用 AI 助理撰寫應用程式的隱私權政策：一段有效的提示詞

AI 助理十秒鐘就能寫出一份隱私權政策。問題在於它是根據什麼寫的。如果你問它「幫我的健身應用程式寫一份隱私權政策」，它手上只有「健身」這個詞，所以它會產出它讀過的所有隱私權政策的平均值：關於你的應用程式根本沒有設定的 Cookie 的條款、為沒有廣告的應用程式寫的廣告識別碼、「在必要期間內」的保留期限，而你實際使用的 SDK 一個都沒有。它讀起來很通順。但它也正是商店審查人員拿來和你的 Data safety 表單及 App Privacy 回答比對的部分，而它就是在這個比對中出問題。

為什麼一句話的提示詞會失敗

• 它會編造。被要求填寫某個章節的模型就會把它填滿。保留期限、法律依據、公司地址——每一項都聽起來合理，每一項都是一句關於你業務、而你從未說過的陳述。
• 該具體的地方它很空泛。最重要的章節是第三方服務清單，而沒有看過你相依套件檔案的模型無法寫出它們的名稱。
• 它會過度申報。列出你沒有蒐集的資料並不「安全」。它和你自己在商店的申報不一致，只是方向相反的同一個問題。
• 它的格式是為聊天視窗設計的。表格、註腳和內嵌 HTML 在回覆中看起來沒問題，貼到別的地方就會壞掉。

提示詞必須讓它做什麼

1. 先讀證據。在你的存放庫中開啟的程式設計代理——Claude Code、Cursor、Codex 之類——可以讀取 build.gradle、Podfile.lock、Info.plist 和 manifest，並列出每個 SDK 和權限以及它們出自哪個檔案。那份清單就是政策的實質內容。對於無法存取檔案的聊天助理，應該告訴它請你貼上那些檔案。
2. 不碰其他任何東西。建置檔案和 manifest 檔案就夠了。它沒有理由開啟 .env 檔案、金鑰庫或原始碼，而提示詞寫明這一點，就讓你少擔心一件事。
3. 只問無法讀到的事。你保留資料多久、有沒有後端、應用程式是否以兒童為對象、你是否與某個在建置中不留痕跡的合作夥伴分享資料。其他都不需要問。
4. 拒絕猜測。在你不知道的地方，它要寫 [confirm: …]，而不是一句話。看得見的缺口可以修正；編造出來的條款則是一份已發布的陳述。
5. 依照它將發布的地方來撰寫。純 Markdown，只在有用的地方放連結——供應商自己的隱私權頁面、你的支援信箱——並附上文字並非法律建議的免責聲明。

提示詞

完整複製。替換最上方方括號中的事實，或者保留它們，讓助理來問你。

You are helping me write the privacy policy for my mobile app. It will be published as a web page on AppFoyer and its URL goes into the "Privacy policy" field of Google Play and App Store Connect, where reviewers compare it with what the app actually does. Accuracy matters more than length.

## About the app

- App name: [app name]
- Developer / company: [developer or company name]
- Support email: [support email]
- Platforms: [Android, iOS or both]
- Store listings: [store listing URLs, or "not listed yet"]
- Where this policy will be published: [your AppFoyer site URL]/privacy
- What the app collects, as I declared it: [what the app collects — e.g. account info, analytics, ads, crash reports, location, purchases, or nothing]
- Account deletion page: [your AppFoyer site URL]/account-deletion (only if the app has user accounts)
- Country whose law applies: [country, if you have one]

## Step 1 — find the facts

If you can read this app's source code, read only its build, manifest and store-metadata files — for example `build.gradle(.kts)`, `gradle/libs.versions.toml`, `AndroidManifest.xml`, `Podfile.lock`, `Package.swift`, `Info.plist`, `PrivacyInfo.xcprivacy`, `pubspec.yaml`, `package.json`, `app.json`. Do not open `.env` files, keystores, credentials or any other secrets, and do not change any file.

From them, list:

- every third-party SDK or service that collects or receives user data (analytics, ads, crash reporting, sign-in, payments, push notifications, backend, AI APIs) and what it receives;
- every permission the app requests and the feature that uses it;
- whether the app sells in-app purchases or subscriptions (StoreKit, Google Play Billing, RevenueCat and the like).

Show me that list with the file each fact came from, point out anything that contradicts what I declared above, and ask me to confirm it.

If you cannot read the code, ask me to paste the dependency files (for example `app/build.gradle` and `Podfile`) or to list the SDKs and permissions myself.

## Step 2 — ask only what you cannot know

Then ask me, in one short numbered list, and wait for my answers:

1. How long each kind of data is kept, and whether there is a backend (where it runs, what it stores).
2. Whether the app is directed at children under 13.
3. Whether any data is shared with or sold to anyone beyond the services above.
4. Whether the app takes any payments, if the files did not settle it.
5. Anything else you could not determine.

Never guess. Where I do not know an answer, write `[confirm: …]` in the text instead of inventing one.

## Step 3 — write the policy

Sections, in this order, leaving out any that do not apply: Data we collect · How we use it · Third-party services · Purchases and subscriptions · Permissions · Data retention and deletion · Children · Your choices and rights · Changes to this policy · Contact.

- Plain language, short sentences. Describe what this app does; no clauses about things it does not do.
- Under Third-party services, name each provider, say what it receives and why, and link its own privacy policy page.
- Do not invent retention periods, legal bases, company addresses or a data protection officer — use `[confirm: …]`.
- Start with `# Privacy Policy`, then the line `_Last updated: [today's date]_`.
- Write these placeholders exactly as shown, never the values — they are filled in from my settings when the page is published: `{{app_name}}`, `{{developer_name}}`, `{{support_email}}`, `{{public_url}}`.
- In the Contact section, write the address as `[{{support_email}}](mailto:{{support_email}})`.
- If the app has user accounts, link account deletion as `[{{public_url}}/account-deletion]({{public_url}}/account-deletion)` in the retention and deletion section.
- Mandatory if the app is on iOS and has any in-app purchase or subscription — declared above, found in the build files or confirmed by me: in the Purchases and subscriptions section, include this sentence unchanged: For the iOS version, Apple's standard [Licensed Application End User License Agreement](https://www.apple.com/legal/internet-services/itunes/dev/stdeula/) applies to your use of the App. Never leave it out when the app takes payments.
- End with this paragraph, unchanged:

  _This page was generated from a template provided by the hosting platform and completed by the app developer. It is not legal advice. The developer named above is solely responsible for its accuracy and for complying with the laws that apply to them._

## Format — this is pasted into a Markdown editor

- Reply with the finished policy only, as Markdown inside one ```markdown code block, with nothing before or after it.
- CommonMark only: headings, paragraphs, lists, bold, italics and links. No tables, no HTML, no images, no footnotes.
- Links only to the providers' own privacy policy pages, to `{{public_url}}`, to Apple's EULA as above and to the support email. Any other link is shown as plain text on the published page, so leave it out. No link shorteners, no download links.

它是為發布在 AppFoyer 上的頁面而寫的，所以它要求使用 {{app_name}} 這類預留位置，並以我們的免責聲明結尾。如果你要發布在其他地方，請刪除 Step 3 中關於預留位置、刪除連結和結尾段落的那幾行，改為要求填入實際的值。

發布它寫的內容之前

助理負責草擬；發布的人是你。請依序檢查：

• 你相依套件檔案中的每個 SDK 都出現在政策中，而且沒有出現任何不在檔案中的東西。這是機械式的測試，實際上也就是審查人員在做的測試。
• 每一個 [confirm: …] 都已替換成真正的答案，或者那句話已被刪除。
• 第三方章節與你的 Data safety 表單和 App Privacy 回答相符。如果它們不一致，就是其中一方錯了——無論是哪一方，都要修正。
• 如果應用程式有收費，Apple 的 EULA 連結必須在。有應用程式內購買或訂閱的 iOS 應用程式，要在隱私權政策中連結 Apple 的標準 Licensed Application End User License Agreement；提示詞有要求它，所以請確認它有保留下來。
• 保留期限是你自己的。只有你知道你的後端保留了什麼、保留多久。
• 任何不尋常的情況都交給律師。健康資料、金融、兒童，或與合作夥伴分享的資料——提示詞改變不了範本無法涵蓋的部分。

AppFoyer 在這裡做什麼

儀表板中的隱私權頁面編輯器有一個 Write it with your own AI（用你自己的 AI 撰寫）面板：同一段提示詞，已經填好你應用程式的名稱、開發者、支援信箱、平台、商店連結和你申報的資料。複製它，在你使用的任何助理中執行，再把回覆貼回面板——Markdown 會從程式碼區塊中取出並放進編輯器，預覽會準確顯示將要發布的內容。在你點擊發布之前，不會有任何內容公開，而且這段文字會和其他任何編輯一樣，通過相同的自動化檢查。

條款頁面也有同樣的面板，搭配它自己的提示詞——刊載於你的應用程式需要服務條款嗎？。如果你使用 Claude Code，AppFoyer 外掛程式會為全部五個頁面完成同樣的工作，不需要複製貼上，而且它同樣無法發布。兩種途徑都不是法律建議，每個頁面也都會這樣註明。

權威來源

• Privacy policy requirements：Google Play 說明
• Provide information for Google Play’s Data safety section：Google Play Console 說明，說明 SDK 資料由你負責申報
• App privacy details on the App Store：Apple