privacy-page-generator
# privacy-page-generator This Claude Code skill structures Privacy Policy pages for digital products, guiding users through identifying what data their product collects, which privacy regulations apply, and how to disclose AI involvement, analytics, and data retention practices. Use it when users need to create, update, or ensure compliance for privacy documentation, especially when GDPR, CCPA, cookie policies, or AI model training are relevant.
git clone --depth 1 https://github.com/kostja94/marketing-skills /tmp/privacy-page-generator && cp -r /tmp/privacy-page-generator/skills/pages/legal/privacy ~/.claude/skills/privacy-page-generatorSKILL.md
# Pages: Privacy Policy Guides Privacy Policy page content, structure, compliance, and AI-specific disclosures. **When invoking**: On **first use**, if helpful, open with 1–2 sentences on what this skill covers and why it matters, then provide the main output. On **subsequent use** or when the user asks to skip, go directly to the main output. ## Initial Assessment Identify: 1. **Product category**: Free anonymous, free with account, freemium, subscription SaaS, enterprise/B2B, API/developer, marketplace, e-commerce, content/media, mobile app, AI agent/MCP — see legal-page-generator §Product Categories 2. **Data actually collected**: URLs, prompts, uploads, analytics, cookies, account data, payment data — be exhaustive 3. **AI involvement**: Whether AI models process user data and whether data is used for training (see §AI Disclosures) 4. **Jurisdiction needs**: Which privacy regulations apply — see legal-page-generator §Jurisdiction Decision Framework 5. **Indexing**: Typically index (see legal-page-generator §Indexing Strategy) --- ## Required Sections (14-Section Framework) ### 1. Who We Are - Operator name (or "the operator of [Product]" for anonymous operations) - Tool purpose in one plain-language sentence - Contact email ### 2. What [Product] Does - One paragraph explaining the core function - Mention that no account or payment is required (if applicable) - Set expectations: this is a [free/paid] [tool type] that does [X] ### 3. Information We Collect Structure with clear sub-sections: **What We Do NOT Collect** (trust signal — include for all products): - No accounts, no passwords, no user profiles - No payment information (if free) - No contact lists or address books - No precise location data - Adapt this list to what's actually true for the product **Data You Submit** (URLs, prompts, uploads, form inputs): - What happens to it: processed for [purpose], sent to [AI providers if applicable] - Whether it's stored: "processed in-memory and discarded after the request" or retention period - Whether it's used for training: "not used to train AI models" (if true — state explicitly) **Generated Content** (AI output, images, text): - Returned to user's browser/account - Whether retained on servers - Whether used for training **Analytics Data**: - Which analytics tool (GA4, Plausible, etc.) - What's collected (page views, device/browser, referrer, country-level location, session duration) - Whether it identifies individuals **Account Data** (if applicable): - Email, username, profile information - How it's used and stored **Payment Data** (if applicable): - Note that payment is processed by [processor], not stored directly ### 4. How We Use Information - Purposes: service provision, improvement, security, analytics, legal compliance - **AI Model Training Disclosure**: State explicitly whether user data is used to train, improve, or fine-tune AI models. If using API-based AI (OpenAI API, Google Cloud), note that these providers do not train on API data. If using consumer AI tools, disclose that training may occur. - Marketing communications (with consent where required) ### 5. Cookies Table format with opt-out instructions: | Cookie | Purpose | Duration | How to Opt Out | |--------|---------|----------|----------------| | `_ga`, `_ga_*` | Google Analytics — aggregate usage measurement | Up to 2 years | [GA opt-out browser add-on](https://tools.google.com/dlpage/gaoptout) or block third-party cookies | | `[session_cookie]` | Session management / fair-use enforcement | 24 hours / session | Clear browser data | Also state: - Whether advertising cookies are used - Whether cross-site tracking occurs - Whether the site responds to Do Not Track signals ### 6. Third-Party Processors Table format with privacy policy URLs: | Provider | Purpose | Privacy Policy | |----------|---------|----------------| | [Cloud provider] | Hosting / backend | [URL] | | [CDN provider] | Content delivery / routing | [URL] | | [AI model provider 1] | AI generation / processing | [URL] | | [AI model provider 2] | AI generation / processing | [URL] | | [Analytics provider] | Usage analytics | [URL] | ### 7. Data Retention Specify per category — avoid vague "as long as needed" language: - **Submitted data** (URLs, prompts, uploads): processed in-memory, discarded after response — not stored - **Generated content**: delivered to browser, not retained on servers - **Analytics aggregates**: retained for [X] months (GA4 default: 14 months) - **Server access logs**: retained for 30 days for security/debugging - **Account data** (if applicable): retained until account deletion; then deleted within [X] days ### 8. Your Rights Structure by jurisdiction: **GDPR (EEA/UK)**: - Rights: access, rectification, erasure, restriction, portability, objection - Legal basis for processing (Art. 6) - Right to lodge complaint with supervisory authority - Response timeframe: 30 days **CCPA (California)**: - Rights: know, delete, correct, opt-out of sale/sharing - Statement: "[Product] does not sell personal information" - How to exercise rights **How to Exercise**: - Email contact - Identity verification if needed (note: for anonymous tools, minimal data exists) ### 9. International Transfers - Where data is processed (country/region) - Safeguards: Standard Contractual Clauses, adequacy decisions, or other mechanisms - Note that data may transit through other regions as part of standard internet routing ### 10. Children - Age threshold: under 13 (US/COPPA) or under 16 (EEA/GDPR) - Statement: "not directed to children" / "do not knowingly collect" - What to do if a child has submitted data: contact for deletion ### 11. Security - TLS/HTTPS in transit - Encryption at rest (provider-managed or self-managed) - **No-credentials advantage** (if no accounts): "no passwords or credentials to leak" - No payment data stored (if applicable) - Breach notification commitment ### 12. Changes - Material changes pos
When the user wants to analyze Google Search Console data, use the GSC API, or interpret search performance. Also use when the user mentions "GSC," "Search Console," "indexing report," "Core Web Vitals," "Enhancements," "Insights report," "search performance," "search queries," "search performance report," "URL inspection," "impressions," "CTR," "average position," "index coverage," "GSC data analysis," "Search Console API," or "searchanalytics.query." When the user wants to rewrite title tags (not only report on them), use title-tag. For meta description rewrites, use meta-description.
When the user wants to build an SEO data analysis system, monitor indexing/traffic/keywords/backlinks, or set up benchmarks. Also use when the user mentions "SEO data analysis," "SEO monitoring," "article database," "traffic benchmark," "penalty recovery," "SEO work document," "SEO dashboard," "keyword tracking," "ranking monitoring," "indexing report," or "backlink monitoring." For GSC API, use google-search-console.
When the user wants to track AI search traffic in GA4 or GSC. Also use when the user mentions "AI traffic," "ChatGPT referral," "Perplexity traffic," "AI Overviews," "GA4 AI sources," "AI search analytics," "track AI referrals," "AI search traffic," "Claude traffic," or "how to track AI traffic." For AI SEO strategy, use generative-engine-optimization.
When the user wants to analyze website traffic sources, attribution, or dark traffic. Also use when the user mentions "traffic sources," "dark traffic," "direct traffic," "UTM parameters," "traffic attribution," "channel attribution," "attribution optimization," "channel analysis," "traffic analysis," "traffic diversification," "natural traffic benchmark," or "organic vs paid traffic." For GA4 setup, use analytics-tracking.
When the user wants to set up, audit, or optimize analytics tracking (GA4, events, conversions). Also use when the user mentions "Google Analytics," "GA4," "event tracking," "conversions," "attribution model," "gtag," "data layer," "GA4 setup," "conversion tracking," "event setup," "User ID tracking," or "CTA attribution." For traffic insights, use traffic-analysis.
When the user wants to promote via forums, communities, or invite users to join a community. Also use when the user mentions "forum promotion," "Indie Hacker," "Hacker News," "community growth," "Discord promotion," "vertical community," "brand encyclopedia," "Wikipedia," "Quora," "Reddit community," "community building," "forum marketing," or "community invite." For Reddit copy, use reddit-posts. For strategy, use integrated-marketing.
When the user wants to submit a product or app to directories, curated lists, launch platforms, or app stores—and needs ready-to-paste copy per platform. Reads project-context.md when present. Also use when the user mentions "directory submission," "get listed," "app store listing," "submit to directories," "curated list," "best tools list," "Taaft," "Product Hunt," "directory ads," "newsletter feature," "directory campaign," "tailor description per platform," "Shopify App Store," "Chrome Web Store," "navigation site," or "product directory." For Product Hunt launch day tactics (hunter, first comment, timing), use product-hunt-launch. For full 0→1 channel planning, use cold-start-strategy.
When the user wants to launch on Product Hunt, prepare a PH submission, or plan launch day (hunter, first comment, timing, upvotes). Also use when the user mentions "Product Hunt," "launch on Product Hunt," "PH launch," "Product Hunt submission," "hunter," "Product of the Day," "upvotes," or "Product Hunt first comment." For multi-platform directory listings and paste-ready copy beyond PH, use directory-submission.