Privacy policy: what is collected

Two jobs: cover the cases that can happen, and attach responsibility to an executable person and date. Elegant but unenforceable is worthless.

Task: A product launch needing a privacy policy.

[Before you start, do three things]
1. Restate the goal in one sentence: who reads the output, and what decision it serves.
2. If I have not given you the following, ask me. Do not assume:
   - data types and purposes
   - third-party sharing
   - storage location and retention
   - user rights
3. Say how you plan to do it (at most 5 steps) and wait for my go-ahead.

[Go through each of these]
- five sections: what, why, to whom, how long, how to delete
- no boilerplate hiding the reality
- list every third-party SDK and its purpose
- handling of minors' data

[Process]
1. List five possible scenarios including the worst
2. For each: who does what, how soon, and the consequence
3. Use checkable words, not 'reasonable' or 'timely'
4. Check clauses for conflict
5. Mark commercial terms needing business input

[Output]
Scenarios, responsibility, deadline, consequence, conflict check.

[Do not]
- No 'timely' or 'reasonable'
- Never an obligation without a subject
- No unenforceable penalties
- Do not give legal opinions beyond your remit