Objective
Your mission
Review your app's data practices: minimization, classification, consent, deletion, and privacy policy. Output: privacy_review.md.
You need: An app that collects user data.
Time: 30 minutes.
Step 1: learn the privacy principles (5 min)
Privacy is trust
Privacy isn't just about compliance — it's about trust. Users who feel their data is respected are more likely to use your app, recommend it, and stay. For small apps, the basics go a long way: collect only what you need, be transparent, let users delete their data, and have a simple privacy policy.
Key principles:
- Data minimization: Collect only what you need. Every field is a liability.
- Safe vs. sensitive: Email/username = safe. Passwords/payment/health/government IDs = sensitive.
- Consent: Get explicit consent for non-essential data collection.
- Deletion: Users have the right to be forgotten (GDPR, CCPA).
- Privacy policy: Required if you collect personal data.
Step 2: audit your data collection (5 min)
List every field your app collects on signup and in the app.
Write in your file:
## Data Collection Audit
### Signup Fields
1. [field name] — Necessary? [yes/no] — Sensitive? [yes/no]
2. [field name] — Necessary? [yes/no] — Sensitive? [yes/no]
[repeat for each]
### App Data Fields
1. [field name] — Necessary? [yes/no] — Sensitive? [yes/no]
[repeat for each]
Step 3: apply data minimization (5 min)
For each field, ask: "Do I need this data to make the feature work?" If no, remove it. If maybe, make it optional.
Write in your file:
## Data Minimization
Fields removed: [list or "none"]
Fields made optional: [list or "none"]
Fields kept as required: [list]
Reasoning: [1-2 sentences on why kept fields are necessary]
Step 4: check consent (3 min)
Do you need explicit consent for anything you collect?
- Data beyond core feature needs → checkbox (unticked by default)
- Marketing emails → separate consent
- Analytics/tracking → consent required
Write in your file:
## Consent Check
Consent needed for: [list or "none — only collecting essential data"]
Consent mechanism implemented: [checkbox/text/N/A]
Step 5: implement data deletion (5 min)
Write the SQL to delete a user's data from all tables:
-- Delete user's data from all tables
delete from habits where user_id = 'uuid';
delete from settings where user_id = 'uuid';
delete from profiles where user_id = 'uuid';
-- Delete auth user (must be done server-side with service_role key)
Write in your file:
## Data Deletion Process
Tables with user data: [list all]
Deletion SQL written: [yes/no — paste the SQL]
Auth account deletion method: [Supabase admin / service_role]
Process ready to use: [yes/no]
Step 6: write a privacy policy (7 min)
Write a simple privacy policy covering:
- What data you collect
- Why you collect it
- How you store it
- Who you share it with (third parties)
- How users can request deletion
- How to contact you about privacy
Write in your file:
## Privacy Policy
[Write your privacy policy here — keep it simple and honest]
Step 7: add privacy policy to app (5 min)
Add a link to the privacy policy in your app's footer, accessible from every page.
Write in your file:
## Privacy Policy Link
Added to footer: [yes/no]
Accessible from every page: [yes/no]
Your signup form asks for name, email, birthday and phone number. The app is a reading list. What does data minimisation say?
Collect only what the app needs to work. A reading list needs an email to log in; birthday and phone add risk without purpose.