Privacy Policy Checklist

Privacy Policy Checklist assembles the disclosures a policy is normally expected to carry, in six sections: identity and contact, what you collect, why and on what basis, sharing and transfers, retention and security, and user rights. Seven answers shape it — the kind of site or product, the main audience, and whether you set cookies beyond the strictly necessary ones, run analytics, send marketing email, show targeted advertising or knowingly serve children. Depending on those answers the list runs to between seventeen and twenty-eight items, followed by a short Before publishing section that is not counted among them.

The audience setting does most of the work. Choose the European Union and the items name GDPR, the seven rights it grants, the supervisory authority in your member state, the safeguards for transfers out of the EEA, and a child age of 16 with the note that member states may lower it to 13. Choose California and the legal-basis item disappears entirely, because CCPA/CPRA is not built that way, the rights narrow to the six that Act grants, and complaints are directed to the California Privacy Protection Agency. The UK, other US states, Canada, Australia, Brazil and a global default each swap in their own set of names. One line ignores the audience: the advertising item carries its Do Not Sell or Share wording whenever that box is ticked, whichever region you picked. The site type adds items rather than rewording them: a shop or a marketplace gets the line about card numbers staying with the payment processor, a marketplace also gets what buyers and sellers can see of each other, a SaaS product gets the customer content you process on someone else's behalf and the DPA to link to, and a mobile app gets device permissions and why each one is needed.

Pasting your current policy into the optional box turns the empty boxes into marks. Each item carries between one and six keywords; the text you paste is lower-cased with its whitespace collapsed, and an item is marked as mentioned when any one of those keywords appears anywhere in it. That is a plain substring search and nothing more, which cuts both ways. The identity item looks for words including address, so a policy that only ever mentions an IP address is credited with having named the controller. The item about data collected directly looks for name, which is also inside username and domain name. Nothing checks that the sentence carrying the keyword is adequate, or even on the subject. Read a tick as probably somewhere in the document and a cross as worth looking at — the crosses are the more dependable half.

Two limits frame everything else. This is a reference list of what those laws usually require, not legal advice, and nothing in it is measured against what you actually collect: there is no cookie scan, no tracker detection and no request made to your domain. Nor does it write the policy — this is not a policy template and there is no publishable text at the end, only the subjects your own text has to cover, and the boxes are printed characters rather than controls, so nothing is saved and a second run rebuilds the list with everything unticked. The whole thing is assembled in this browser tab from text that ships with the page, so a draft pasted in for the keyword check is not uploaded, and the tool still works with the network disconnected.

Runs on your device. Your file is processed directly in this browser.