Generating Privacy Policy

Template, not legal advice

Publish a public HTTPS privacy-policy URL before App Store/Google Play submission. Use legal counsel or a reputable generator, then customize the result to the exact profile, permissions, SDKs, vendors, and backend behavior you ship.

Data to review

Account profile

Document potential processing of:

• Name, email, password/verification state, phone, avatar, and Google/Apple connected identities.
• Sanctum tokens, device/session metadata, login history, and account security actions.
• Language, region, timezone, privacy, notification preferences, and onboarding state.
• Feedback/help requests, uploads, notification history, and billing entitlement records.
• FCM/device tokens when Account push is enabled.

Laravel owns Account storage, mail, uploads, webhooks, and notification delivery. State retention, deletion, processors, and cross-border-transfer practices explicitly.

Guest profile

Guest is local-first: Account auth/API calls, remote preference sync, FCM token registration, and server entitlement checks are disabled. Paywall/RevenueCat and AdMob remain available, so document store/payment and advertising SDK data flows when enabled. Store operations may require internet access.

Optional SDKs

List only integrations that you configure and ship. Possible services include RevenueCat, Google Sign-In, Sign in with Apple, Firebase Cloud Messaging, Google Mobile Ads, and Firebase/Crashlytics if you explicitly initialize it. The template includes a Crashlytics dependency but does not initialize collection by default.

Host and link the policy

Host the policy on the Guest profile's generated landing-page/, the Account profile's public admin-panel route (including its built-in landing/legal surface), Laravel public/, or another stable HTTPS domain. Link it from the Flutter About/settings screen using the existing url_launcher dependency. Test the URL while logged out and keep it consistent with store metadata and Data safety/App Privacy forms.

Before submission

• Inventory every permission, SDK, API, storage key, and backend table used by the shipped profile.
• Explain Account versus Guest behavior if both are distributed.
• Add contact, retention, deletion, and regional-rights information.
• Complete Apple App Privacy and Google Play Data safety forms consistently.
• Update the policy when adding ads, analytics, purchases, push, uploads, or new backend data.