How to write a privacy policy for an AI app
If your app collects an email address, you need a privacy policy. If it sends user text or files to an AI model, the policy needs to say so clearly. Here’s what to include, written for solo founders shipping with Lovable, Bolt or Cursor. It isn’t legal advice, but it will keep you from launching with a blank page or a template that doesn’t describe your app.
Do I legally need one?
- California (CalOPPA): any commercial website that collects personal information from California residents must post a privacy policy.
- EU/UK (GDPR): if you have EU or UK users, you must tell them what you collect, why, your legal basis, who you share it with and their rights.
- Platforms: Stripe, Google and Apple sign-in, the App Store, Google Play and most ad networks require a privacy policy URL.
The sections an AI app needs
1. What you collect
Account data (email, name), content users submit (prompts, files, generated output), payment metadata, and usage/device data (IP, browser, pages).
2. How AI processing works
Say plainly that user inputs are sent to a third-party model provider to generate results. Name the provider, link its policy, and state whether data is used for training. For example, OpenAI says API data isn’t used to train its models by default, and API providers may keep inputs for a limited time for abuse monitoring. Check your provider’s current terms and describe them accurately.
3. Service providers (sub-processors)
List every service that touches user data. A typical AI-built stack:
| Service | What to say |
|---|---|
| Supabase / Firebase | Hosts database, authentication and file storage |
| Stripe / Lemon Squeezy | Processes payments; you never see full card numbers |
| OpenAI / Anthropic | Processes submitted content to generate AI output |
| Google Analytics / PostHog | Measures usage with cookies or identifiers |
| Resend / SendGrid | Sends transactional email |
| Vercel / Netlify | Hosting; may log IP addresses for security |
ShipGrader detects these services from your live site and pre-fills them in the Full Report’s privacy policy starter.
4. Cookies and analytics
Distinguish essential cookies (login sessions) from analytics and marketing cookies. EU and UK visitors must opt in to the non-essential ones, so you need a consent banner. Cookieless analytics (Plausible, Fathom) avoid the problem.
5. Retention and deletion
Say how long you keep account data and generated content, and how users can delete their account. Pick a number you can actually honor, such as 30 days after a deletion request.
6. User rights and contact
Access, correction, deletion, export, and objection for GDPR; right to know and delete for CCPA/CPRA. Give a real contact email and respond within 30 days.
7. Children, international transfers, security, changes
State your minimum age (13+, or 16+ in parts of the EU), note that providers may process data in the US, describe your basic safeguards (HTTPS, access controls, RLS), and explain how you’ll notify users of changes.
Common mistakes
- Copying a generic template that mentions services you don’t use, while leaving out the ones you do.
- Promising “we never share your data” while sending prompts to an AI provider.
- Writing “we delete data immediately” when your database backups keep it for 7–30 days.
- No link to the policy from the sign-up form or footer.
Next step
Run a free scan. If ShipGrader can’t find a privacy policy, it flags it. The $29 Full Report includes a starter Privacy Policy, Terms and Refund policy pre-filled with the services detected on your site.