Why I Didn't Write the Privacy Policy Today

Today I had a small, tidy task queued up, and I decided not to do it.

Duskglow's settings screen shows two links, Privacy Policy and Terms of Service. Right now both of them go nowhere. They were always meant to point at real pages, the pages just don't exist yet, so a tester who taps either one lands on a dead route. The obvious move was to sit down, write the two pages, and wire them up. I had even drafted most of the analysis to do it well.

I didn't write them. I hid the links instead and pushed the writing to later. Here's the reasoning, because the sequencing is something a lot of solo builders get backwards, myself included on most days.

A privacy policy is a set of claims you can be held to

A privacy policy reads like boilerplate, but every sentence in it is a factual claim about what your system does with people's data. A regulator can hold you to it. So can a user.

So the real question was never "do I have a privacy page." It was "are the claims on that page true right now." And for Duskglow, some of the claims I'd most want to make aren't true yet. I'm building toward stronger privacy guarantees, and that work isn't finished. If I write the page today, I either describe the current state, which is weaker than where the product is going, or I describe where it's going, which isn't live yet. The first version gets rewritten the moment the architecture lands. The second version is fiction with my name on it.

Neither of those is a page worth shipping. A privacy policy should come after the architecture that makes it true. Writing it early felt like diligence, and it was really just generating a document I'd have to retract.

Match the artifact to the actual exposure

There's a second layer here, and it's about being honest with myself on risk.

Duskglow is in closed beta. The user base is two friends, and neither is actively using it this week. Sign-up is gated to an allowlist, so nobody from the public can create an account. The laws I care most about for an AI companion app are the safety ones, recurring AI disclosure and crisis handling, and those are already in place. What a published privacy and terms page actually unlocks is public sign-up, and I'm nowhere near opening that door.

I caught myself wanting to write the pages anyway. And when I looked at why, the honest answer was that it would make me feel responsible, not that it would protect anyone. That's a pattern I've named in my own work before, where setup and paperwork masquerade as progress while really being a way to look busy on the safe part of the problem. The twist this time is that the disciplined move was restraint. Not doing the obvious-looking task.

Sizing the work to the real exposure matters because the alternative quietly trains you to do compliance theater. A policy nobody can read yet, for users who can't sign up yet, describing protections that aren't live yet. It looks like rigor and it's really just motion.

The cheap fix is not the deferred deliverable

One thing did genuinely need fixing today. A user shouldn't tap Privacy Policy and land on a broken route, beta or not.

But fixing the links and writing the pages are two different jobs, and I'd been treating them as one. So I split them. Hiding the two links until the real pages exist took about ten minutes. The pages themselves now have a clear trigger. I write them once the encryption work is done and the privacy claims finally stop moving, and I write them once instead of twice.

Decoupling the small trust fix from the large deferred deliverable is the part I almost missed. When a tiny visible problem is bolted onto a big unfinished one, the instinct is to do the big one just to clear the small one. There's usually a ten-minute version that handles what the user sees and buys you the room to do the rest properly.

Mental models

Disclosure is downstream of architecture. A privacy policy is a promise about how your system behaves. Write it after the behavior is real, or you are committing to claims you will have to walk back.

Size the compliance work to the actual stage. A closed beta of allowlisted friends is not a public launch. Match the artifact to who is genuinely exposed, and watch for the moment when "being responsible" is really just generating reassuring paperwork.

Find the ten-minute version. When a small visible problem is attached to a big unfinished one, look for the cheap fix that handles the visible part and protects your ability to do the rest properly later.

None of this means the pages don't matter. They matter enough that I want to write them when they are true, for users who can actually read them, describing a product that does what the page says. That day is coming. It wasn't today.