Create privacy policy ch en
agent skill library for ai agents using skills
npx -y skills add roebi/agent-skills --skill create-privacy-policy-ch-enAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Creates a Swiss-law-compliant Datenschutzerklärung (Privacy Policy) for websites operated from Switzerland or targeting Swiss users. Guides the user through an interactive data-inventory phase covering all processing activities (hosting, fonts, analytics, contact forms, cookies, external embeds, etc.), then generates a ready-to-publish Privacy Policy in German and/or English. Covers obligations under nDSG (in force 01.09.2023), DSG Art. 19, and where relevant DSGVO (for EU visitors). Activate for phrases like: "create a privacy policy", "Datenschutzerklärung erstellen", "I need a privacy policy for my Swiss website", "nDSG privacy policy", "DSGVO Datenschutz", or "create privacy policy switzerland".
The file declares its own license as CC BY-NC-SA 4.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
7.5 KB, as published. Nobody here has run it
Create Privacy Policy CH
Generates a Swiss-law-compliant Datenschutzerklärung for a website, following the revised nDSG (in force since 01.09.2023) and, where the site targets EU visitors, the DSGVO (GDPR).
Disclaimer: This skill produces a best-effort legal text based on your inputs. It is not a substitute for advice from a Swiss lawyer. For commercial operations or sites processing sensitive data, review with a legal professional.
Swiss legal basis (quick reference)
| Law | Relevance |
|---|---|
| nDSG Art. 19 | Duty to inform data subjects at time of collection |
| nDSG Art. 5 lit. j | Definition of data controller (Verantwortlicher) |
| DSGVO Art. 13/14 | Applies if site targets EU residents — stricter than nDSG |
| DSG Art. 12 | Prohibition of unlawful data processing |
Phase 1 — Operator identity
Ask the user:
"Do you already have an Impressum for this website created with
create-impressum-ch-en? If yes, I can reuse the identity data directly."
If yes → import: name-full / company-name, address, email, website-url
If no → collect same fields as Group B of create-impressum-ch-en
Phase 2 — Data processing inventory
Ask each group separately. Wait for answers before proceeding.
Group A — Hosting & infrastructure
"Where is your website hosted?" Examples: GitHub Pages, Netlify, Vercel, Hostpoint, AWS, own server
Store as hosting-provider and hosting-location (country/region if known).
GitHub Pages note: hosted on GitHub (Microsoft) servers, primarily USA. Netlify note: USA. Vercel note: USA. Swiss hosters: Hostpoint, Cyon = CH.
Group B — Web fonts
"Does your website load fonts from an external CDN?" Examples: Google Fonts, Adobe Fonts, Bunny Fonts, or self-hosted
Google Fonts loaded via <link> tag (standard):
- Transfers visitor IP address to Google servers (USA) on every page load
- Google privacy policy: https://policies.google.com/privacy
- Basis: legitimate interest (Art. 6 DSGVO) / nDSG Art. 19
- Mitigation option: self-host fonts (no external request)
Store as fonts-provider: google-fonts | adobe-fonts | bunny-fonts |
self-hosted | none
Group C — Analytics & tracking
"Does your website use any analytics or tracking tools?" Examples: Google Analytics, Plausible, Fathom, Matomo, none
| Tool | Data sent to | Cookies | Privacy-friendly |
|---|---|---|---|
| Google Analytics | Google (USA) | yes | no |
| Plausible | EU servers | no | yes |
| Fathom | EU/CA | no | yes |
| Matomo (self-hosted) | own server | optional | yes |
| None | — | — | ✓ |
Store as analytics-tool and analytics-cookies: yes | no | none
Group D — Contact & forms
"How can visitors contact you? Does the site have any forms?" Examples: email link only, contact form, newsletter signup
| Type | Data collected | Storage |
|---|---|---|
| Email link (mailto:) | none by the site | n/a |
| Contact form | name, email, message | server/email |
| Newsletter | email address | mailing list provider |
Store as contact-method: email-only | contact-form | newsletter | none
If form/newsletter: store form-provider (e.g. Formspree, Netlify Forms, Mailchimp)
Group E — External embeds & third-party services
"Does your website embed or link to any external services that load resources from third-party servers?" Examples: YouTube videos, Vimeo, Google Maps, Claude / AI links, social media buttons, GitHub badges, CDN scripts
Each embed that loads external resources must be disclosed. Claude.ai links (claude.ai/new?q=...) are regular hyperlinks — no data transfer from your server, user clicks voluntarily → no disclosure needed. cdnjs.cloudflare.com scripts → disclose Cloudflare CDN.
Store as embeds[]: list of services
Group F — Cookies
"Does your website set any cookies?"
Purely informational static sites with no analytics and no forms typically set zero cookies. Confirm:
- No analytics → no tracking cookies
- No login → no session cookies
- No consent tool → no consent cookies
Store as uses-cookies: yes | no
If yes: list name, purpose, duration, provider for each cookie.
Group G — EU visitors
"Does your website intentionally target visitors in the EU (e.g. German, French, Italian, Austrian audience)?"
If yes → DSGVO Art. 13 disclosure obligations apply in addition to nDSG. The generated policy will include DSGVO-compatible language.
Store as targets-eu: yes | no | unsure (treat as yes if unsure)
Group H — Language preference
"Should the Privacy Policy be in German only, English only, or both languages?"
Store as output-language: de | en | both
Phase 3 — Generate Privacy Policy
Using collected data, generate the policy using the templates in
references/template-de.md and/or references/template-en.md.
Generation rules
- Include only sections relevant to the actual processing activities found.
- Do not include boilerplate sections for tools/services the site does not use.
- Mark any missing data with
[bitte ergänzen]/[please add]. - For Google Fonts: always mention IP transfer to Google USA and link to Google Privacy Policy.
- For GitHub Pages hosting: mention Microsoft/GitHub as processor, USA transfer.
- If
uses-cookies= no: include a short "No cookies" statement — users appreciate explicit confirmation. - If
targets-eu= yes: add DSGVO Art. 13 rights block (access, erasure, portability, objection, supervisory authority).
Phase 4 — Deliver and advise
- Present the generated Privacy Policy.
- List any
[bitte ergänzen]fields as a checklist. - Remind the user:
"Place this at
/datenschutzor/privacyreachable within one click from every page. Link it from your footer next to the Impressum." - Mitigation tip for Google Fonts:
"To avoid disclosing Google Fonts IP transfers entirely, self-host your fonts. Download from https://google-webfonts-helper.herokuapp.com and serve from your own domain. Then remove the Google Fonts
<link>tag."
Reference files
references/template-de.md— German Datenschutzerklärung templatereferences/template-en.md— English Privacy Policy templatereferences/processing-activities.md— Standard descriptions for common processing activities (hosting, fonts, analytics, forms)references/rights-blocks.md— nDSG and DSGVO data subject rights blocks