By Partly fixable yourself. Draft it yourself, have a lawyer review it for your jurisdiction.
- How serious
- Medium
- Fix it yourself?
- Partly, some steps need a developer
- Typical cost
- $49–$800 one-off check of what data the app really collects (prices)
- Top rated
- Afterbuild Labs · 10.0/10
What you see. You are about to launch, collect emails or payments, and do not know whether a privacy policy is required.
Why it happens
This is not legal advice. Short version: if your app has user accounts, you collect personal data, and you very likely need a privacy policy. Ask a lawyer for your jurisdiction.
Under the GDPR, any company that handles personal data of people in the EU must comply, wherever it is based. The notice must say who you are, what you collect and why, the legal basis, who receives it, how long you keep it, and what rights people have. The UK regulator says to give that information when you collect the data, in plain language. California's CCPA applies to for-profit businesses above thresholds like $25 million in revenue or data on 100,000 or more residents, so a small app may fall outside it. Apple requires every app to link a privacy policy in App Store Connect and inside the app. Data you send to a payment processor or an AI API belongs in the policy too.
Fix it yourself
- List what you collect. Open your database tables, auth providers, analytics, payment processor, AI calls, and file storage. Note every field that identifies a person.
- Draft a policy covering who you are and how to contact you, what you collect and why, the legal basis, who receives it including sub-processors, how long you keep it, how users delete their data, and their rights.
- Make deletion real. If the policy says users can delete their account, the app must actually be able to delete the account and its rows and files.
- Link the policy in the footer, on the sign-up form, and in any app store listing. Apple requires the link both in App Store Connect and inside the app.
- Have a lawyer review it for your jurisdiction, especially if you have EU or UK users, handle health or financial data, or serve children.
- Check the app matches the words. A policy that promises protection while a table is open to the public makes things worse, see data leak.
When to get an engineer
An engineer cannot write your policy, a lawyer does that. What an engineer can do is tell you what the app really collects and where it goes, which is what the policy must describe. A one-off check at $49–$800 maps the tables, third-party calls and storage, and flags data you did not know you kept. Give the result to your lawyer along with the draft.
Top-rated companies
Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.
- 1Afterbuild Labs10.0/10Best for: A check before launchFree first step · from $49
- 2Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
- 3Vibe Code Rescue (Lev Arakelyan)9.0/10Best for: A one-off check and a cleanupFrom $299
Check these
Access rules are on for every table
In Supabase, open Table Editor: every table should show RLS enabled, with at least one policy. In Firebase, your rules should never say allow read, write: if true.
One user cannot open another user's records
Sign in as user A, copy a request from the Network tab, and change the record ID to one that belongs to user B. You should get an error or an empty result.
File storage is private where it should be
Upload a private file, copy its URL, and open it in a private window. If it loads, the bucket is public.
Signing out really ends the session
Sign out, press Back, and refresh. You should not see private pages or data.
Questions
My app is tiny and free, do I still need one?
Size is not the test under the GDPR, handling personal data of people in the EU is. App stores require a policy regardless. Confirm with a lawyer for your country.
Can the AI write the policy for me?
It can produce a draft, but it does not know what your app actually collects or which laws apply to you. Check the data list yourself and have a lawyer review it.
Sources: GDPR.eu: writing a privacy notice; UK ICO: the right to be informed; California Attorney General: CCPA; Apple: App Store Review Guidelines.