Why this matters
Privacy policies aren't decoration: laws, app stores, and payment processors all expect them, and a missing terms page means every billing dispute is argued from nothing. Launching without a way to reach a human kills early trust.
What "done" looks like
- A privacy policy describing what you actually collect is live and linked in the footer
- Terms of service cover accounts, payments, refunds, and termination
- A refund/cancellation policy is visible before checkout
- A monitored support channel is published with a realistic response expectation
How to do it
- Draft a privacy policy that matches reality — list the data you collect and the third parties it flows to. Generators like Termly or iubenda are a workable start; get lawyer review as you grow.
- Write plain-language terms of service: accounts, acceptable use, billing, refunds, termination, liability limits.
- Post refund and cancellation terms near checkout — processors like Stripe expect contact information and refund terms visible on your site.
- Stand up support: a support@yourdomain address or form that a human checks daily.
- Link everything in the footer, signup screen, and app store listings.
- Recheck the pages whenever your data practices or pricing change.
Common mistakes
- Copying a competitor's policy that misdescribes your actual data practices
- Publishing a support address nobody monitors
- Making cancellation harder than signup — a fast route to chargebacks
Real-world examples
- California's CalOPPA requires any commercial website collecting Californians' personal information to post a privacy policy — no size threshold.
- GDPR applies to services offered to EU users regardless of where the company is based.
- Apple's App Store requires every app to include a privacy policy link.
From a founder's point of view
These pages feel like paperwork until the first dispute, and then they are the whole conversation. Writing them honestly is cheaper than defending vague ones later.
Rule of thumb
A stranger should find how you handle their data, how to cancel, and how to reach a human — each within two clicks of your homepage.