“It’s just a side project” isn’t a category the law recognises. What matters is whether you collect personal data, and almost every app does. This is a practical guide, not legal advice; if real money or sensitive data is involved, have a professional look.
You’re collecting personal data if you have any of these
- A sign-up or login (email addresses are personal data).
- A contact form, waitlist or newsletter box.
- Analytics that use cookies or identify visitors, such as Google Analytics or Meta Pixel.
- Payments, even when Stripe or another provider handles the card.
- Server logs with IP addresses, which is nearly every host’s default.
If visitors from the EU, the UK or California can reach your site, the GDPR and CCPA expect you to tell them what you collect and why. Separately, the App Store, Google Play, Stripe and Google’s OAuth screen all ask for a privacy policy link before they’ll approve you. In practice the platforms catch small projects long before a regulator does.
What a useful policy actually says
- What you collect, in plain words: “your email address and the projects you create”.
- Why: to log you in, to send receipts, to see which pages get used.
- Who else sees it: name the services. Your host, your database, your analytics, your email sender.
- How long you keep it, and how to get it deleted.
- A contact email that someone reads.
The most common mistake is a generated policy that doesn’t match the app. If the policy says “we don’t use cookies” and your site loads Google Analytics, the policy is worse than useless. Start from what your code actually does.
The cookie banner question
You need consent before loading trackers that set cookies for EU and UK visitors. You don’t need a banner for cookies that are strictly necessary, like the one that keeps someone logged in. The cheapest way out is to switch to cookieless analytics (Plausible, Fathom, Vercel Analytics), which is why this site has no banner.
The other things that get checked
A privacy policy is the headline, but the same reviewers and regulators look for terms of service, a way to contact you, and basic accessibility: a page language, image descriptions and a real page title. Accessibility is a legal matter too, under the ADA in the US and the European Accessibility Act.
Scan your site with vibeliqand it will tell you which of these it can’t find, and hand you a prompt that makes your AI tool read your own codebase first, list the data you really collect, and draft the policy from that.