I do not want my app to get sued

I do not want my app to get sued. Please review this site end-to-end
and address the following, explaining each change as you make it:

LEGAL PAGES
- Add a Terms and Conditions page
- Add a Privacy Policy page
- Add a Refund Policy page if the site sells anything
- Add clear business details (legal name, address, contact) somewhere on the site

COOKIES & CONSENT
- Check whether this site needs cookie consent based on what it tracks
- Add a Cookie Policy page
- Add a cookie consent banner if required
- Add consent checkboxes on every form that collects personal data

ACCESSIBILITY & TRUST
- Check color contrast across the site against WCAG AA
- Check basic accessibility: alt text on images, labelled form fields, keyboard navigation
- Replace vague button/link labels ("click here", "submit") with clear, specific ones

CLAIMS & CONTENT
- Remove or flag any fake or placeholder testimonials/reviews
- Remove or flag any claims that aren't backed up ("#1", "guaranteed", "clinically proven", etc.)
- Check that every image has a license or attribution I actually have rights to

DATA & TRACKING
- List every third-party embed and script on the site (analytics, chat widgets, ad pixels, fonts)
- Check that analytics/tracking tools are disclosed in the privacy policy
- Flag which local laws likely apply based on where visitors come from (GDPR, CCPA, etc.)

Go section by section, explain what you changed and why, and flag anything you're not
fully confident fixing automatically so I can review it with a lawyer if needed.

Why each section actually matters

• Legal pages: no Terms or Privacy Policy means you have nothing to enforce and no defense if a user disputes how their data was used. Most ad networks and payment processors won't even approve a site without one.
• Cookies & consent: tracking without consent is a GDPR/ePrivacy violation in the EU, and enforcement elsewhere is catching up fast. The fines aren't hypothetical anymore.
• Accessibility & trust: accessibility complaints against small business websites have risen sharply in recent years, and poor contrast or unlabeled buttons are the easiest violations to spot
• Claims & content: fake reviews and unsupported claims are directly regulated by the FTC in the US. A testimonial widget showing reviews nobody actually left is a real liability, not a gray area.
• Data & tracking: undisclosed third-party trackers are one of the most common reasons a privacy policy gets flagged as non-compliant, even when the page itself reads fine

How to actually run it

1. New branch, not main. Same as any AI-driven pass. Review before it lands.
2. One site at a time. If you run several small sites, don't batch them. The applicable laws and claims differ per site.
3. Read every page it touches. A generated Privacy Policy is a draft, not a filed legal document. Have an actual lawyer look at it before you rely on it.
4. Re-run it whenever you add a form, a tracker, or a claim. Each one is a new gap.

Go deeper: follow-up prompts

Send these one at a time, after the first pass lands.

Write the cookie consent banner copy in plain English, not legal jargon.

List every third-party script this site loads and what data each one collects.

Pretend you're a regulator doing a spot check. What's the first thing you'd flag?

One honest caveat. This closes the obvious, checkbox-level gaps that most vibecoded sites skip entirely. It is not a substitute for an actual lawyer, especially once you're processing payments, health data, or have visitors in multiple jurisdictions. Treat it as your first pass, not your legal sign-off.