Does GDPR Apply to My Tiny App With Almost No Users?

Short answer: yes, probably. GDPR is not triggered by how big you are or where your company sits. It is triggered by whether you handle the personal data of people who are in the EU or UK. If even one person in Europe signs up to your beta, the rules apply to you, no matter that you are one founder in another country with a handful of users.

Why this catches people out

GDPR has no minimum size and no "hobby project" exemption. What matters is who your users are, not who you are. If you offer your app to people in the EU or UK, or you monitor their behaviour (analytics counts), you are inside its scope. Being based in the US, India, or Australia changes nothing.

The vibe-coded twist is that your AI agent already made you a data collector without saying so. You asked for "let users sign up" and "add analytics," and it wired in an email field, a users table, cookies, and a tracking script. Every one of those is personal data or behaviour monitoring. The agent built exactly what you asked for. It did not mention the legal weight of an email address, because you never asked it to.

How to check if this is you

Answer these honestly:

1. Can anyone in the EU or UK reach your app? If it is on the public internet with no country blocking, yes. That is almost everyone.
2. Do you store anything that identifies a person? Email, name, IP address, user ID tied to a real human, and support messages all count.
3. Do you run analytics or a tracking pixel? Google Analytics, PostHog, Meta Pixel, and similar all process personal data.

If you answered yes to number one plus either two or three, GDPR applies. For a typical beta app, all three are yes.

The fix: what a small app actually has to do

You do not need a compliance department. You need a short, honest list done properly.

1. Publish a privacy policy that says what you collect, why, who you share it with (Supabase, Stripe, OpenAI, your analytics tool), and how someone deletes their data. See do I need a privacy policy for a beta app.
2. Get consent for non-essential cookies and tracking. Analytics and marketing scripts should not fire until the user agrees. Cover this with a real consent banner, not a "by using this site" notice. See do I need a cookie consent banner.
3. Have a lawful basis for each use. For most beta apps this is consent (for marketing and analytics) and contract (to run the service they signed up for). Write it down in the privacy policy.
4. Be able to delete and export a user's data on request. You do not need a fancy dashboard. A documented manual process ("email us and we delete you within 30 days") is fine at this size, as long as you can actually do it.
5. List your processors. Any third party that touches user data on your behalf needs a data processing agreement. See is it legal to send user data to OpenAI.
6. Only collect what you need. Every extra field is extra risk. If you do not use a phone number, do not ask for one.

The trap to avoid

The common wrong move is deciding you are "too small to matter" and doing nothing. Enforcement against tiny apps is rare, but the real cost usually comes another way: a user files a data request you cannot answer, an EU customer or investor asks for your privacy policy and you have none, or a data leak turns a missing basic into a serious problem. The fix here is cheap. The gap is not worth carrying into launch.

The opposite trap is over-engineering: paying for enterprise compliance software before you have ten users. At beta scale, the six steps above, done honestly, are enough.

Where this fits

GDPR readiness is one of the quiet gaps that never shows up in a demo but greets your first EU signup. The free Readiness Report checks your real project for the practical basics: whether you have a privacy policy, whether tracking fires before consent, and where personal data flows. If you would rather have the missing pieces written and wired in for you, that is what the Finishing Pass is for.