Your privacy policy gives no way to contact you

Why it matters

The privacy policy at the published policy URL contains no email address, no mailto: link, and no link to a contact page, so a reader who wants to ask what you hold about them — or ask you to delete it — has nowhere to send that request. Naming who is responsible for the data and how to reach them is one of the few things privacy law is specific about (GDPR Article 13(1)(a)–(b) requires the controller's identity and contact details in the notice itself), and it is a routine omission in a generated policy nobody finished. Add a dedicated address — privacy@ your domain is the convention — or link the policy to your contact page. If the address is inserted by client-side code, a passive scan cannot see it; put it in the page's own HTML so people and automated checks both find it.

How ShipReady detects it

What the published privacy policy says, against what the site actually does. SITE-scoped because that is the only scope that can hold two pages at once: the policy is on /privacy and the trackers are on the homepage. Costs no extra requests — every page it reads was already fetched by the crawl. Silent unless a privacy policy page was actually crawled AND that page returned enough text to be a document rather than an app shell. Both gates matter: "your policy does not mention Hotjar" is a serious thing to say to someone, and saying it because the crawler never fetched their policy — or fetched a client-rendered shell of it — would be indefensible.

Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.0.0.

How to fix it

This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.

Your privacy policy has no email address, no mailto: link, and no link to a contact page, so nobody can act on it — a visitor who wants to know what you hold about them, or wants it deleted, has nowhere to write. Add a contact route directly in the policy text: privacy@yourdomain.com is the convention, and it should reach a mailbox somebody reads. Include the legal entity name and a postal address alongside it if you have one, since GDPR Article 13(1)(a)-(b) asks for the controller's identity as well as contact details. Make sure the address is present in the page's own HTML rather than inserted by client-side JavaScript, so it is visible to people using assistive technology and to automated checks. Finally, confirm the mailbox actually receives mail — publishing an address at a domain with no MX record means requests bounce and you never learn they were made.

Frequently asked questions

What does "Your privacy policy gives no way to contact you" mean?

The privacy policy at the published policy URL contains no email address, no mailto: link, and no link to a contact page, so a reader who wants to ask what you hold about them — or ask you to delete it — has nowhere to send that request.

How serious is it?

ShipReady rates this low. Worth fixing. Small individually, and they accumulate.

How do I fix it?

Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.

Can I check my own site?

Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.

Related checks

• Your privacy policy does not appear to name a service the site useslow
• A device-fingerprinting script is presentmedium
• A form collecting personal data submits via GETmedium
• No privacy policy link foundmedium
• Session-replay or behaviour-recording script is presentmedium
• Tracking cookie is set before the consent banner can be answeredmedium