privacy-policy-writer

Privacy Policy Writer

Create or update a practical privacy policy draft based on installed packages, product code, project docs, and the user's stated data practices.

This skill is a drafting aid, not legal advice. Always recommend qualified legal review before publishing.

Workflow

Step 1: Inspect Product And Data Context

Before writing, inspect the project for real data flows and existing privacy language.

Prioritize these sources:

1. Existing privacy policy, legal pages, cookie notices, consent banners, footer links, onboarding copy, settings pages, account deletion flows, and support docs.
2. README.md, product docs, landing pages, feature specs, app store copy, and public marketing pages.
3. Package manifests and lockfiles that reveal installed SDKs or services.
4. Auth/account flows, forms, API routes, server actions, backend models, database schemas, storage buckets, uploads, exports, deletion jobs, and webhooks.
5. Analytics, telemetry, crash reporting, advertising, attribution, payments, email, chat/support, maps/location, AI APIs, push notifications, identity providers, and cloud services.
6. Environment variable examples and config files that name third-party providers.

Common files and patterns to inspect:

PRIVACY.md
privacy*.md
LEGAL.md
README.md
docs/**/*
app/**/*.{ts,tsx,js,jsx,md,mdx}
pages/**/*.{ts,tsx,js,jsx,md,mdx}
src/**/*.{ts,tsx,js,jsx,py,rb,php,go,rs,md,mdx}
components/**/*.{ts,tsx,js,jsx}
routes/**/*
api/**/*
server/**/*
models/**/*
schema.prisma
migrations/**/*
package.json
pnpm-lock.yaml
package-lock.json
yarn.lock
requirements*.txt
pyproject.toml
Gemfile
go.mod
Cargo.toml
.env.example
app.json
app.config.*
next.config.*
firebase
supabase
stripe
posthog
analytics
amplitude
segment
sentry
crashlytics
mixpanel
ads
cookies
consent
delete-account
data-export

Treat the user's explicit data-practice statements as the highest-priority input. Treat project files as evidence of actual implementation. Do not invent legal facts or compliance claims.