App launch fine traps: KVKK, GDPR, Supabase RLS

Your app can get fined before its first sale: the audit prompt

How to use it: open Claude Code (or Cursor) in your project folder and paste the prompt below. It only reports at first and changes nothing; it fixes things after you approve.

Before this project goes live, run a privacy and security audit. Don't change any files yet; report what you find.

1. Supabase / database: is RLS enabled on every table in an exposed (public) schema? List tables with RLS off or with no policies. Is a service_role key or any other secret in frontend code?
2. Forms: does every form that collects personal data (signup, newsletter, contact) link to a privacy policy? Is marketing consent a separate, unticked checkbox?
3. Email: is there code that sends marketing emails? Does it only go to people who opted in, is consent stored with a date, and does every email have an unsubscribe link and a postal address?
4. Payments and subscriptions: does checkout clearly show the price, the renewal date and how to cancel before the user pays?
5. Data breaches: are errors and access logged? If there's no plan for who does what to report a breach within 72 hours, draft docs/data-breach.md.
6. Third parties: are Google Fonts, analytics or tracking scripts loaded straight from third-party servers in the visitor's browser? Suggest self-hosting the fonts.

End with a table: item · status (ok / missing / risk) · file and line · suggested fix. No legal opinions, technical findings only.

The four traps

• No privacy policy at signup: GDPR Art. 13 requires one; this tier of fines goes up to €20M or 4% of worldwide turnover (Art. 83(5)).
• Marketing emails without an unsubscribe link or your postal address: up to $53,088 per email in the US (CAN-SPAM; the FTC kept 2025 amounts for 2026).
• Google Fonts loaded from Google's servers sends the visitor's IP address to Google. In 2022 a Munich court ordered a site owner to pay a visitor €100 over it (LG München I, 3 O 17493/20). Self-hosting the fonts removes the issue.
• Supabase with RLS off: Supabase's docs say a table in an exposed schema without RLS is readable and writable by any role with a grant on it, which includes the key in your frontend. Security failures fall under fines up to €10M or 2% (Art. 32, 83(4)), and a breach must be reported within 72 hours (Art. 33).

Why it applies to you GDPR covers developers outside the EU who offer goods or services to people in the EU, whether or not they pay (Art. 3(2)).

Sources

• GDPR full text: https://eur-lex.europa.eu/eli/reg/2016/679/oj
• FTC CAN-SPAM guide: https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business
• Supabase RLS: https://supabase.com/docs/guides/database/postgres/row-level-security

These are maximums; regulators scale fines to the case, and rules differ by country (checked Oct 30, 2026). Not legal advice; talk to a lawyer where you're unsure.