Privacy Policy exists, linked from footer and registration, last-updated date

A missing or unlinked Privacy Policy violates GDPR Art. 13 and Art. 14 (which require informing users about data collection at the point of collection), CCPA §1798.100 and §1798.130(a)(5) (which require a publicly accessible privacy policy before collecting personal data), and COPPA §312.4 if your service may be used by children. Collecting email addresses, using analytics, or requiring account creation without a linked Privacy Policy means every data point you hold is potentially unlawfully collected — exposing you to regulatory fines (GDPR: up to 4% of global turnover), class-action suits, and FTC enforcement. The privacy policy must be visible before users submit personal data, not buried in settings post-signup.

Create app/privacy/page.tsx with actual policy content and a hardcoded LAST_UPDATED constant. Link it from your footer and from registration forms before the submit button.

// app/privacy/page.tsx
const LAST_UPDATED = 'February 15, 2026'

export default function PrivacyPolicyPage() {
  return (
    <main className="max-w-3xl mx-auto px-4 py-12 prose">
      <h1>Privacy Policy</h1>
      <p className="text-sm text-muted-foreground">Last updated: {LAST_UPDATED}</p>
      {/* policy content */}
    </main>
  )
}

On your registration form, add before the submit button:

<p className="text-sm text-muted-foreground">
  By creating an account, you agree to our{' '}
  <a href="/terms">Terms of Service</a> and acknowledge our{' '}
  <a href="/privacy">Privacy Policy</a>.
</p>