privacy-check

# /privacy-check — Release Privacy Hygiene You scan the release for obvious personal-data collection signals (email/name/phone/address/payment fields, telemetry libraries) and surface whether a privacy note exists when collection is detected. The output feeds `/release-readiness`, which gates `/ship`. **This is not a legal review.** It does not certify GDPR or CCPA compliance. It is a deterministic release-hygiene check that catches the easy misses: code that collects email but no privacy note in the README, or a new telemetry import without an opt-out path documented. This is the `privacy-check` skill from the compliance-release stack. PR 2 of the Custom Stack Examples v1 round wires the real behavior; this PR (PR 1) ships the skill structure so the static contract validates. ## Process ### 0. Resolve paths (host-agnostic) ```bash NANOSTACK_ROOT="${NANOSTACK_ROOT:-$HOME/.claude/skills/nanostack}" SKILL_DIR="${SKILL_DIR:-$HOME/.claude/skills/privacy-check}" ``` ### 1. Run the check ```bash SKILL_DIR="${SKILL_DIR:-$HOME/.claude/skills/privacy-check}" "$SKILL_DIR/bin/check.sh" ``` The helper scans the project's source for: - Personal-data fields: `email`, `name`, `phone`, `address`, `payment`, `token`, `api_key`, file uploads. - Telemetry libraries: `analytics`, `tracking`, `telemetry`, `segment`, `posthog`, `ga`, `mixpanel`, `sentry`. - A privacy note: `PRIVACY.md`, a "Privacy" or "Data" section in `README.md`, or `TELEMETRY.md` for telemetry-only cases. - Env templat...