A privacy policy that matches what your site actually does
Stop pasting a 3,000-word template full of services you never integrated. Flip 8 switches below; the sections and clauses in the document are decided by how your site really runs.
Start from an example
Not sure what to fill in? Pick the preset closest to your site — it fills the whole form — then change it to your own values (all example domains are reserved example domains).
Live preview
Follows every switch and keystrokeTake it with you
Three exits, identical content: Markdown for a docs folder or repository, plain semantic HTML that pastes straight into your page template, and a standalone .html file with its own styling.
Everything you type stays in this browser. Nothing is uploaded, and there's no account. Clearing site data or switching devices will lose it.
Why generic templates fail
Most privacy policy generators hand you the same 3,000 words no matter what your site does. Last spring I watched one indie maker clear an AdSense review in 48 hours, while another — using a template stuffed with clauses for services he never integrated — waited three weeks. The difference was not the writing. It was specificity.
My rule of thumb: every sentence in your policy should be checkable against something on your site. If the text mentions advertising cookies, an ad script should actually load; if it promises an account-deletion flow, you should have accounts. Reviewers and visitors both notice the mismatch faster than you expect.
The toggles are the tool
Eight switches stand between you and the finished document: cookies, third-party ads, analytics, payments, comments, email subscriptions, embedded content, and third-party fonts/CDN. Flip one and the preview below re-renders in roughly 200 milliseconds — enable ads and the ad-network clause appears along with the cookies it may set; turn on donations and an “Orders and payments” section explains what your payment provider sees and what this site keeps.
Turn everything off and the cookie section says, plainly, that the site sets none. Sections you did not enable simply do not exist in the output — no crossed-out clauses, no “not applicable” filler.
GDPR, CCPA, or neither
A second choice shapes the rights section. The default here follows the GDPR: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right to lodge a complaint with a supervisory authority. Switch to the California option and the text rewrites itself around the CCPA as amended by the CPRA — the right to know, delete, correct, opt out of sale or sharing, and the no-discrimination rule, with a plain statement that this site does not sell personal information.
The “General” option keeps a plain rights list without citing any law — useful for small personal sites whose audience is nowhere in particular. Pick by where your visitors are, not by which acronym you saw in a blog post. The Chinese edition of this tool targets the PIPL instead; the two pages are separate documents, not translations of each other.
Take it with you
Copy the Markdown into a docs folder or repository, paste the plain HTML into your page template (semantic tags, zero dependencies), or download a complete standalone .html file you can upload as-is — it carries its own minimal styling, so it looks like a document rather than a dump of tags. Whatever you change afterwards, re-export and overwrite.
One habit worth keeping: every time you add a third-party script — a new analytics account, an ad network, a payment button — come back, flip the switch, move the effective date to today, and re-download. A policy that lags reality by two services is worse than a short one that is accurate.
What this tool is not: legal advice. It covers the common shapes of independent sites. Regulated data — health, financial, children-first products — deserves a professional review after export.
Nothing leaves your browser
Everything you type stays in this browser. Nothing is uploaded, and there's no account. The form state lives in localStorage on this device; clearing site data or switching devices loses it, and the “Clear my data” button in the footer asks twice before deleting. Incognito windows forget everything the moment they close — that is normal, not a bug.
FAQ
Can I publish the generated policy as-is?
Yes, as a working draft. Check that every service you actually run — analytics, ad network, payment provider — has its toggle switched on, because the document only mentions what you enable. It covers common independent-site shapes and is not legal advice; for regulated data such as health or financial information, or sites aimed mainly at children, have a professional review it.
What actually happens when I flip a toggle?
The preview re-renders within about 200 milliseconds. Enabling ads adds the ad-network clause to Third-party services along with the advertising cookies it may set; turning on payments adds the Orders and payments section. Switch everything off and the cookie section states, plainly, that the site sets none. Re-copy or re-download after changing switches.
Is my input uploaded anywhere?
No. Everything you type stays in this browser. Nothing is uploaded, and there's no account. The form state is saved in localStorage on this device and never sent to a server; clearing site data or switching devices will lose it. The Clear my data button in the footer deletes it after a double confirmation.
Should I pick GDPR or CCPA?
Choose by where your visitors are, not where you read about it. The GDPR option fits EU audiences, the CCPA option fits California, and General keeps a plain rights list without citing any law. If your audience spans both the EU and California, keep the stricter GDPR version and add the CCPA opt-out note yourself.