Your app collects emails and has no privacy policy

You built an app with Lovable, Bolt, v0, or Replit. It has a signup form, or an email capture box, or a login backed by Supabase or Firebase. There is no privacy policy link anywhere on the page, because you never asked the AI for one and it never volunteered. That combination is not a style problem. It is the first thing automated demand letter operations check for, because it is provable from a single screenshot.

Why this matters more than it feels like it should

California's CalOPPA requires any site or app that collects personal information from California residents to conspicuously post a privacy policy. An email address is personal information. "Conspicuously" means a visible link, usually in the footer. There is no small-site exception and no revenue threshold: a weekend project with an email box is covered the moment one Californian types their address into it. CCPA and GDPR add notice duties on top for larger operations, but CalOPPA is the one that applies to almost everyone and is the easiest to prove a violation of, which is exactly why low effort legal demand letters lead with it.

Separate from the law: Stripe, ad networks, and app stores all require a posted privacy policy, so the missing page will eventually block something you want to do anyway.

Confirm it in two minutes

1. Open your deployed app the way a stranger would. Does any page collect anything: email box, signup, contact form, chat widget, analytics?
2. Look for a Privacy Policy link on the page that collects it, and in the footer. Not in your repo, on the rendered page. If a visitor cannot find it, it does not count.
3. While you are there, check for a Terms of Service link too. Terms are not legally required the way the privacy policy is, but without them you have no liability cap, no governing law, and no stated right to close abusive accounts.

The fix, about an hour

1. Write down what you actually collect. Email addresses, names, analytics events, chat transcripts, payment data (Stripe collects card numbers for you, but you still receive names and emails), and anything your database stores per user. Also list the third parties the data flows through: Supabase or Firebase, Stripe, any analytics or pixel, any AI API you send user text to.
2. Generate an honest policy from that list. A generator or an AI prompt is fine as a starting point. What makes it defensible is that it matches reality: every collection point and third party from step 1 appears in it, and nothing in it claims practices you do not follow. A copied policy that mentions practices you do not have is worse than a short accurate one.
3. Include the required pieces: what you collect, what you use it for, who you share it with (name the actual services), how a user can ask you to delete their data, an effective date, and a contact email that works.
4. Post it conspicuously. A /privacy page linked from the footer of every page and next to any signup button. Tell your AI builder: "Add a privacy policy page at /privacy with this text, and link it in the footer site-wide and under the signup form." That is a five minute change.
5. Add terms while you are at it. Same pattern, /terms, footer link. For a small app the important parts are: the service is provided as-is, a liability cap, your right to terminate accounts, and governing law.

Do not do this

Do not paste a policy that names another company, promises a Data Protection Officer you do not have, or claims certifications you never got. Demand letters quote your own policy back at you, and a policy you do not follow converts a paperwork gap into a deceptive practices claim, which is worse. Short and true beats long and copied.

Related exposure the same audience ships

If the AI built your page with a Meta pixel, TikTok pixel, or a session recording tool (Hotjar, Clarity) firing before any cookie consent, that is its own demand letter category in California, with $5,000 statutory damages per violation cited in the letters: see the pixel before consent guide. And if most of your images have no alt text, ADA accessibility suits target exactly that: see the alt text guide. Both are visible from the outside in seconds, which is how the letter mills find them.

Not sure what your app is exposing?