The legal minimum of a public site

Not legal advice, and why that is the honest position

The rules for a public site depend on where you are, where your users are, what you store, and how old your users might be. They differ between the European Union, India, the United States (where they differ between states), Brazil, Nigeria and everywhere else, and several of them have been rewritten in the last few years and will be again. This lesson describes the shape that is common to most of them so that you know what the questions are. It cannot answer them for your app, and neither can a model.

The privacy notice

Nearly every regime requires that you tell people what you collect and what you do with it. The notice is a page, linked from the footer and from sign-up, written in plain sentences, and it says:

• What you store: email, name, the content they create, their IP address in logs.
• Why: to run the service, to send the emails they asked for, to fix problems.
• Who else receives it: the host, the database provider, the email service, the error tracker, and (this is the one generated notices omit) the model provider, for the AI features, with the provider named and what they retain stated.
• How long you keep it, including the log retention and the backup retention.
• How to get a copy, correct it, or have it deleted, and an email address for that.

Free generators produce a template; the template will not know about the model provider or your backup retention, so read it and fix it. A notice that does not match what the app does is worse than none in most regimes.

Terms

A short page saying what the service is, that it may change or stop, what users may not do with it, and which country’s law applies. For a free side project it is mostly protection against the person who treats a hobby app as a contract. Once money changes hands it becomes a real document, and that is the point to have somebody read it.

Cookies

Session cookies needed to keep somebody signed in are exempt from consent requirements in the European rules, because the site does not function without them. Analytics, advertising and third-party cookies are not, which is why banners exist. An app with a session cookie and nothing else does not need a banner; an app with an analytics script serving EU users generally does. The cheapest compliance is to use a privacy-respecting analytics tool that sets no cookie, or none at all.

Deletion is a path, not a flag

The question above is the mistake generated apps make: a soft delete is a display decision, not erasure. A real deletion request runs a path:

1. The soft delete, immediately, so the person disappears from the product.
2. A hard delete of the rows, after whatever grace period you give for mistakes, by a scheduled job.
3. The backups expire on their retention schedule, and the notice says so: “deleted data may persist in backups for up to 30 days”.
4. Requests to third parties where the data went: the email service’s contact record, the error tracker’s events, and the model provider’s retained inputs if their terms retain any.
5. What you keep, named: invoices you must retain for tax law, or a record under a legal hold, with the reason.

Build the job before the first request arrives, because the first request will come with a deadline attached in some regimes: a month is common.

Age

Rules differ on the age below which a service needs a parent’s consent: thirteen in the US federal rule, thirteen to sixteen by country in the EU, and under eighteen with parental consent in India’s data protection law. A general-audience app usually states a minimum age in its terms and asks for a birth year or a confirmation at sign-up. An app that is for children is a different category with much heavier duties everywhere, and the closing lesson of this course names it as one to not build unsupervised.

The person who can answer

For a free app with a few hundred users in one country, the notice, the terms, the deletion path and the age line are usually the whole of it, and a careful afternoon produces them. The moments that call for somebody qualified: users in more than one jurisdiction, payments, health or financial data, anyone under eighteen, or a first request from a regulator or a lawyer. At those points the cost of an hour of advice is small next to the cost of guessing, and the model’s guess is the cheapest and least reliable of all.