LegalFree
Privacy Policy Generator for Sites and Apps
List what you collect and the services you use, and get a privacy policy matching what your business actually does, with only the sections that apply.
River writes a privacy policy from what your business actually collects and the services that touch it. Tell it the data, the tools on your website and in your app, and where your users are. It drafts each section to match: what you collect and from where, why, who receives it, how long you keep it, and how people can use their rights. Sections that do not apply to you are left out rather than padded in to look thorough.
A privacy policy is a promise regulators can hold you to. The Federal Trade Commission says that if a company makes privacy promises, the law requires it to live up to them. So a template claiming you never share data, while an advertising pixel runs on every page, is worse than having no template. River checks the tools you name against the claims in the policy. A retargeting pixel, for example, means the policy has to address sharing for advertising.
This is for small businesses, founders and app makers who need a policy before launch, before an app store submission or before turning on ads. If you sell software to businesses, they will also ask for a data processing agreement, and the DPA and data terms review helps when they send their own. The terms of service generator writes your terms from the same facts, because the two documents have to agree.
Which privacy laws reach a small business
In the United States the widest rule is California's online privacy law. Any commercial website or online service that collects personal information from California residents must conspicuously post a privacy policy. It has to list the categories collected and who receives them, explain how people can review or change their information, say how you announce changes, give an effective date, and say how you respond to browser do not track signals. Size makes no difference.
California's broader consumer privacy law applies only above certain thresholds, such as annual gross revenue over $26,625,000 from 2025, or buying, selling or sharing the personal information of 100,000 or more California consumers or households. A growing number of other states have passed comprehensive privacy laws with thresholds of their own. River asks for your rough size and audience, includes the state rights sections that apply, and tells you which ones it left out and why.
Europe and the United Kingdom work differently. If you offer services to people there, the GDPR can apply whatever your size. Its Article 13 lists what you must tell people when you collect their data, including the legal basis for each use, how long you keep it, and their right to complain to a regulator. River adds those sections only when your users are in Europe or the UK, and notes when you may also need a representative there.
How it works
List your practices
What you collect, the tools on your site and in your app, and roughly where users are.
River maps the rules
Your size, audience and tools are checked against the privacy laws that could apply to you.
Get your policy
A privacy policy ready for review, plus a short list of practices to confirm or change.
Keep it current
Ask River to update the policy when you add a tool, a feature or a new market.
What you get
- A privacy policy written from the data you collect and the tools you actually use
- Each service you name checked against the policy's claims, such as advertising pixels and sharing
- California's required disclosures, plus state privacy rights sections only where the thresholds apply
- European and UK sections, with a legal basis for each use, when your users are there
- Plain language a customer can actually read, with no sections padded in for show
- Every practice River could not confirm marked clearly, so nothing untrue gets published
Common questions
Do I legally need a privacy policy?
If your website or app collects personal information from California residents, which includes an email address on a sign-up form, California law requires one. App stores, payment processors and advertising platforms also require a policy before they will work with you. In practice almost every business with a website that collects anything needs one.
Is a privacy policy enough to comply with privacy laws?
No. The policy describes what you do; the laws also require you to do it. That can mean honoring opt-out requests and browser privacy signals, getting consent for certain cookies, signing data agreements with your vendors, and keeping data secure. River lists the actions the policy commits you to, so you can check each one is actually in place.
Do I need a cookie banner?
For visitors in Europe and the UK, generally yes: non-essential cookies such as analytics and advertising need consent before they are set. United States law has no general banner rule, but if you sell or share data for targeted advertising, several states require a clear way to opt out. River tells you which applies from the tools you list.
What if we send customer data to AI services?
Say so plainly. The policy should name the purpose, the kind of provider, and whether that provider may keep or train on the data. Check your contract with the provider before writing that it cannot, because the policy must match what the contract allows. River asks about this whenever your description mentions AI features.
How often should I update it?
Whenever your practices change in a way the policy describes: a new analytics or advertising tool, a new kind of data, a new country, or a new use such as training AI. Change the effective date each time, and tell users about material changes as the policy promises. A yearly review catches the changes nobody announced.
Is this legal advice?
No. River drafts the policy from what you describe and flags what it cannot confirm, but it does not audit your systems or give legal advice. If you handle health, financial or children's data, sell personal information, or serve large numbers of people in several states or in Europe, have a privacy lawyer review it before publishing.
Sources
- FTCPrivacy and Security (opens in a new tab)
- California Legislative InformationCodes displaySection.xhtml (opens in a new tab)
- cppa.ca.govCalifornia Privacy Protection Agency (CPPA) (opens in a new tab)
- EUR-LexDelete or return all the personal data at the end of the service and delete existing copies (opens in a new tab)
Built by
Chandler Supple
Co-founder & CEO, River
Chandler has spent the last six years working in AI, building tools for millions of users and Fortune 100 companies. In 2025, he co-founded River to build a new kind of operating system for AI agents.
Privacy Policy Generator for Sites and Apps
Describe what you need, add any files you have, and your workspace opens with the work already underway.