Fine Print

Privacy policies are written by lawyers and code by engineers, and nobody checks one against the other. Twitter paid $150M because phone numbers collected "for account security" were used for ads. GoodRx, BetterHelp and Meta paid for the same kind of gap. Before a release, a privacy review is a questionnaire and a meeting; nobody runs the code against the promises. Fine Print runs inside IBM Bob. In the Fine Print Auditor mode, Bob reads the policy PDF and extracts every testable promise with its section. It spawns parallel subagents, one per promise; each traces the data through the code and writes an executable proof. Verdicts only ever come from running those proofs. A canary user drives every journey. Every outbound request is captured and never sent, and hashed values still count, so SHA-256 of a phone number is caught. After account deletion, every database, index and log is scanned, including raw SQLite bytes. The result is a ledger: the policy fact-checked sentence by sentence, each broken promise pointing to the line of code responsible. The Fine Print Engineer mode then fixes the code, but it cannot touch the proofs: mode edit rules and a Bob hook freeze them after the audit. A git hook, CI and a Bob hook refuse any later commit that breaks a promise, quoting the sentence. On Tidewell, a demo app that repeats those real-world mistakes, Bob found the 5 broken promises and fixed all of them. The verdicts match a hidden answer key 9/9 before and after the fix. All 4 kept proofs fail when their promise is deliberately broken, and no proof was edited by the fix. Target users: engineering and privacy teams shipping code that handles personal data. They copy the .bob mode pack into their repo, ask Bob to fact-check their policy, and install the guard. There is no account and no hosted service; everything runs in their own repo. Live demo and measurements: https://fineprint.larinova.com