LegalFree tool
Privacy Policy Generator for Sites and Apps
A privacy policy for your website or app, written from the data you collect and the tools you use, with only the sections that apply.
Free to start · Opens in your River workspace, ready to edit and share
How to write a privacy policy for a website or app
A privacy policy is the public notice on your website or app that explains how you handle personal information. It says what you collect, why, who receives it, how long you keep it and what rights people have. California law requires one from any commercial site or app that collects personal information from Californians, and Apple and Google require one for every app. A good policy describes what you actually do, in plain words.
The safest policies describe rather than promise. "We use an email service to send our newsletter" stays true as you grow. "We never share your data" breaks the day someone adds an ad pixel.
Map where your data goes
Trace each piece of personal information from where it enters your site or app to every service that receives it. Ask whoever built the product, and check your tag manager and your app's code libraries (SDKs): tracking tools are the easiest to forget.
Walk through every form
Sign-up, checkout, contact and support forms, uploads and surveys. Note each field and why you need it.
Add what's collected automatically
IP addresses, device identifiers, cookies, analytics events, crash reports and session recordings.
Name every outside service
Payments, hosting, email, analytics, ads, live chat, and any AI service that receives what people type or upload.
Note how long you keep it
The retention period for each item, where it's stored, and how you'd delete one person's data.
Tracking tools are where policy and practice drift apart. In 2023 the FTC alleged that GoodRx had promised users it would never share their health information with advertisers1, then shared it with Facebook, Google and Criteo. GoodRx agreed to pay a $1.5 million civil penalty.
If you prefer a spreadsheet, the small business privacy policy template has a data inventory sheet for this step. Before you write that an AI provider won't keep or train on your users' data, confirm it with a plain-English review of its contract.
Check which privacy rules apply
What the policy must cover depends on where your users live and what you collect. Start with CalOPPA, California's online privacy law. It has no size threshold, and the state Attorney General's guide notes that a mobile app counts as an online service2 under it.
Rules that shape most website and app privacy policies
| Rule | Who it covers | What the policy must cover |
|---|---|---|
| CalOPPA (California) | Commercial sites and apps that collect personal information, even just an email address, from Californians | What you collect, the kinds of third parties you share it with, how you announce changes, and the effective date |
| CCPA (California) | For-profit businesses with over $26,625,000 in revenue3 last year, or that buy, sell or share the data of 100,000 or more California consumers or households a year | Each privacy right, two or more ways to send requests, and the kinds of data you collected, sold or shared in the past 12 months |
| GDPR and UK GDPR | Businesses based in the EU or UK, or that offer goods or services to people there or track their behavior there | Your identity, each purpose and its lawful basis, recipients, retention and people's rights, as listed in the UK regulator's checklist4 |
| COPPA (US) | Sites and apps aimed at children under 13, or that know they collect data from them | Your practices for children's data, plus direct notice to parents and their verifiable consent5 before you collect, with limited exceptions |
The CCPA's third test is earning half or more of your annual revenue from selling or sharing personal information. Its revenue figure rises with inflation every two years. Many other states have their own privacy laws and thresholds.
CalOPPA also covers tracking. Say whether other companies, such as ad networks, can collect data on visitors' activity across sites through yours. If you track people across sites yourself, say how you respond to a browser's Do Not Track signal.
Write your privacy policy in plain words
Write for someone hunting for one answer: use headings that match their questions, and write as "we." The UK regulator says privacy information must be concise, transparent, intelligible, easily accessible and in clear and plain language4, a good standard anywhere. A clear order:
- Who we are: your legal name and a contact address someone reads
- What we collect: what people give you, what's collected automatically, and what comes from others
- How we use it: each purpose, with its lawful basis if you serve the EU or UK
- Who we share it with: service providers by type, and anyone using the data for their own ends
- Cookies and tracking: each tool, and your response to Do Not Track
- How long we keep it: a period, or the rule that sets one
- Your rights: what people can ask for, and exactly how
- Changes: how you'll announce them, and the effective date
Before: We may share your information with trusted third parties to improve our services.
After: When you record a meeting, we send the audio to our transcription provider, which turns it into text and a summary. Its contract lets it use recordings only to provide that service, not to train its models. We delete recordings 90 days after the meeting unless you save them.
- Names the data. Meeting audio, not "your information."
- Says who and why. One kind of provider and one purpose, stated as fact rather than "may."
- Matches the contract. Promise no more than the provider's terms allow.
Post it where people and app stores look
On a website, put a link with the word "privacy" in your footer so it shows on every page, including checkout and sign-up. California's law accepts a homepage text link containing that word as conspicuously posting the policy2.
Apps need the policy in two places. Apple's guidelines require a link in the App Store Connect metadata field and within the app6. The policy must also explain retention and deletion. It must confirm that third parties such as analytics tools, ad networks and SDKs give user data the same protection your policy promises.
Google Play requires a link in Play Console and a link or text inside the app7, even for apps that don't access any personal data. The policy must be a public web page, not a PDF. It must cover all the app's data handling, not just what you declared in the store's Data safety section.
Update it when your product changes
Review the policy whenever you add a vendor or SDK, collect something new, enter a new country or find a new use for data. Update the effective date each time. If the CCPA applies, it also requires an update at least once every 12 months.
Announce changes the way your policy says you will; CalOPPA requires it to describe how. The UK regulator goes further: you must tell people about any new use of their data before you start4. For a big change, such as sharing data with advertisers, email your users; California's Attorney General advises against relying on a policy edit alone2.
When a lawyer should read it first
This guide explains common US, EU and UK rules; it isn't legal advice. Get a privacy lawyer's review before publishing if you handle health, financial or children's data, sell personal information, or may meet the CCPA's thresholds.
Before you publish your privacy policy
- Every form, tag, SDK and AI service is on your data map
- No line promises more than you do, including "we never share"
- Each right you list has a working email or form behind it
- It has an effective date and says how you'll announce changes
- It's linked in your footer, your app and each app store listing
To start from a draft, the generator at the top of this page writes the policy from the tools you list and marks anything it can't confirm. Then write your terms of service from the same facts, so the two documents agree.
How it works
Start with a few lines on what you collect and every service that touches it: payments, hosting, analytics, ad pixels, email and any AI features. Add where your users are, and attach your current policy if you have one. River works out what each service receives, checks which privacy laws reach your business, and writes the policy in your workspace.
It never invents a practice you didn't describe. Anything likely but unconfirmed is marked for you to check, and if you attached an old policy, River lists each claim it changed and why. Its reply also names the laws it applied and what the policy commits you to, such as answering deletion requests.
Describe your setup
Say what you collect and which services touch it, from payments and analytics to ads and AI.
River maps the rules
It works out what each tool receives, then checks which privacy laws apply to your size and audience.
Get your draft policy
A plain-language policy in your workspace, with every practice it couldn't confirm marked for you to check.
Confirm and keep current
Fix the marked items, then ask River to update the policy when you add a tool or market.
What you get
- A privacy policy in plain language, written from the data you collect and the tools you name
- Each service you name described by what it receives, such as card details, usage data or browsing activity
- California's required disclosures, including the effective date and how you respond to Do Not Track signals
- State privacy rights and opt-out sections only when your size, revenue and audience meet the thresholds
- European and UK sections, with the lawful basis for each use, when your users are there
- A reply naming the laws applied, what the policy commits you to and every item to confirm
Common questions
Do I need a privacy policy for my website or app?
Almost certainly, if you collect any personal information, even just an email address. California's online privacy law covers commercial sites and apps of every size with users in California. Both app stores require a policy for every app, and so do Google Analytics' terms. If you serve people in the EU or UK, the GDPR sets out what you must tell them.
What should a privacy policy include?
A privacy policy should tell people what you collect, why, who gets it, how long you keep it, and how they can see, fix or delete it. Add a contact for privacy questions, the effective date and how you'll announce changes. Some rules ask for more: the GDPR wants the lawful basis for each use, and Apple wants apps to explain how users can request deletion.
Can I copy another company's privacy policy?
You shouldn't. A copied policy describes another company's tools and data practices, so parts of it will likely be false for your business. And you can be held to every promise it makes. Start instead from a list of what you collect and the services that receive it, then write or generate the policy from that list.
How often should I update my privacy policy?
Update it whenever your practices change: a new tool, a new kind of data, a new market or a new use, such as training AI. Change the effective date each time, and tell users about material changes before they take effect. If the CCPA applies to you, the law also requires an update at least once every 12 months.
How do I write a privacy policy with River?
Type what you collect and the services that touch it in the box at the top of this page, then pick where your users are. You can also attach your current policy. River infers what each service receives, decides which laws apply, marks anything it couldn't confirm, and writes the policy into your free River workspace.
Is the policy River writes legal advice?
No. River drafts the policy from what you describe, but it doesn't audit your systems or give legal advice. It flags children's, health and financial data, where extra rules apply. In those cases, or if you sell personal information or serve many people across states or in Europe, have a privacy lawyer review the draft before you publish.
Is the privacy policy generator free?
Yes, it is free to start. Your privacy policy opens in a River workspace, where you can edit it, share it or ask River to change it, for example after you add a new tool. Paid plans add more AI use and access to the most advanced models.
Sources
FTC. “FTC Enforcement Action to Bar GoodRx from Sharing Consumers’ Sensitive Health Info for Advertising.” ftc.gov (opens in a new tab)
California Attorney General. “Making Your Privacy Practices Public: Recommendations on Developing a Meaningful Privacy Policy.” oag.ca.gov (opens in a new tab)
California Privacy Protection Agency. “Updated Monetary Thresholds in CCPA.” cppa.ca.gov (opens in a new tab)
Information Commissioner's Office. “Right to be informed.” ico.org.uk (opens in a new tab)
FTC. “Complying with COPPA: Frequently Asked Questions.” ftc.gov (opens in a new tab)
Apple Developer. “App Review Guidelines.” developer.apple.com (opens in a new tab)
Google Play Console Help. “User Data.” support.google.com (opens in a new tab)
Built by
Chandler Supple
Co-founder & CEO, River
Chandler has spent the last six years working in AI, building tools for millions of users and Fortune 100 companies. In 2025, he co-founded River to build a new kind of operating system for AI agents.