Guide
Privacy policy for Bolt apps
How to write a privacy policy for an app built with Bolt, by scanning the deployed URL instead of guessing the stack.
What Bolt does not write for you
Bolt projects are often one deployed app with client calls to Firebase, Supabase, or an AI API written into the generated code. A boilerplate line that says 'we use cookies to improve the site' does not name those providers.
Paste the public URL, including the bolt.host or custom domain you shipped. The scan follows the homepage and a few same-origin links and matches scripts against the signature list.
What to put on the page
Name the operator, a contact email, and every service the live site actually loads: payments, auth, database, analytics, session replay, email, ads, support chat, and AI APIs. Say how someone can ask you to delete an account. Link a refund policy if you charge.
TermsPack's free scan scores those gaps. The $29 pack drafts the pages from the detected vendors. Monitoring is $9 a month and emails you when a later scan finds a service the policy does not name.
TermsPack generates templates from what we detect on your site. This is not legal advice and does not create an attorney–client relationship. Have a lawyer review documents for your situation.