| name | privacy-alignment-check |
| description | Review Aura Historia code changes that touch user data, cookies/storage, auth, consent, analytics, payments, partner/admin data, OAuth, or tokens for privacy-policy alignment. |
Privacy Alignment Check
Use this skill whenever work affects user data or behavior described by the privacy policy.
Required Reading
Read:
docs/privacy-policy-alignment.mdsrc/assets/content/AGENTS.md when privacy/legal markdown may change- the applicable DOX chain for touched code paths
Data Categories to Check
Look for changes involving:
- Account/profile data: email, name, user ID, language, currency, roles, subscriptions.
- Auth/session data: AWS Amplify/Cognito, route guards, server auth, logout/login behavior.
- Cookies/storage:
user-preferences, i18next, localStorage, sessionStorage, consent flags.
- Watchlists, saved searches/search filters, notifications, matching, product interactions.
- Newsletter/marketing and double-opt-in evidence.
- Partner/shop/admin data: contact/address/domain metadata, applications, access tokens, OAuth clients.
- Payment/subscription/Stripe metadata.
- Tracking/analytics, external embeds, processors, logs, or error reporting.
Review Procedure
- Identify exactly what personal data is collected, displayed, stored, sent, logged, or deleted.
- Identify purpose, storage location, processor/API, persistence/retention implications, and whether the user expects it.
- Confirm current privacy policy text covers the behavior in
de, en, es, fr, and it.
- Confirm optional analytics/tracking/non-essential storage remains consent-gated.
- Confirm authenticated/user-specific data is not exposed in cacheable public responses, URLs, logs, or analytics events.
- Confirm secrets and tokens are masked except for deliberate one-time plaintext display.
- If policy/UI text changes are needed, update every locale and related i18n metadata.
- If a new processor, data category, purpose, retention behavior, or transfer is introduced, flag for legal/product review.
Output Expected
When reporting, summarize:
- Data touched.
- Policy sections/locales checked or updated.
- Consent/security/cache considerations.
- Remaining legal/product review questions, if any.
