Privacy policy page exists and is linked

A linked, non-placeholder privacy policy is a baseline legal obligation under GDPR Art. 13, CCPA §1798.130, and Google/Apple store policy — any app that collects email, names, or analytics identifiers without disclosing the fact fails each of those regimes. It is also gating for third-party integrations: Stripe requires a published policy before activating a live account, Google OAuth verification rejects apps without one, and the App Store/Play Store will remove listings on takedown. AI coding tools routinely scaffold a sign-up form and an analytics library but skip the policy page entirely, or leave an unlinked /privacy route with "Coming soon" boilerplate that never gets written. The failing shape is invisible in development — the site works, users sign up, and the legal gap is discovered at launch review or on first takedown notice.

Create a privacy policy page (templates available at termly.io, gdpr.eu) and add a link in your footer component.

Deeper remediation guidance and cross-reference coverage for this check lives in the gdpr-readiness Pro audit — run that after applying this fix for a more exhaustive pass on the same topic.

• ID: project-snapshot.legal.privacy-policy-linked
• Severity: medium
• What to look for: Look for a privacy page at app/privacy/page.tsx, app/privacy-policy/page.tsx, pages/privacy.tsx, public/privacy.html, or equivalent. Then check whether the site footer or main layout contains a link to that route. Count both.
• Pass criteria: A privacy policy page exists AND is linked from at least one persistent navigation surface (footer, header, signup form).
• Fail criteria: Either the page is missing, or it exists but is unlinked.
• Skip (N/A) when: Project is purely a CLI / library / non-user-facing API with no public web surface. Quote: "No public web surface detected (project type: {type})."
• Do NOT pass when: A page exists but its content is a placeholder ("Coming soon", "TODO", or fewer than 100 words of actual policy text).
• Report even on pass: "Privacy policy at {path}; linked from {locations}."
• Detail on fail: "No privacy policy page found at app/privacy/, app/privacy-policy/, or pages/privacy.tsx" or "Privacy page exists at app/privacy/page.tsx but no link found in footer/header".
• Remediation: Create a privacy policy page (templates available at termly.io, gdpr.eu) and add a link in your footer component.