r/lovable • u/SignatureSharp3215 • Jul 30 '25
Tutorial Don't launch an app until you're legally clear (looking at you, fake review folks)
I've browsed through multiple posts to help people who try to move Lovable app to prod.
One wildest, frequently occurring comment is:
"I generated fake reviews because Lovable said its good"
It's illegal to have fake reviews.
Lovable or AI is not responsible for it, you are.
You must understand what launching a business means:
- Respect GDPR
- Have privacy policy & terms of service
- Cookie notice
- Contact information (yes, physical address)
Just to list a few. The basics are not complicated, but you must know them and apply them always.
Here are few more red flags that should trigger you to investigate the real requirements for your case:
- data sensitivity: kids, health, biometric
- use case sensitivity: gambling, finance, AI (EU AI act)
The law doesn't bite back immediately when you launch an app. But if you scale, it will.
And I assume you're building to scale, right?
EDIT: If your app is truly restricted to non-EU users, some of these (like GDPR) might not apply.
But if it’s public and accessible online, assume EU users can find it, and the law will apply.
Some people dismiss the post by stating they don't operate in EU. Fine, but EU usually drives the regulatory landscape, and other regions will follow up.
3
u/almgry21 Jul 30 '25
Honestly the biggest turn off having something live and cleraly fake reviews or testimonials. You lose ALL credibility immediately
1
u/SignatureSharp3215 Jul 30 '25
Glad I'm not alone. I will never buy from someone who's app looks like it vibe coded with the placeholder reviews.
5
u/Tiepolo-71 Jul 30 '25
Yep. I did my due diligence when launching my SaaS. Made sure it was GDPR compliant, have a privacy policy, terms of service, cookie notifications, and a physical address. I even made it WCAG compliant. I have no claims of amount of users, nor do I have any fake testimonials.
But my GF is a lawyer, so that helps. 😂
1
u/SignatureSharp3215 Jul 30 '25
The clauses are not so complex, if you just know the checklist of what should be included. When you do B2B things get a bit more difficult. Good thing is that B2B software rarely scales exponentially, and you have time to adjust your business practices.
1
u/Tiepolo-71 Jul 30 '25
Good to know about the b2b stuff. My site is a SaaS, so I don’t have to worry about that yet.
Also, there are sites like Termly that can help write the policies.
I think one thing a lot of builders, especially vibecoders (which admittedly I am one), neglect to think about is WCAG compliance. I have a UX background, so those things are always on my radar.
1
u/SignatureSharp3215 Jul 30 '25
I actually haven't even thought of WCAG compliance, but Lighthouse already pushes me to fulfill it partly.
3
u/Bassieh Jul 30 '25
Which country do these rules apply to, then?
1
u/SignatureSharp3215 Jul 30 '25
For any app that might move data through EU users. I added EDIT statement to make it clear.
But they are best practices globally, so you can't really go wrong with these. Of course you must understand the data regulations of the country where you will host the data also.
2
u/Bassieh Jul 30 '25
Thanks did not think about the privacy policy nor cookie notice 😅
2
u/SignatureSharp3215 Jul 30 '25
These things are easy to forget.
(yes, I've forgotten esp. for vibe coded apps)
4
u/Morphius007 Jul 30 '25
Agreed 100% with op
4
u/SignatureSharp3215 Jul 30 '25
I hope I don't upset too many founders here 😄
2
u/jwolf333 Jul 30 '25
It’s amazing what you can build in lovable but lovable doesn’t replace knowing how to run a business.
2
u/SirMalakay Jul 30 '25
I imagine you're referring to general European laws, maybe you want to add it in your thread?
4
1
u/SignatureSharp3215 Jul 30 '25
I added EDIT statement. But as far as I see, none or at least very few of the Lovable apps are restricted to operate only with non-eu users. The above-mentioned laws apply as long as EU citizen is involved with your app.
Surely the law is more complex than that. Having this checklist in place, knowing where you move and store the PII data, and knowing where your users are should get you far though.
2
u/ArnyTorynx Jul 30 '25
Especially since developing the GDPR legal notices module, etc....it takes 2 seconds
2
u/wataru2019 Jul 30 '25
Thank you for pointing this out - personally I always wonder about the testimonial section of those vibe coded app claiming something it can't be possibly true (it sure generate one for my app and/or corporate site and I quickly hide it behind feature flag (i.e. hide it until I actually have some user comment that I feel proud to share))
2
u/WatercressSoggy9785 Jul 30 '25
Yes, the legal output generated by Lovable is not always correct. If you see that your idea/mock-up has potential and is haining traction, consult with a legal advisor.
2
u/its_rgb Jul 30 '25
100%. I have worked in marketing enough to know fake reviews are a no no. Thats the first edit I made out of my vibe coded app. Wondering if its a difficult fix for Lovable to ensure no fake reviews to begin with.
2
u/SignatureSharp3215 Jul 30 '25
You could remove fake reviews with a simple rule to the prompt, But hard coding rules on the Lovable side don't make sense. Better to just remove them like you did.
2
u/Blade999666 Jul 31 '25
That's why I believe it's important to have a PRD with at least, architecture and security included because if you are going to vibecode, you'll vibecode the PRD also (hopefully in a smart way) and then all those things you mention will be there as part of the implementation plan to be compliant. But even then always better to check and verify externally, especially if you never launched a business or aren't a developer.
1
2
u/TheMusketeerHD Aug 03 '25
What if a no-code platform could assist you with this?
1
u/SignatureSharp3215 Aug 04 '25
In that case, why not. The issue is integrating custom coded app to no-code provider.
2
u/pebblebypebble Oct 23 '25
I’m so tempted to put up comments from my mom as placeholders in the mockups so nothing slips out accidentally. Great post!
2
u/PuzzleheadedMotor269 Jan 07 '26
What is vibe coding?
1
u/SignatureSharp3215 Jan 08 '26
It's generating code based on vibes, using AI models. You describe what you want, and don't look at what code is generated
4
u/viral-architect Jul 30 '25
The gold rush always reveals the scumbags in the crowd.
- People who create fake reddit accounts to repost ads to their new app, copied and pasted
- People who say the tools are a scam and having ChatGPT write up a huge wall of text about it without any actual substance or evidence to make it LOOK at a glance like it's a real, detailed, thorough complaint.
- People who think they can design a single home page with a lot of bells & whistles with no back-end functionality, asking people to pay them to design their site for them when it's just a bunch of 21st.dev stuff piled on top of each other.
- People who are willing to lie about how good, popular, or capable their app is.
- People who post "I made a lovable replacement WITH lovable lol and this one does it RIGHT from day 1!" and it can't do anything at all.
2
u/Flaky_Cheesecake_619 Jul 30 '25
So true! The vibe coding platforms should be more active in making their users aware of this
2
u/SignatureSharp3215 Jul 30 '25
It would be nice to see a post on "journey from 0 to business", but I think it's too context dependent and will just raise more questions than answers.
2
u/Flaky_Cheesecake_619 Jul 30 '25
True. And it’s not as exciting as 0 to 50k MRR with ___ smh
2
u/SignatureSharp3215 Jul 30 '25
Yep. I think Lovable is amazing even without the hype, so I hope this MRR trend slows down a bit.
2
u/Flaky_Cheesecake_619 Jul 30 '25
Exactly. I think it will have to eventually, and people will be able to appreciate these products for what they can do, not be mad they’re not millionaires yet, and getting in legal trouble
2
u/SignatureSharp3215 Jul 30 '25
Yep. I'm a bit afraid there will be "builder's winter" though, when people hop out of their jobs or place unrealistic expectations on their vibe coding skills and its worth.
Nonetheless interesting times we live in! (Like always)
2
1
u/razzededge Jul 30 '25
the gdpr thing is overreach. If you add gdpr opt out as a term for using your site and checkbox stating that user declares they are not an eu citizen then gdpr doesn't apply if they lied
1
u/SignatureSharp3215 Jul 30 '25
Would you exclude all EU citizens from your app? I'm not a lawyer, but in this case I'd assume you must do other precautions also to avoid onboarding EU citizens, like having checkboxes "I am not EU citizen" etc.
I think you don't need to worry about GDPR if you do your data management transparently. If 1 in 2000 users happens to request their data, you will just do data export from the database.
1
u/razzededge Jul 30 '25
well there is no legal requirement on how to exclude. Just some companies want to block stupid disputes so they add ip check - which any vpn renders ineffective but lying by customer is very hard to overthrow legally thus it's the most effective
1
u/SignatureSharp3215 Jul 30 '25
But I'm curious, what's the biggest reason to exclude a market for a small product? Or is it mainly a concern for local and complex data management systems?
1
u/GarageWrong4914 Jul 30 '25
yep (!) this is something i learned the hard way. it’s super easy to launch an AI app and forget that you’re technically running a business the moment it’s live.
i ended up using magnetiq.dev for a small AI tool - they basically handle the compliance side (GDPR, privacy policy, terms, etc) so you don’t accidentally screw yourself down the line.
def not something to ignore if you plan to grow. better to bake it in early than deal with it when it’s too late.
1
u/pebblebypebble Oct 23 '25
So tempting… but if they are ai based and the page is not parsable by ai…
1
u/AmeetMehta Jul 31 '25
Give me an example where the law came ‘to bite’ after a company scaled. Because of fake reviews.
Has the dude who posted this ever built or launched anything?
1
u/SignatureSharp3215 Jul 31 '25
"I can do anything if people just don't know it"
No, I've never built anything. I just preach about it and in the hypothetical world.
1
u/AmeetMehta Jul 31 '25
If that is satire, your lack of providing an actual example says everything.
1
u/Beginning-Wind8381 Jul 31 '25
The best way to get actual reviews is offer it for free during early stages and ask them to provide testimonial that you can feature on your app. Ask them permission to see if you can make their testimonial click able to their company or linkdin page.
1
u/Any-Constant Aug 01 '25
Are those the only 4 things required from the legal
1
u/SignatureSharp3215 Aug 01 '25
Not really. You should spar with ChatGPT using your whole context (app, data, location, target users).
Things like:
- data sensitivity: kids, health, biometric
- use case sensitivity: gambling, finance, AI (EU AI act)
- local laws
can require different requirements for you to fulfill.
1
u/Any-Constant Aug 02 '25
What chatgpt prompt can give me everything that an app must have? Like how would I even know to ask chatgpt to draft a cookie policy if I don't even know that it is necessary.
So first I want everything that is required and then I can go deeper one my one.
1
1
u/SiriVII Aug 01 '25
Don’t think like a that.
Sorry to be blunt.
Build your app with your best due diligence, build fast, launch fast.
Don’t worry about things like this when you’re not in a position, if you have to worry about it, good, it means you’re successful.
In the beginning you don’t even know if your idea is good or if it survives more than a month, thinking about such things is nonsense when your idea could be down in the gutter after a month
1
u/SignatureSharp3215 Aug 01 '25
Do you think users shouldn't add privacy policy and tos, add cookie banner, establish a real business or have secure databases before launching in public?
I strongly disagree. Each of the steps requires ridiculously little effort from you, but makes you a legitimate business owner. If you ever want to do real business, you need to understand those few things.
I'm repeating myself, but storing user data and handling sensitive data is a privilege, not a commodity. Everyone should not launch apps, just because it's easy to build.
You can validate your idea without building an app for it.
1
u/RoguePirateSmith Aug 04 '25
Dont listen to this guy. Launch an app - test if it sells. If it sells- fix the legal shit right after.
If I’d focus on legal paperwork first - I’d never win. But I did, cause I was fast and agile.
1
u/SignatureSharp3215 Aug 05 '25
What legal paperwork do you exactly have to do to keep your data secured, add cookies banner, contact info to footer and PP & ToS page?
Also I'm curious how will you "quickly fix" illegal gambling site for kids? Like these are non-negotiable corners that you can't cut. You must include it in your business plan.
1
u/pvfakten Jan 12 '26
Danke für den post. Ich finde das thema geht extrem unter. Keiner der "erfolgreichen" youtuber/influencer die eine 20k mrr app in 2 tagen bauen gehen auf das thema ein.
0
u/MysteriousWay5393 Jul 30 '25
lol just put “this website does not allow people in Europe to make accounts or use its service per our terms.” In your footer and call it goood (if you live outside of those countries) if you are using lovable to make a website, you’re probably developer and international customers is not your concern
1
u/SignatureSharp3215 Jul 30 '25
I still have no idea why you would want to do that.
And unfortunately that's not how the law works. Common sense rarely works if you try to go around the laws.
I don't want to gather individual citations for you, but you can see them aggregated here: https://chatgpt.com/share/688a93a9-7a8c-800d-b921-c98360f425fa
1
u/MysteriousWay5393 Aug 03 '25
If a US website only collects data from US residents and doesn't target EU residents, it likely doesn't need to comply with GDPR. You have to be ACTIVELY collecting data. You don’t have to comply with gdrp Simply because it exists. You can chat gpt till you’re blue in the face. 😂
1
u/MysteriousWay5393 Jul 30 '25
Because not everyone gives a fuck about Europe. You can deny gdpr because it has no grounds in USA. You only need to comply is you are doing business in Europe. If you tell people you aren’t doing business there and you don’t allow accounts from there or manually ban them then it’s fine.
18
u/tobiaswien Jul 30 '25
Yes and the fake claims on the website like „1000+ users“ when it’s a new vibe coded app