name: solo-legal description: Use when "privacy policy", "terms of service", "legal pages", "GDPR", "CCPA", "app store legal", or project needs compliance documents. Do NOT use for NDA or contracts. license: MIT metadata: author: fortunto2 version: "1.0.1" openclaw: emoji: "📜" allowed-tools: Read, Grep, Glob, Write, AskUserQuestion argument-hint: "[project-name]"

/legal

Generate privacy policy and terms of service tailored to the project's stack, features, and data handling. Aligned with manifesto privacy-first principles (templates/principles/manifest.md): on-device processing, local storage, no accounts when possible, user owns their data.

Disclaimer: Generated documents are templates, not legal advice. Review with a lawyer before publishing, especially for regulated industries (health, finance, children).

Steps

1. Parse project from $ARGUMENTS.

• Read docs/prd.md — features, ICP, data handling
• Read CLAUDE.md — stack, services used
• Read stack YAML from templates/stacks/{stack}.yaml if available
• If empty: ask via AskUserQuestion

1. Data audit — determine what data the product collects:

Scan PRD and codebase config for:

For each "yes": note the legal basis (consent, legitimate interest, contract).

Manifest alignment check:

• Data stored locally? (offline-first principle)
• Can user export all their data?
• Can user delete all their data?
• Any data sent to third parties without explicit consent?
• Does the app work without an account?

1. Detect applicable regulations:

Most solo projects: GDPR + App Store/Play Store is sufficient.

1. Generate Privacy Policy:

Structure (adapt to product):

```markdown # Privacy Policy

Last updated: {YYYY-MM-DD} Effective date: {YYYY-MM-DD}

## What we collect

{table from step 2 — only "yes" rows, in plain language}

## How we use it

{purpose for each data type — be specific, not "to improve our services"}

## Where data is stored

{local device / specific cloud service + region} {for offline-first apps: "Your data stays on your device. We cannot access it."}

## Third-party services

{list each service: Cloudflare (hosts the superduper-analytics counter), Stripe, Supabase — with links to their privacy policies}

## Your rights

• Access: request a copy of your data
• Delete: delete your account and all associated data
• Export: download your data in {format}
• Opt-out: disable analytics in app settings

## Data retention

{how long data is kept, what triggers deletion}

## Children

{if product is not for children under 13: "This product is not intended for children under 13."}

## Changes

We may update this policy. Changes will be posted here with an updated date.

## Contact

{email address for privacy questions} ```

Rules:

• Plain language, no legalese — users should understand what they're agreeing to
• Be honest about what you collect — don't hide tracking behind vague language
• Offline-first products get a simpler policy (less data = less to explain)
• If the app collects nothing: say so explicitly ("We collect no personal data")

1. Generate Terms of Service:

Structure:

```markdown # Terms of Service

Last updated: {YYYY-MM-DD}

## What this is

{product name} is {one-line description}. By using it, you agree to these terms.

## Your account

{if accounts exist: account rules. If no accounts: "No account is required."}

## Your data

You own your data. We do not claim any rights to content you create. {for offline-first: "Your data is stored on your device. We have no access to it."}

## Acceptable use

Do not use {product} to: {short list of prohibited uses relevant to the product}

## Payments

{if paid: pricing, refund policy, billing terms} {manifest alignment: "No hidden fees. What you see is what you pay."} {if one-time purchase: "One-time purchase. No recurring charges."} {if subscription: explain what justifies the recurring cost}

## Availability

We aim to keep {product} available but cannot guarantee 100% uptime. {for offline-first: "Core features work without internet connection."}

## Limitation of liability

{standard limitation clause — product provided "as is"}

## Changes

We may update these terms. Continued use after changes means acceptance.

## Contact

{email} ```

1. Generate App Store privacy labels (if iOS or Android):

iOS (App Store Connect):

• Privacy nutrition label categories based on data audit
• Tracking: yes/no (ATT required if yes)
• Data linked to identity: list
• Data not linked to identity: list

Android (Play Store):

• Data safety form responses based on data audit
• Data shared with third parties: list
• Data collection purposes: list
• Security practices: encryption, deletion available

1. Write legal documents:

• legal/privacy-policy.md — privacy policy
• legal/terms-of-service.md — terms of service
• legal/app-store-privacy.md — app store labels (if mobile)
• Create legal/ directory in project root if needed

1. Output summary:

• Data types collected (count)
• Regulations applicable
• Manifest alignment (all principles met or violations flagged)
• Files generated
• Reminder: "Review with a lawyer before publishing"

Notes

• Documents are templates — always review before publishing
• Offline-first apps need simpler policies (this is a feature, not a limitation)
• Update legal docs when adding new data collection, third-party services, or features
• Analytics via superduper-analytics (https://github.com/fortunto2/superduper-analytics): no cookie, no localStorage, web id derived at the edge and rotated daily, so no consent banner. On iOS declare Usage Data → Product Interaction + Identifiers → Device ID, Not Linked, not Tracking, no ATT. Any other tracker on the page voids that claim
• Stripe handles PCI compliance — never store card data yourself

Common Issues

Product collects more data than expected

Cause: Third-party SDKs (analytics, crash reporting) collect data automatically. Fix: Audit all SDKs in package.json/Podfile/build.gradle. List each one in the privacy policy.

Offline-first but still needs some cloud

Cause: Sync, backup, or auth requires cloud. Fix: Be explicit: "Core features work offline. Optional sync requires {service}." List exactly what syncs.

App Store rejection for missing privacy policy

Cause: No privacy policy URL in app metadata. Fix: Host privacy-policy.md as a web page (GitHub Pages, project website, or static hosting). Add URL to App Store Connect / Play Console.