Using a coding agent to write your compliance pages

Writing a privacy policy is mostly transcription. The hard part — working out what your app actually collects — is answered by files already sitting in your repository, which is exactly the kind of work an agent with filesystem access is good at.

What an agent can genuinely derive

From the build files alone, without asking you anything:

Fact	Where it comes from
App name	strings.xml app_name, CFBundleDisplayName, pubspec.yaml, app.json
Application / bundle id	applicationId in Gradle, PRODUCT_BUNDLE_IDENTIFIER in the Xcode project
Platform	Which of those files exist
Data collection	Every third-party SDK in build.gradle, Podfile, Package.swift, pubspec.yaml, package.json
Permissions and usage strings	AndroidManifest.xml, Info.plist
Ad publisher id	The AdMob application id in the manifest or plist
A proposed Play URL	Constructed from the application id — a proposal, not a fact, since the app may not be listed

That table is the substance of a privacy policy. It is also the answer to “what does my app collect”, which is the question most developers get wrong by memory and right by reading.

What it cannot know and must ask

An agent that invents these is worse than no agent:

• Your legal entity name and the jurisdiction your terms name.
• The support address you actually read. It must never guess this from a git config or an Apple developer login found in a fastlane file.
• Your real App Store id, unless it is in a fastlane config — the numeric id is not derivable.
• Whether the app is live, and under which listing.
• Business facts: whether you sell subscriptions, whether children are a target audience, whether you share data with a partner that leaves no trace in the dependency list.
• Anything about your backend. Nothing in the repository says how long you keep data.

A good result looks like: everything derivable is derived with the file and line it came from, and what remains is a short list of questions only you can answer.

Boundaries worth insisting on

Before you let any agent near this, decide these — they are the difference between a useful tool and a liability:

1. Nothing publishes without a human click. A generated legal page going live unreviewed is the whole risk in one sentence.
2. Every derived fact is attributable. “I found firebase-crashlytics at app/build.gradle:47” is checkable; “your app collects diagnostics” is not.
3. It does not commit or push. Proposing a diff is help; rewriting your repo is not.
4. It sends the minimum off your machine. Deriving facts locally and sending the conclusions is very different from uploading your source.
5. It says what it does not know. An agent that fills a placeholder with a plausible sentence has produced a compliance document containing a guess.

Ask those five questions of any tool in this category, including ours.

Where the human stays in the loop

The agent drafts; you decide. Specifically, you are the one who:

• confirms the questions it could not derive;
• reads the third-party section, which is the part a reviewer compares against your Data safety form;
• decides retention periods, because only you know your backend;
• clicks publish;
• fills in the store console fields — no agent should be inside your Play Console.

If your app touches money, health data or children, a lawyer’s hour still belongs in this list. A template drafted from evidence is a better starting point than a blank page; it is not advice.

What AppFoyer does here

There is a Claude Code plugin. You install it, say “make this app store-ready”, and the skill reads your build files, derives the table above with file and line for each fact, asks only what it could not find, and drafts all five pages plus app-ads.txt. It then hands you a review URL in the dashboard.

The boundaries above are enforced rather than promised. The agent’s credential reaches eight tools — list_apps, get_app, create_app, update_app, set_page, set_ad_lines, get_checklist and request_publish — and publishing is not among them: request_publish gives you a link, not a live page. An agent key cannot publish, unpublish, delete an app, change notification channels or touch your deletion-request inbox; those are session-only actions you take yourself. The skill never commits or pushes, and proposes a diff only when you ask it to wire the finished URLs back into the app.

If you have no agent, the same thing exists as a short form. The agent path is faster because the answers are already in your repository — it is not a different product.

The authoritative sources

• Provide information for Google Play’s Data safety section — Google Play Console Help, on SDK data being yours to declare
• App privacy details on the App Store — Apple
• Privacy and security in Firebase — an example of the per-SDK disclosure an agent reads

---