The Fine Print

What your app does that the law cares about, and whether your fine print says so.

A compliance read, not legal advice.

npx -y @bigsteele/the-fine-print@latest            # Step 0 in the current repository
npx -y @bigsteele/the-fine-print@latest --skill    # install the Claude Code skill

What it does

Step 0, the scan (seconds, offline): reads the product's own files and lists

• what the app does: accounts, payments, subscriptions and trials, cancellation, AI calls and chat, AI voice agents, uploads and public buckets, analytics, ad pixels, session recording, chat widgets, video, email, texts and calls, testimonials, income claims, iOS and Android builds, and sensitive data (health, biometrics, location, SSNs, financial);
• who receives personal data: every vendor SDK and host it recognises, with what each one receives;
• the fine print against the code: which data categories and vendors the privacy policy never mentions, and which expected clauses are missing;
• which of the rulebook's rules that behaviour opens, and why, with file and line.

The read (THE-FINE-PRINT.md, a long agent session): grades every rule PASS, FAIL, UNKNOWN or N/A with evidence from the code, read-only probes of the live product, and a re-opened source for the law; writes The Fine Print - <App>.md with a verdict, the ship blockers, a fix for every failure (drafted policy text included), and the questions only the owner can answer.

The gate (--check): validates the grade and the deliverable mechanically. No verdict without every rule graded; no FAIL without a dated source; no "compliant" anywhere.

The rulebook

49 rules in src/rules.ts, US federal, state and app store: privacy notices and rights (CalOPPA, the 20 state privacy laws, account deletion), tracking (GPC and opt-out, CIPA session replay, VPPA), security of personal data, subscriptions (ROSCA, California's auto-renewal law), reviews and claims (FTC Part 465, endorsements, earnings, AI and compliance claims), AI (companion chatbot laws, bot disclosure, automated decisions), email, texts and calls (CAN-SPAM, TCPA, AI voices, recording consent), children and age (COPPA, app store age laws), sensitive data (health, biometrics), accessibility (ADA, Unruh, overlays), app stores (Apple and Google), terms (clickwrap) and regulated industries (credit repair, the Safeguards Rule).

Every source carries the month it was last checked. The scan flags any rule whose newest check is older than six months, and the read re-opens a source before recording any FAIL. When the law changes, update the rule and its checked month.

Use

npx -y @bigsteele/the-fine-print@latest [dir]               # Step 0: the scan, plus THE-FINE-PRINT.md
npx -y @bigsteele/the-fine-print@latest --check             # the gate, on a finished read
npx -y @bigsteele/the-fine-print@latest --ignore vendor-dir # skip code that is not the product
npx -y @bigsteele/the-fine-print@latest --skill             # install the Claude Code skill

Then open Claude Code in the repository and have it follow THE-FINE-PRINT.md, or just ask it to "run the fine print" once the skill is installed. Paths listed in .fineprintignore (one per line) are skipped, for vendored engines and reference copies.

Not covered: EU, UK and other non-US law; tax; industry licensing beyond credit repair.