Document Guide

Privacy policy
IN PLAIN ENGLISH

Upload your privacy policy for a clause-by-clause breakdown in plain English.

$10/ 30 pages

A privacy policy is a legal document that explains what personal information a company collects, how they use it, who they share it with, and what rights you have over your data. Every website, app, and online service has one — it's required by law in most jurisdictions. But privacy policies are famously unreadable: thousands of words of legal jargon that almost no one reads, often changing without notice, and offering less protection than most people assume.

The function of a privacy policy is disclosure, not protection. A company can collect enormous amounts of data, track you across the web, share your information with hundreds of partners, and sell your behavioral profile to advertisers — as long as they say so in their privacy policy. "We take your privacy seriously" is a marketing phrase, not a legal commitment. What matters is what the policy actually permits, which is usually a lot.

Privacy policies matter most when you're sharing sensitive information: health data, financial data, location history, biometric data, or anything about children. They also matter when you're evaluating a product's trustworthiness — a company with a clear, limited privacy policy is signaling something different from one with a vague, permissive one. Reading the policy won't stop data collection, but it will help you make an informed choice about whether to use the service.

Common clauses in a privacy policy

  • Information collected

    A list of the personal data the company gathers, typically divided into categories: information you provide directly (name, email, payment info), information collected automatically (IP address, device type, browser, location, cookies), and information from third parties (social login data, data brokers, advertising partners). The more detailed this section, the more transparent the company is being. Vague language like "information necessary to provide our services" is a red flag.

  • Cookies and tracking technologies

    A description of how the company uses cookies, pixels, SDKs, and other tracking tools. First-party cookies are set by the site you're visiting; third-party cookies are set by advertising and analytics partners. Many privacy policies link to a separate cookie policy with more detail, and may offer a cookie consent banner (required in the EU and some US states).

  • How information is used

    The purposes for which your data is collected: to provide the service, personalize your experience, send marketing emails, run analytics, improve the product, comply with legal obligations, and — often buried — to show you targeted advertising. Look for language about "sharing" data for advertising purposes, which is how most free services make money.

  • Information sharing and disclosure

    Who the company shares your data with: service providers (who process data on their behalf), advertising partners, analytics companies, affiliates, law enforcement (when required), and in connection with a merger or sale. "We don't sell your data" is common language, but it often coexists with sharing data for advertising, which accomplishes the same thing through a different mechanism.

  • Third-party services and integrations

    A note that the privacy policy doesn't apply to third-party websites or apps you access through the service. If you click a link or use a social login, the third party's privacy policy governs. This is a liability limitation, not a protection.

  • Data retention

    How long the company keeps your data. Some policies specify retention periods (e.g., "we retain account data for 3 years after you close your account"); others say they retain data "as long as necessary" for their purposes. Indefinite retention is common and means your data may never be deleted.

  • Data security

    A general statement about security measures — encryption, access controls, audits — without specific commitments. Most privacy policies disclaim liability for breaches: "No system is 100% secure" is standard language. Look for whether the company commits to notifying you of a breach.

  • Your rights and choices

    A description of what you can do: access your data, correct inaccuracies, delete your account, opt out of marketing emails, manage cookie preferences. If you're in California (CCPA), the EU (GDPR), or certain other jurisdictions, you have statutory rights — the right to know what data is collected, the right to delete, the right to opt out of "sale" or "sharing" of data. The policy should explain how to exercise these rights.

  • Children's privacy

    A statement about whether the service is intended for children under 13 (usually not) and what happens if the company learns a child has signed up. COPPA in the US and similar laws elsewhere require parental consent for collecting children's data. If the service is designed for kids, there should be detailed COPPA compliance language.

  • International data transfers

    A disclosure that your data may be transferred to and processed in countries other than your own, and a description of the legal mechanisms used (Standard Contractual Clauses, the EU-US Data Privacy Framework, etc.). This matters if you're in the EU or another jurisdiction with restrictions on cross-border data transfers.

  • Changes to the privacy policy

    How the company will notify you of changes. Common language is "we'll post the updated policy and change the 'last updated' date" — in other words, no active notice. Better policies commit to emailing you or obtaining consent for material changes. Continued use after a change typically counts as acceptance.

  • Contact information

    How to reach the company with privacy questions or requests. Look for a dedicated privacy contact or data protection officer (DPO), especially if you're in the EU. Companies subject to GDPR are required to appoint a DPO.

  • California-specific disclosures (CCPA/CPRA)

    If the company does business in California, there may be a separate section describing rights under the California Consumer Privacy Act and its successor, the California Privacy Rights Act: the right to know, delete, correct, and opt out; the categories of information collected and sold; and how to submit a request. Similar disclosures may exist for Virginia, Colorado, Connecticut, and other states with privacy laws.

  • GDPR-specific disclosures

    For EU users, a section explaining the legal bases for processing (consent, contract, legitimate interest), additional rights (data portability, objection, restriction), and how to file a complaint with a supervisory authority.

Red flags to watch for

  • Vague or unlimited data collection

    Language like "we may collect any information you provide or that we obtain from other sources" without specifics. A good privacy policy lists categories of data; a bad one leaves the door open for anything.

  • Sharing with "partners" for advertising

    A disclosure that your data is shared with advertising partners or used for targeted advertising, often phrased as "to provide relevant ads" or "to support our services." This is how free services monetize you. If you're uncomfortable being tracked across the web, this matters.

  • Indefinite data retention

    A policy that says data is kept "as long as necessary" without defining what that means. Your data could be retained forever, even after you delete your account.

  • No meaningful opt-out

    A policy that describes data collection and sharing but offers no way to opt out except by not using the service. Look for an opt-out mechanism for advertising, email marketing, and data sales (if applicable).

  • "We may share data in connection with a merger or sale"

    Standard language, but it means your data could end up with a company you never agreed to do business with. Some policies let you delete before a transfer; most don't.

  • Automatic acceptance of changes

    A statement that the company can change the privacy policy at any time and your continued use is consent. This is common but worth noting — the privacy policy you agreed to today may not be the one that governs tomorrow.

  • No breach notification commitment

    A policy that disclaims responsibility for security breaches and doesn't commit to notifying affected users. Some jurisdictions require breach notification by law, but the policy itself may not promise it.

  • "Aggregated and anonymized" data sharing without limits

    A carve-out that says the company can share "aggregated or anonymized" data with anyone for any purpose. Anonymization is often reversible, and this clause can be used to share detailed data while claiming it's not "personal."

Read your own privacy policy

$10 for 30 pages // About 90 seconds // Deleted after 24 hours

// This is not legal advice // Plain-English summary generated by AI // Always read the original document