Privacy Policy

The public statement of what personal data you collect and how you use it.

Also known as: privacy policy, privacy notice, data policy

A privacy policy publicly states what personal data you collect, why, how long you keep it, who you share it with, and what rights users have. It is legally required in most markets you will operate in, practically required by app stores and enterprise buyers, and increasingly read by users who have learned to care.

must cover:  data collected + purposes + legal bases · retention · sharing/processors
             user rights + how to exercise them · contact + updates procedure

Write it from reality: inventory actual data flows first, then describe them truthfully. A policy promising what engineering does not do (or omitting what it does) is liability in both directions — regulators see deception, customers see betrayal on breach day.

The classic mistakes:

Copy-paste policies. A template describing practices you do not follow (or omitting ones you do) fails the one test that matters: matching reality. Draft from your data inventory, then have counsel review.
Dark patterns beside fine words. A policy promising control above a UI that hides deletion is evidence against you. Align product behavior first, prose second.
No update procedure. Products evolve; policies must version with them, with meaningful changes communicated — not silent edits discovered by watchdogs.
Cookie and tracker sprawl undeclared. Third-party SDKs and pixels collect under your name. Audit what actually fires on your properties (cookie consent) and declare it completely.
One global policy, contradictory laws. Indonesia’s UU PDP, EU GDPR and others overlap without coinciding. Structure a base policy with jurisdictional supplements where you operate.

Pair with: matching terms of service, real consent flows, and the operational backbone (inventory, rights processes, breach playbook) that makes the promises true.