Module 6 of 10

Legal pages and your country

A video for this module is coming.

Real users, and especially real money, mean your app needs a privacy policy and terms of use. Shipyard writes drafts from what your app actually does. It also researches your country's rules from official sources. Neither is legal or tax advice.

What you'll do

You will answer a few questions about who runs the app, let Shipyard write the /privacy and /terms pages, read them back in plain words, and publish them. Then you will build a country checklist you can take to an accountant.

Everything here is a draft and research, not legal or tax advice. Rules differ by country and change. Have the pages checked by a professional, especially before you take real payments. If you are unsure about anything in your situation, ask a lawyer or an accountant in your country.

Why this matters

Your app collects at least an email address, so privacy rules apply. The app stores also require a privacy page. If you sell anything, consumer rules apply too, such as the right to cancel. Generated text from your real settings is much better than a template with blanks, but it is still only a starting point.

Steps

Claude runs these commands for you inside Claude Code. They are shown so you know what is happening; they do not work if you paste them into a normal terminal.

In Claude Code, run /shipyard:launch and choose "Privacy and terms pages". Your app already has /privacy and /terms routes. They show text from one file, src/lib/legal-content.ts.
Claude runs the generator:
```
node "${CLAUDE_PLUGIN_ROOT}/scripts/legal-generate.mjs" <appDir>
```
If details are missing, it stops and lists them. Claude asks one at a time and saves each:
- Whose name is on the service. You as a person is fine, with your full name. Or a company.
- A postal address where you can be reached. In many countries it is shown publicly. If you work from home and do not want that, a business address or a PO box may be an option. The law in your country decides.
- A public contact email for privacy questions.
- Your country. It decides which law the terms name and which privacy authority is mentioned.
- A phone number, only when your app takes payments. A mobile number is fine. If you truly have none, the answer "none" is accepted.
- A VAT number, only if you have one.
Claude never invents a value.
Claude runs the generator again. It lists the services it found (Supabase and Vercel always, and Resend, Stripe, an AI service or Google sign-in when your app uses them) and writes the file. The same input gives the same file, so running it again is safe.
Claude reads the result back in five bullets: who is responsible for the data, what is collected, who else handles it, the rights people have (including deleting their account in the app), and what the terms say about payments and cancelling if billing is on.
Publish it the normal way: a branch, a pull request (a proposed change you review), green checks, merge, then a deploy. Claude asks before saving anything to GitHub.
Open /privacy and /terms on your live address and read them on your phone.
Build the country checklist. Claude researches your country from official sources only: the tax authority, the business register, the consumer protection authority, the data protection authority, and for EU countries the Your Europe portal. It writes LAUNCH-CHECKLIST.md in your app folder, one short section per topic, with a source link and the date it looked.

What the country checklist covers

Whether you need to register as a business before your first sale.
Sales tax or VAT: whether you must register and from what income. In the EU, selling digital services to consumers in other EU countries above 10,000 euro a year in total means charging the buyer's country VAT, handled through a scheme called the One Stop Shop. Other thresholds are marked "check current value" with a link.
What an invoice or receipt must contain, and whether Stripe's receipts are enough where you live.
Consumer rights, such as the 14-day withdrawal right for digital subscriptions in the EU and the UK.
Which privacy authority applies and what your privacy page must include.
How Stripe pays you out in your country.
Whether a merchant of record would take the tax work off you (module 7).

Claude does not recommend a specific accountant or lawyer. The top of the file says it is research from official sources, not advice, and that you should confirm with an accountant before taking real payments.

When to regenerate

The generator replaces the file, so hand edits are lost. Run it again when you add a service or a module (payments, an email list, an AI service), change a price, change your company details or country, or change your domain. If you want custom wording, tell Claude and re-apply it after each regeneration.

Done when

/privacy and /terms open on your live address and name you.
You read them and understood the five points above.
LAUNCH-CHECKLIST.md exists and you have marked what you did and what you still need to do.
You have booked or planned a professional check, at the latest before taking real payments.

If something goes wrong

The generator stops and lists missing details. That is on purpose. Answer each one. It will not guess.
You do not want your home address shown. Do not put it in just to get past the step. Ask a local professional what your country allows, such as a business address.
The Health page still says "draft". That is a deliberate reminder for admins, not an error. The public pages do not show it.
You edited the file and it disappeared. The generator rewrites it. Keep custom wording in a note and re-apply it.

Check yourself

Is the generated privacy policy legal advice?

No. It is a draft made from your settings. Have it checked, especially before taking real money.

You add a newsletter to your app. What should you do to the legal pages?

Run the generator again so the privacy page mentions email updates and how to unsubscribe.

Where do the country notes come from?

Only from official sources such as tax authorities, business registers and consumer and data protection authorities, with links and dates in `LAUNCH-CHECKLIST.md`.