Privacy policy template

This is a free, static sample privacy policy for a small app or website. Copy it as plain text and replace every [[FIELD]] with facts about your own product. It is a starting point, not a finished policy: it only works if it describes what you really do with data.

Before you copy it

List every kind of personal data you collect, including what analytics, hosting, payment and email tools collect for you.
Delete any clause that does not apply to you. A clause that promises something you do not do is worse than no clause.
Publish the policy at a public address and link it from your signup page, your app store listing and your site footer.
If you serve people in the EU, GDPR Article 13 lists what you must tell people. For California, see the California Attorney General CCPA page.

Sample privacy policy

Privacy Policy for [[PRODUCT_NAME]]

Last updated: [[DATE]]

1. Who we are

[[PRODUCT_NAME]] is provided by [[LEGAL_NAME]], [[ADDRESS]]. You can contact us about privacy at [[PRIVACY_CONTACT]].

2. What we collect

- Information you give us: [[DATA_YOU_PROVIDE, for example email address, name, payment details handled by our payment provider]].
- Information collected automatically: [[AUTOMATIC_DATA, for example IP address, device and browser type, pages or screens viewed]].
- Information from others: [[THIRD_PARTY_DATA, or write "none"]].

We do not collect: [[DATA_NOT_COLLECTED]].

3. Why we use it and our legal basis

We use your information to: provide and secure [[PRODUCT_NAME]]; take payments; answer your messages; improve the product; and meet legal duties. If the GDPR applies, our legal bases are: [[LEGAL_BASES, for example contract, legitimate interests, consent, legal obligation]].

4. Who we share it with

We share information only with service providers that help us run [[PRODUCT_NAME]]: [[PROVIDERS_AND_PURPOSES, for example hosting, payments, email, analytics]]. We do not sell your personal information. [[CHANGE_THIS_LINE_IF_YOU_SELL_OR_SHARE_FOR_ADVERTISING]]

5. Cookies and similar technologies

We use [[COOKIES_SUMMARY]]. See our cookie notice at [[COOKIE_NOTICE_URL]].

6. How long we keep it

We keep [[DATA_TYPE]] for [[RETENTION_PERIOD]]. After that we delete or anonymise it, unless the law requires us to keep it longer.

7. Where it is processed

Your information is processed in [[COUNTRIES]]. When it leaves your region we rely on [[TRANSFER_MECHANISM, or write "not applicable"]].

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your information, to object to or restrict some uses, to withdraw consent, and to complain to your data protection authority. To use a right, write to [[PRIVACY_CONTACT]]. We will reply within [[RESPONSE_TIME]].

9. Security

We protect your information with [[SECURITY_MEASURES]]. No system is completely secure, and we cannot guarantee absolute security.

10. Children

[[PRODUCT_NAME]] is not directed to children under [[MINIMUM_AGE]]. If you think a child has given us information, contact us and we will delete it.

11. Changes

If we change this policy we will update the date above and, for material changes, tell you by [[NOTICE_METHOD]].

Pick the version for your product

Store and platform reviews ask for specific points. These pages list them and give store-specific sample clauses:

Also useful: the terms and conditions template, the refund policy template and the cookie notice template.

Background reading: Privacy policy on Wikipedia.

The full editable pack (7 templates in Markdown, PDF and HTML) is being prepared.