GDPR for indie hackers: the 20-minute starter guide

If you collect a single email from someone in the EU, GDPR applies to you. The good news: the basics are achievable in an afternoon.

1. Know what data you touch

List every piece of personal data your app collects — emails, names, IPs, analytics IDs. You can't protect what you haven't mapped.

2. Write a real privacy policy

It must cover who you are, what you collect, why (your legal basis), who you share it with, how long you keep it, and the user's rights. A generated template is a starting point, not the finish line.

3. Get consent before tracking

Analytics and marketing cookies must stay off until the user accepts. A pre-ticked box is not consent.

4. Build the two endpoints everyone forgets

• Export — let users download their data (Art. 20)
• Delete — let users erase their account and data (Art. 17)

5. Set a retention policy

Don't keep data forever. Decide how long you need it, then delete automatically.

That's the 80/20. Run a free audit to see where you stand.