-populate data collection sections.

### 3. Detect Data Collection Patterns in Code

```
Grep: "UserDefaults" -- Local preferences storage
Grep: "CoreData" or "SwiftData" or "NSPersistentContainer" -- Local database
Grep: "CloudKit" or "CKContainer" -- Cloud sync
Grep: "URLSession" or "Alamofire" -- Network calls
Grep: "HealthKit" or "HKHealthStore" -- Health data
Grep: "CLLocationManager" or "CoreLocation" -- Location data
Grep: "AVCaptureSession" or "PHPhotoLibrary" -- Camera/photos
Grep: "Contacts" or "CNContactStore" -- Contacts access
Grep: "ATTrackingManager" -- App Tracking Transparency
Grep: "ASAuthorizationAppleIDProvider" -- Sign in with Apple
```

### 4. Check Info.plist for Permission Usage Descriptions

```
Grep: "NSCameraUsageDescription" or "NSPhotoLibraryUsageDescription"
Grep: "NSLocationWhenInUseUsageDescription" or "NSLocationAlwaysUsageDescription"
Grep: "NSHealthShareUsageDescription" or "NSHealthUpdateUsageDescription"
Grep: "NSContactsUsageDescription" or "NSMicrophoneUsageDescription"
Grep: "NSUserTrackingUsageDescription"
```

## Configuration Questions

Ask the user via AskUserQuestion:

### 1. What documents do you need?

- Privacy Policy only
- Terms of Service only
- EULA only
- All three (recommended for App Store apps)

### 2. What data does your app collect?

- No user data (fully offline, no accounts)
- Anonymous analytics only (usage events, crash data)
- Account with email (sign-in required)
- Account with personal info (name, email, profile, preferences)
- Health or financial data (triggers additional compliance sections)

### 3. What third-party services does your app use?

- None
- Analytics only (e.g., TelemetryDeck, Firebase Analytics)
- Analytics + crash reporting (e.g., Sentry, Crashlytics)
- Advertising (e.g., AdMob, AppLovin)
- Social login (e.g., Sign in with Apple, Google Sign-In)
- Multiple of the above (list them)

### 4. Does your app target or allow children under 13?

- No
- Yes (triggers COPPA section and stricter data practices)

### 5. Where will you host these documents?

- GitHub Pages (free, Markdown to HTML)
- In-app (Settings screen with WKWebView or Text view)
- Personal/company website
- All of the above (recommended -- Apple requires a publicly accessible URL)

## Generation Process

### Step 1: Select Template Sections

Read `templates.md` for the document templates.

Based on configuration answers, include or exclude sections:

| Answer | Sections Added |
|--------|---------------|
| No user data | Minimal privacy policy (no collection, no sharing) |
| Anonymous analytics | Analytics disclosure, third-party services list |
| Account with email | Account data, authentication, data retention |
| Personal info | Full data collection, user rights, data portability |
| Health/financial | Sensitive data handling, enhanced security, additional consent |
| Children under 13 | COPPA section, parental consent, limited data collection |

### Step 2: Fill in App-Specific Details

Replace template placeholders with detected or user-provided values:
- `[APP_NAME]` -- App display name
- `[DEVELOPER_NAME]` -- Developer or company name
- `[CONTACT_EMAIL]` -- Privacy contact email
- `[EFFECTIVE_DATE]` -- Document effective date
- `[WEBSITE_URL]` -- Developer website or privacy page URL

### Step 3: Add Region-Specific Sections

Include sections based on target markets:

**GDPR (European Union users):**
- Data controller identification
- Lawful basis for processing (consent, legitimate interest, contract)
- Data subject rights (access, rectification, erasure, portability, objection)
- Data Protection Officer contact (if applicable)
- Data retention periods
- Right to lodge complaint with supervisory authority

**CCPA (California users):**
- Categories of personal information collected
- Business purposes for collection
- "Do Not Sell or Share My Personal Information" notice
- Right to know, delete, and opt-out
- Non-discrimination for exercising rights
- Financial incentive disclosure (if applicable)

**DPDP (India users):**
- Data fiduciary identification
- Purpose of data processing
- Consent mechanism
- Data principal rights (access, correction, erasure, grievance redressal)
- Data retention limitations
- Processing of children's data (under 18)

**COPPA (children under 13):**
- Parental consent requirement
- Limited data collection (only what is strictly necessary)
- No behavioral advertising to children
- Parental rights (review, delete, refuse further collection)
- Safe harbor program compliance (if applicable)

### Step 4: Generate Apple Privacy Nutrition Label Mapping

Based on detected data practices, generate a mapping for App Store Connect:

```
Apple Privacy Nutrition Label Mapping
=====================================

Data Types to Declare:
- [ ] Contact Info: Email Address -- Used for: App Functionality, Account
- [ ] Identifiers: User ID -- Used for: App Functionality
- [ ] Usage Data: Product Interaction -- Used for: Analytics
- [ ] Diagnostics: Crash Data -- Used for: App Functionality
- [ ] Diagnostics: Performance Data -- Used for: Analytics

Data Linked to User: [List items linked to user identity]
Data Used to Track: [List items used for cross-app tracking, if any]

Tracking: [Yes/No -- triggers ATT requirement if Yes]
```

### Step 5: Output Documents

Generate documents in Markdown format. Place files based on user's hosting preference:

- **GitHub Pages**: `docs/privacy-policy.md`, `docs/terms-of-service.md`, `docs/eula.md`
- **In-app**: `Resources/Legal/privacy-policy.md`, etc.
- **Website**: Output to clipboard/file for manual upload
- **All**: Generate in `docs/` with guidance for in-app integration

## Apple-Required Privacy Disclosures

### App Store Connect Privacy Questions

When submitting to the App Store, Apple asks about data practices. Map generated privacy policy to these questions:

| Apple Question | Where to Find Answer |
|---------------|---------------------|
| Do you or your third-party partners collect data? | "Information We Collect" section |
| Data types collected | Privacy Nutrition Label mapping (Step 4) |
| Is data linked to user identity?