Privacy policy generator

Draft a privacy policy for your website.

Site / service name Operator (privacy officer) Contact email Effective date

Use cookies Analytics Advertising (AdSense, affiliates, etc.)

This is a reference draft with no guarantee of legal validity. Before using it, adjust the collected items, retention periods, etc. to fit your service and have it reviewed by a professional.

You finish a small site, apply to an ad network or submit an app, and the form asks for a privacy policy URL you do not have. Writing one from scratch is intimidating; copying a stranger's policy leaves you with clauses about services you do not run.

This generator produces a short, readable draft covering the clauses a simple website normally needs. Fill in four fields, tick what applies, and edit the result to match what you actually collect.

How it works

The four fields

Site / service name — appears in the title and throughout the body as the name of the service.
Operator (privacy officer) — the person or company answerable for the data, printed in the contact section.
Contact email — the address users write to when they want their data viewed, corrected or deleted.
Effective date — printed at the bottom as the date this version starts applying.

The three checkboxes

Each one inserts an extra numbered section, and the numbering renumbers itself so there are never gaps:

Checkbox	Section it adds
Use cookies	States that cookies are used for personalised features and usage statistics, and that the visitor can refuse them in browser settings
Analytics	States that traffic-measurement tools may run and collect non-identifying statistics
Advertising	States that third-party ad or affiliate content may appear and that those providers may set their own cookies

The fixed sections — what is collected, why, how long it is kept, user rights, the responsible person, and notice of changes — are always included.

What you still have to edit

The draft describes a site that collects server logs, cookies and inquiry emails. If you have accounts, payments, file uploads, newsletters or a comment system, add those items to section 1 and give each a real retention period in section 3. If your visitors include people in the EU, the UK or California, you will also need clauses this template does not cover.

The result is a reference draft with no guarantee of legal validity — for anything beyond a personal site, have it reviewed by a professional before you publish it.

Terms explained

Operator (privacy officer): The person or company responsible for handling personal data and for answering user requests about it. Most privacy frameworks expect this name and a contact route to be published.
Effective date: The day the published version starts to apply. When you revise the policy later, publish a new date and keep a record of what changed.
Cookies: Small files a site stores in the browser to remember state or measure usage. Ticking the box adds a clause disclosing their use and the visitor's ability to refuse them.
Analytics: Traffic-measurement tools such as page-view counters. The generated clause says non-identifying statistical information is collected to improve the service.
Retention period: How long collected data is kept. The draft says data is destroyed once its purpose is met unless a law requires longer storage — replace this with your real periods if you store accounts or orders.
Non-identifying information: Data that cannot on its own be tied to a named person, such as aggregate visit counts. Combining several such fields can still identify someone, so the label is not a blanket exemption.

Frequently asked questions

Is the generated policy legally valid?

Treat it as a starting draft rather than legal advice. It covers the clauses most small informational sites need, but obligations vary by jurisdiction and by what you actually collect. Have it reviewed by a professional before you rely on it, particularly if you handle accounts, payments, or visitors from the EU or California.

Does this cover GDPR or CCPA?

Not on its own. The draft does include a user-rights clause and a contact route, which both regimes expect, but it does not state a legal basis for processing, describe international data transfers, or add a "Do Not Sell or Share My Personal Information" link. Add those separately if your audience reaches those regions.

Do I need a privacy policy just to run ads?

Ad and analytics providers generally require one in their programme terms, and disclosure of cookie and data use is a standard condition for publishers. Tick the advertising and analytics boxes so the matching clauses are present, then check the current requirements of the specific network you are joining.

My site collects nothing. Do I still need one?

Almost certainly. Server logs, IP addresses, and cookies set by your host, CDN, comment system or font provider count as personal data under most frameworks even when you never show a signup form.

Where should I publish it?

At a stable URL linked from the footer of every page — `/privacy` is the usual convention. Ad networks and app stores ask for that URL directly and may re-check it later, so pick a path you will not move.