Skip to main content
CalcChef

Privacy Policy Skeleton

Answer questions about your site or app to get a privacy policy template in Markdown or HTML, with optional GDPR, UK GDPR, CCPA and CalOPPA sections. How it works

Use the Privacy Policy Skeleton

Basic information

Data collected

What data does your website/app collect? *

Third-party services

Tick every outside service that receives information about your visitors.

Third-Party Services (optional)

Your situation

Do you use cookies or tracking?
Do you collect data from children under 13?
Do you offer your site or app to people in the EU/EEA, or monitor their behavior?

That is what brings a business outside the EU under the GDPR (Art. 3). Having a visitor from the EU is not by itself the test. Adds a section with the Art. 13 information to complete.

Does the CCPA cover your business?

Any one of three tests is enough: gross annual revenue over $26,625,000 (the figure since 1 January 2025; the California Privacy Protection Agency adjusts it for inflation in odd-numbered years), buying, selling or sharing the data of 100,000 or more California residents or households, or earning 50 percent or more of annual revenue from selling California residents' personal information. Adds a California section.

Do you offer your site or app to people in the United Kingdom, or monitor their behavior?

The UK GDPR (with the Data Protection Act 2018) has its own rules and its own regulator, the ICO. Adds a UK section with the items the ICO lists for privacy information to complete.

Does your site or app collect personal information from California residents?

CalOPPA asks such a site to post a privacy policy that names the categories of information and of third parties, says how users can review and change their information, how you tell them of changes, the effective date, and how you respond to Do Not Track signals. Adds a CalOPPA section.

Do you sell or share personal information with third parties?

Sell means for money or other value; share includes cross-context advertising.

The form, including the name, address and email, is kept in this browser (localStorage) until you press Clear Saved Values. Values from a link are filled in for this visit and are not saved.

Draft policy
9 sections
Gaps to complete 11
Not legal advice. This is a starting template, not a finished policy and not a statement that you comply with the GDPR, the CCPA or any other law. It lists what your answers say and leaves a [BRACKETED] gap wherever only you know the answer or the law asks for more. Complete every gap and have a lawyer check the result before you publish it.

Sections in this draft (9)

INFORMATION WE COLLECT, HOW WE USE YOUR INFORMATION, DATA RETENTION, COOKIES AND SIMILAR TECHNOLOGIES, THIRD PARTIES, SECURITY, CHILDREN'S PRIVACY, CHANGES TO THIS POLICY, CONTACT

Still to complete (11)

Each of these is a gap in the text below. The text is not usable until they are filled in or deleted on purpose.

  • [DRAFT TEMPLATE, NOT LEGAL ADVICE: COMPLETE EVERY BRACKETED PART, HAVE A LAWYER CHECK IT, THEN DELETE THIS LINE]
  • [YOUR APP NAME]
  • [LIST THE INFORMATION YOU COLLECT]
  • [LIST EACH PURPOSE FOR WHICH YOU USE THE INFORMATION, FOR EXAMPLE PROVIDING THE SERVICE, PAYMENTS, SUPPORT, ANALYTICS, LEGAL OBLIGATIONS]
  • [ADD ANY DATA YOU KEEP LONGER, FOR HOW LONG AND WHY]
  • [CONFIRM THIS IS TRUE FOR EVERY PAGE AND EVERY SERVICE YOU USE]
  • [CONFIRM THIS IS TRUE, INCLUDING HOSTING, EMAIL AND PAYMENT PROVIDERS]
  • [DESCRIBE THE SECURITY MEASURES YOU ACTUALLY USE TO PROTECT PERSONAL DATA]
  • [YOUR CONTACT EMAIL]
  • [DESCRIBE HOW YOU WILL TELL USERS ABOUT CHANGES]
  • [YOUR WEBSITE ADDRESS]

Draft Privacy Policy (Markdown)

[DRAFT TEMPLATE, NOT LEGAL ADVICE: COMPLETE EVERY BRACKETED PART, HAVE A LAWYER CHECK IT, THEN DELETE THIS LINE]

# PRIVACY POLICY FOR [YOUR APP NAME]

Last updated: [TODAY'S DATE]

## 1. INFORMATION WE COLLECT

We collect the following types of information:

- [LIST THE INFORMATION YOU COLLECT]

## 2. HOW WE USE YOUR INFORMATION

We use the information we collect to:

- [LIST EACH PURPOSE FOR WHICH YOU USE THE INFORMATION, FOR EXAMPLE PROVIDING THE SERVICE, PAYMENTS, SUPPORT, ANALYTICS, LEGAL OBLIGATIONS]

## 3. DATA RETENTION

We keep personal data for 12 months after account closure or your last interaction with us. [ADD ANY DATA YOU KEEP LONGER, FOR HOW LONG AND WHY]

## 4. COOKIES AND SIMILAR TECHNOLOGIES

We have not listed any cookies or similar tracking technologies on our website. [CONFIRM THIS IS TRUE FOR EVERY PAGE AND EVERY SERVICE YOU USE]

## 5. THIRD PARTIES

We have not listed any third-party service that receives your information. [CONFIRM THIS IS TRUE, INCLUDING HOSTING, EMAIL AND PAYMENT PROVIDERS]

## 6. SECURITY

[DESCRIBE THE SECURITY MEASURES YOU ACTUALLY USE TO PROTECT PERSONAL DATA]

## 7. CHILDREN'S PRIVACY

Our service is not intended for children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us at [YOUR CONTACT EMAIL].

## 8. CHANGES TO THIS POLICY

We may update this policy. The date at the top shows when it was last changed. [DESCRIBE HOW YOU WILL TELL USERS ABOUT CHANGES]

## 9. CONTACT

For questions about this policy or to use your rights, contact us:

**Website/App:** [YOUR APP NAME] ([YOUR WEBSITE ADDRESS])
**Contact email:** [YOUR CONTACT EMAIL]

The text is Markdown (# headings, ** bold). Use Copy HTML or Download .html for a web page, or Download .md to keep the Markdown.

About the Privacy Policy Skeleton

This is a starting template, not legal advice and not a finished policy: you answer the questions and it writes a draft, copied or downloaded as Markdown or HTML, with numbered sections and a [BRACKETED] gap wherever only you know the answer or the law asks for more. With nothing filled in the draft has 9 sections and 11 gaps under Still to complete; Yes to the EU/EEA, UK GDPR, CCPA or CalOPPA question adds a section for that law, each with more gaps.

Sections and gaps for some answers

AnswersSectionsStill to complete
Nothing filled in911
Name, address, email and one data type filled in97
The same, children under 13: Yes912
The same, EU/EEA: Yes1015
The same, CCPA: Yes1013
The same, UK GDPR: Yes1016
The same, CalOPPA: Yes1013
The same, EU/EEA and CCPA: Yes, Google Analytics ticked1122

Still to complete counts the distinct [BRACKETED] gaps, including the draft marker on the first line, which has to be deleted.

GDPR Art. 13 items the EU/EEA section leaves for you

Art. 13 itemGap in the draft
(1)(a), (1)(b): identity and contact details of the controller, its representative and the data protection officer[ADD THE CONTROLLER'S LEGAL NAME AND ADDRESS, ITS EU REPRESENTATIVE IF ANY, AND THE DATA PROTECTION OFFICER'S CONTACT DETAILS IF YOU HAVE ONE]
(1)(c), (1)(d): legal basis and legitimate interests[FOR EACH PURPOSE STATE THE LEGAL BASIS: CONSENT, CONTRACT, LEGAL OBLIGATION OR LEGITIMATE INTERESTS, AND DESCRIBE THE LEGITIMATE INTERESTS IF YOU RELY ON THEM]
(1)(e): recipients[LIST THE RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA, OR STATE THERE ARE NONE]
(1)(f): transfers to a third country[STATE WHETHER PERSONAL DATA IS TRANSFERRED OUTSIDE THE EEA, THE SAFEGUARDS USED AND HOW TO GET A COPY OF THEM, OR STATE THERE ARE NO TRANSFERS]
(2)(a): storage period or its criteria[ADD THE CRITERIA USED TO DECIDE HOW LONG DATA IS KEPT]
(2)(d): complaint to a supervisory authority[NAME AND CONTACT DETAILS OF THE SUPERVISORY AUTHORITY YOU REFER PEOPLE TO]
(2)(e): whether providing data is required[STATE WHETHER PROVIDING PERSONAL DATA IS REQUIRED BY LAW OR CONTRACT AND WHAT HAPPENS IF SOMEONE DOES NOT PROVIDE IT]
(2)(f): automated decision-making[STATE WHETHER YOU USE AUTOMATED DECISION-MAKING OR PROFILING, OR STATE THAT YOU DO NOT]

The rights of Art. 13(2)(b) and (c), access, rectification, erasure, restriction, objection, portability and withdrawing consent, are written out as a list in the draft.

CCPA points the California section leaves for you

What the California Attorney General's CCPA page saysGap in the draft
Requests can be sent by at least two methods, one a toll-free number; a business that operates only online needs only an email address[TOLL-FREE PHONE NUMBER, OR IF YOU OPERATE ONLY ONLINE STATE THAT AN EMAIL ADDRESS IS THE ONLY METHOD]
Businesses must verify requests to know and delete[DESCRIBE HOW YOU VERIFY THAT THE PERSON WHO MAKES A REQUEST TO KNOW OR DELETE IS THE CONSUMER]
A consumer may authorize another person to send a request[DESCRIBE HOW A CONSUMER CAN USE AN AUTHORIZED AGENT AND WHAT PROOF YOU ASK FOR]
A business that sells or shares shows a "Do Not Sell or Share My Personal Information" link, also in its privacy policy[ADD A CLEAR LINK TITLED DO NOT SELL OR SHARE MY PERSONAL INFORMATION TO YOUR WEBSITE AND LINK TO IT FROM THIS POLICY]
Sharing means sharing for cross-context behavioral advertising[SELL / SHARE / DO NOT SELL OR SHARE]

The link gap appears when you answer Yes to selling or sharing; the sell-or-share gap appears when you answer No but tick Google Analytics, Google Adsense, Facebook Pixel or Mixpanel.

CalOPPA points the section covers

What Business and Professions Code 22575(b) asks the policy to doIn the draft
Identify the categories of personally identifiable information collected and of third parties it may be shared withThe data types you ticked and the services you named, or [LIST THE CATEGORIES OF THIRD PARTIES, OR STATE THERE ARE NONE]
Describe the process for reviewing and requesting changes to that information, if there is oneA bracketed line for the process, with your contact email
Describe how users are told of material changes to the policy[DESCRIBE HOW YOU WILL NOTIFY USERS OF MATERIAL CHANGES TO THIS POLICY]
Identify its effective dateThe date at the top of the policy
Disclose how the operator responds to Do Not Track signals[DESCRIBE HOW YOUR SITE RESPONDS TO A BROWSER'S DO NOT TRACK SIGNAL OR TO OTHER SUCH MECHANISMS, OR LINK TO A PROGRAM THAT GIVES VISITORS A CHOICE ABOUT ONLINE TRACKING AND STATE THAT YOU FOLLOW IT]
Disclose whether other parties may collect personally identifiable information about online activities over time and across sites[STATE WHETHER OTHER PARTIES MAY COLLECT PERSONALLY IDENTIFIABLE INFORMATION ABOUT VISITORS ON YOUR SITE OVER TIME AND ACROSS DIFFERENT WEBSITES]

The statute as printed in the California Attorney General's guide Making Your Privacy Practices Public, which also recommends a clearly labeled Do Not Track heading and a conspicuous homepage link containing the word privacy; the draft names Do Not Track signals in the section title and leaves a gap for the link. With a cookie-based service ticked, the other-parties line is written for you with a gap to confirm it.

Frequently asked questions

What does this privacy policy template not cover?
It adds sections for the EU/EEA (GDPR), the United Kingdom (UK GDPR) and California (CCPA and CalOPPA) only. There is no section for Brazil's LGPD, Canada's PIPEDA, the Swiss FADP or US state privacy laws other than California's, it does not build a cookie consent banner, and for children under 13 it leaves gaps for what COPPA asks rather than writing that part. Copy the Markdown or HTML, or download the .md or .html file, and add anything else in your own copy.
What does a GDPR privacy policy need to include?
Art. 13 GDPR lists the information to give when data is collected: the controller's identity and contact details, the data protection officer where there is one, the purposes and legal basis, legitimate interests, recipients, transfers outside the EU, how long data is kept, the rights of access, rectification, erasure, restriction, objection and portability, withdrawing consent, complaining to a supervisory authority, whether providing data is required, and automated decision-making. The EU/EEA section of the draft has a line or a gap for each.
Does the GDPR apply to my website?
Art. 3 GDPR covers processing in the context of an establishment in the EU, and a business outside the EU when it offers goods or services to people in the EU or monitors their behavior there. Having a visitor from the EU is not by itself the test. The tool does not decide this for you: answer the EU/EEA question and ask a lawyer.
Who does the CCPA apply to?
The California Attorney General's page lists for-profit businesses that do business in California and have gross annual revenue of over $25 million, or buy, sell or share the personal information of 100,000 or more California residents or households, or derive 50% or more of their annual revenue from selling California residents' personal information. The revenue figure is adjusted for inflation: the California Privacy Protection Agency set it at $26,625,000 from 1 January 2025, and it changes again in odd-numbered years. CalOPPA, a separate California law, has no such threshold: it applies to operators of commercial websites and online services that collect personally identifiable information about Californians, and asks for a posted policy with a Do Not Track disclosure.
What rights does the California section list?
The rights to know, delete, correct, opt out of the sale or sharing of personal information, limit the use and disclosure of sensitive personal information, and not be discriminated against for using them, with 45 days to answer a request to know, delete or correct, extendable by another 45 days. These are the rights on the California Attorney General's CCPA page.
Why does the draft say [SELL / SHARE / DO NOT SELL OR SHARE]?
You answered Yes to the CCPA question and No to selling or sharing, but ticked an advertising or analytics service such as Google Analytics. The California Attorney General defines sharing as sharing for cross-context behavioral advertising, which such services can be, so the draft leaves the sentence for you to decide with a lawyer and shows a Check note.

When to answer Yes to each law question

Answer Yes to EU/EEA if you are established in the EU, offer goods or services to people there, or monitor their behavior there (GDPR Art. 3); a stray visitor from Europe is not the test. Answer Yes to CCPA if your business meets one of three California tests, such as gross annual revenue over $26,625,000 (since 1 January 2025); the FAQ lists them. CalOPPA has no threshold: it covers any commercial site or online service that collects personally identifiable information about Californians.

Each Yes adds a section and more gaps under Still to complete. Not legal advice. Unsure whether a law covers you? Ask a lawyer.

How the draft is built

The text never contradicts your answers: ticking Google Analytics with No to cookies still gives the cookie statement, with a Check note. Every draft has 9 numbered sections, and each Yes adds one:

  • EU/EEA: the GDPR Art. 13 items (controller, legal basis, transfers and more).

  • UK GDPR: the same items under UK law, the right to object set apart, and a complaint to the ICO.

  • CCPA: the rights to know, delete, correct, opt out of sale or sharing, limit sensitive data and non-discrimination, with 45 days to answer, extendable by 45.

  • CalOPPA: what you collect and share, how users review their data, how you announce changes, how you respond to Do Not Track signals and whether other parties track visitors.

Example: with a name, address, email and one data type filled in, the draft has 9 sections and 7 gaps under Still to complete; answering Yes to EU/EEA and CCPA and ticking Google Analytics makes it 11 sections and 22 gaps, one of them [SELL / SHARE / DO NOT SELL OR SHARE]. Adding UK GDPR and CalOPPA as well gives 13 sections and 35 gaps. The draft marker on line 1 is a gap too.

Copy the draft as Markdown or HTML, or download privacy-policy.md or privacy-policy.html. The HTML keeps only an allowed list of tags.

Related Tools

View all tools
Misc

Internet Ping Test

Time 5 HTTP requests from your browser to this site and see the median, min, max and jitter in ms. An HTTP round trip, not an ICMP ping.

Misc

Plywood Sheet Layout Optimizer

Turn a plywood, MDF or OSB cut list into a sheet count, cutting diagrams, a cut sequence and cost, with kerf and mixed sheet sizes, by a heuristic.

Misc

Browser Info

See what your browser tells websites: screen and window size in CSS pixels, pixel ratio, time zone, languages, processor count and user agent.

Misc

Roman Numeral Converter

Convert Roman numerals to numbers and numbers to Roman numerals, from 1 to 3,999,999, with a step breakdown. Spellings such as IIII are refused.

Misc

Plant Spacing Calculator

Plants that fit a garden bed from its length, width and spacing: square grid, staggered grid (about 15% more) and edge-to-edge counts.

Misc

Map Scale Calculator

Real distance from a map measurement and scale, the map distance for a real one, or the scale from both: at 1:50,000, 10 cm is 5 km.