Your code can be clean and the launch can still get sunk.

No Terms of Service. No privacy policy. No way for a user to delete their account. A copyleft package buried in your dependency tree. None of these are bugs, and a security scanner won't see them, but each one can stop a launch cold: an App Store rejection, a regulator's letter, a customer dispute you have no liability cap to defend. LaunchGuard models these as adversaries and tells you which ones you've left an opening for. It is advisory, and it is not legal advice.

What LaunchGuard actually checks

LaunchGuard is a rule pack that reads signals already in your codebase (auth flows, payment SDKs, email senders, analytics, dependencies, AI calls) and asks a short set of intake questions code can't answer on its own. Each rule names the adversary it's protecting you from and cites the source behind it.

Your Lawyer ToS, privacy, liability The Auditor GDPR, CCPA, COPPA Apple account delete, SIWA Google consent, tracking Payments PCI, idempotency IP / Lawyers copyleft, trademark Customers subscriptions, ADA

The adversaries waiting on the other side of launch

Every finding is framed as a specific party who can hurt you. Here are the ones that catch solo founders most often.

1. Your Lawyer: no Terms, no privacy policy, no liability cap

If users can create accounts but there's no Terms of Service in your source, you have no limitation of liability, no acceptable-use clause, no governing law, and no arbitration term. Account creation by itself creates legal exposure. Separately, if you collect personal data (an email field counts) with no privacy policy page, most jurisdictions already require a notice the moment you start collecting. LaunchGuard flags both, citing GDPR Art. 13/14, CCPA notice-at-collection, and the contract-law basics behind a liability cap.

2. The Auditor: erasure, retention, and minors

A regulator doesn't read your marketing. They check whether a user can get their data deleted and exported, whether you keep it longer than you should, and whether children can sign up without parental consent. LaunchGuard maps these to GDPR Art. 17 (erasure), Art. 20 (portability), Art. 5(1)(e) (storage limitation), and COPPA for under-13 audiences. The minors check only fires if you tell it your audience might include children, because the code alone can't know that.

3. Apple: the rejection you can predict

Apple has rejected apps for one missing feature over and over: a user can make an account but can't delete it in-app. That's App Review Guideline 5.1.1(v), and LaunchGuard treats a missing account-deletion path on an app with auth as a Critical. It also catches a mobile app offering social logins without Sign in with Apple (Guideline 4.8), which is another common bounce.

4. The dependency tree: a copyleft license that wants your source code

An AGPL, GPL, or SSPL package pulled into a closed-source product, or offered as a SaaS, can legally obligate you to open-source your application. Most founders have no idea it's in there. LaunchGuard surfaces strong-copyleft dependencies as a Critical so you can swap, license, or rethink before you ship, not after a letter arrives.

The trap

The dangerous findings are the absences. A scanner is great at flagging the bad line you wrote. It can't flag the Terms of Service, the delete-account route, or the privacy policy you never wrote, because there's nothing to point at. LaunchGuard reasons about what's missing given what your app does, which is exactly the gap that gets a launch pulled.

The shape of a real rejection

It usually plays out like this:

# Your app: users sign up with Clerk, you collect their email.
app/(auth)/sign-up/page.tsx        // signup flow ✓
app/account/settings/page.tsx      // profile, password ✓

# What's NOT in the repo:
app/account/delete/...             // no account-deletion route
app/legal/privacy/...              // no privacy policy
app/legal/terms/...                // no Terms of Service

# LaunchGuard, before you submit to the App Store:
#   LG-DELETE-01  Critical  (Apple 5.1.1(v) + GDPR Art. 17)
#   LG-PRIV-01    Critical  (GDPR Art. 13/14, CCPA, Apple 5.1.1)
#   LG-TOS-01     Warning   (limitation of liability missing)

How IOnclad runs LaunchGuard

LaunchGuard is a rule pack inside the local engine. It runs entirely on your machine, and the work is advisory: it points to a likely gap and cites the source, it does not decide your legal position.

Rules fire on signals already in your code: an auth library, a Stripe or PayPal SDK, an email sender, analytics pixels, AI/LLM calls, file uploads, and your dependency licenses.
A handful of intake questions sharpen findings code can't see on its own, like whether an anonymous user can trigger a paid API, whether your audience may include minors, or whether you've formed a business entity.
Each finding carries an adversary (Your Lawyer, Apple, Regulators, Payments, IP) and cited evidence: the specific GDPR article, App Review guideline, CWE, or statute behind it.
Severity is honest. Missing account deletion or a copyleft dependency reads as Critical; a missing Terms or consent banner as a Warning; data-export and entity gaps as Info.
Every rule has a suppress path. If your Terms live on a separate marketing site, or moderation runs through an external service, you mark it handled and it stops nagging.

LaunchGuard finds common gaps and well-known patterns. It is not a compliance certification, not a guarantee, and not a substitute for a lawyer. Treat it as a sharp pre-launch checklist that tells you which conversations to have with counsel.

How to close the gaps

Publish a privacy policy and Terms of Service, link them from signup and the footer, and require acceptance at account creation. A liability cap and governing-law clause live in the Terms.
Ship an in-app account-deletion path from account settings that purges the user's records and revokes their session. This alone clears a frequent Apple rejection.
Add data export and retention rules. Offer a "download my data" action and define how long you keep personal data instead of storing it forever.
Audit your dependency licenses. Replace any AGPL, GPL, or SSPL package with a permissive (MIT, Apache, BSD) alternative, or get a commercial license before launch.
Gate analytics behind consent in the EU and UK, and disclose AI use where your app sends user input to an LLM.
Take the Criticals to a real lawyer. LaunchGuard tells you where the exposure is. Counsel tells you what to do about it for your jurisdiction and model.

Find every secret before someone else does.

Scan your code and full git history in under a minute. Free verdict, no signup, nothing leaves your machine.

Try the Browser Scanner → Download for Windows