I'm making a web app which:

  • is a personal project,
  • is open source,
  • is completely free,
  • doesn't have any kind of login system (users can't create accounts),
  • doesn't collect personal user data,
  • doesn't use cookies.

It is common among web developers to make this kind of apps and provide them without any Ts&Cs or privacy policy. Some examples from two web developers well known in the community:

My app will be similar to these two.

What, exactly, do we risk by not having Ts&Cs and/or a privacy policy on our web apps?

  • 2
    Ok I've added "(if any)" to my question. If you're able to answer "there are no risks" and provide some sources for this, I'd be super happy :-)
    – Zwyx
    Commented Mar 13 at 5:59

3 Answers 3

  • If you want to make your app available in app stores, those will insist on documentation.
  • The lack of a privacy statement may be in violation of the privacy laws in various countries.
  • Your understanding of what constitutes personal data may not match the definition of various privacy laws.

Say you host a website on your own server, the user gets to enter the parameters of a set of linear equations, and you solve the equations. Simple mathematics, nothing personal.

But the access logs of your server may legally constitute personal data. It is the kind of data that you can collect and process for legitimate readons, like troubleshooting your server. But you may need to tell that you do collect it, and document when it will be deleted.

And if the website is on a cloud hosting service, you are entrusting that personal data to a third party. Again, that can be done, but it needs to be documented.

  • It's a web app, so no app stores to insist on anything.
    – Greendrake
    Commented Mar 13 at 7:42
  • "the access logs of your server may legally constitute personal data" - note that it could actually even be worse than that. The definition of "processing" personal data under the GDPR for example is very broad, such that it isn't even necessary for it to be stored in a log. Merely collecting or using the data (e.g. an IP address) is sufficient.
    – JBentley
    Commented Mar 13 at 11:09

A privacy policy is needed to communicate to the users how their personal data is handled by the app (if it is handled at all).

Terms and Conditions are needed to spell out terms of the contract between the app holder and its users (if there is any contract at all).

doesn't have any kind of login system (users can't create accounts)

doesn't collect personal user data,

doesn't use cookies.

Assuming that is all true, the only risk is that some overly zealous simple-minded asshole with power tripping inclinations reports your web app to personal data protection authorities, and you may end up having to answer some stupid questions.


Since you asked what the risks are:

The following applys in the EU for Example.

Not telling your Users what data you collect and how you use it (even just the mandatory IP- Adresses) can make you vulnerable to legal actions.

Example: Many German website providers recently faced the problem that someone visited their Site and afterwards send them an letter from their attorney, telling them they violated the GDPR etc. This was due to a Lack of knowledge among the website providers that their website used the Google Fonts API and therefore send the IP of the Visitor to Google, which is a violation of GDPR, if the Visitor didn't acceptet this transfer of "personal Data(the IP Adress)". So if someone wants to hurt you, he has a lot of possibilities if you dont provide a privacy policy and ToS. You could even be fined.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .