I Spent a Week Doing Paperwork for Zero Users: A Compliance Time Audit

Somewhere in week three of building my latest side project, I made a mistake that every American hobbyist developer eventually makes: I read a Hacker News thread about someone getting sued.

It was a frivolous-looking complaint, probably, but it did what it was designed to do. It scared me. And instead of shipping the feature I'd planned that Saturday, I opened a browser tab, typed "do I need an LLC for a side project," and fell down a rabbit hole that ate the next seven days of my life.

Here's the honest accounting.

The Time Audit, Hour by Ugly Hour

I track my lab time in a notebook — old habit — so I have real numbers. Over one week, here's where the compliance rabbit hole took me versus where the code went:

• LLC formation research and filing (my state): 3.5 hours. Comparing DIY filing versus a service like LegalZoom or Stripe Atlas is a part-time job. I ended up filing directly with my state's Secretary of State website for about $100. The fancy services charge four times that for work that takes twenty minutes.
• EIN application with the IRS: 45 minutes. Free, online, surprisingly painless. This was the single best hour of the week.
• Business bank account: 1.5 hours including driving to a branch because the online flow choked on my home address.
• Writing a privacy policy: 4 hours. I read three other apps' policies, plagiarized the structure shamelessly, then rewrote every line so it described what my project actually does. Which, spoiler: is almost nothing. It collects an email and a hashed password.
• Terms of Service: 3 hours. Same drill. My ToS is 1,400 words protecting a tool that, at the time of writing, had zero users and one very patient beta tester (my brother-in-law).
• Cookie banner implementation: 2 hours. For a site with, again, no analytics yet. I installed a banner to comply with laws that currently have no reason to apply to me.
• Researching sales tax nexus, 1099 thresholds, and quarterly estimated taxes: 2.5 hours. Mostly reassuring myself I don't owe anyone anything yet.

Total: roughly 17 hours of paperwork. Total hours of feature code written that week: 4. The compliance tail didn't just wag the dog. It swallowed it whole.

What Actually Mattered Before Launch

The week wasn't wasted — but it was inefficient. If I could replay it, here's the short list I'd actually do, in order:

1. A privacy policy that tells the truth. If you collect any data — even just emails — write a plain-English page saying what you collect, why, and how to delete it. This matters because state laws like California's CCPA and CPRA kick in based on data collection and (eventually) revenue, and because Apple and Google app stores require one anyway.
2. A ToS that limits your liability and sets expectations. This is the classic "as-is, no warranty, we're not responsible" page. For a hobby project, a template you adapt is genuinely fine.
3. A way to be contacted. The CAN-SPAM Act and basic decency both require a real address or contact method. A working email is the floor.
4. An EIN and a separate bank account. Not legally required for a sole-prop hobby, but the moment money touches the project, you'll thank yourself. Mixing side-project revenue into your personal checking account is how tax season becomes a nightmare.

That's it. That's the pre-launch list. Maybe six hours, total.

What Can Absolutely Wait

• The LLC. Unless you're handling other people's money, taking payments at scale, or operating in a genuinely risky space, a sole proprietorship is fine to start. Liability for a free tool with no users is mostly theoretical. Form the LLC when there's revenue or real risk — it takes an afternoon.
• The cookie banner. GDPR applies to EU users; CCPA applies at meaningful scale in California. If you're not running analytics or ads, you likely don't need a banner on day one. I added mine out of anxiety, not law.
• Sales tax registration. Digital services taxability varies wildly by state, but most states only care once you cross revenue thresholds. Don't pre-register for taxes you don't owe.
• Trademark anything. You're not Coca-Cola yet. Neither am I.

The Meta-Lesson for the Lab

The uncomfortable part of this audit isn't the hours — it's what the hours were doing. Compliance work feels productive. It generates artifacts: a filing confirmation, a polished policy page, a green checkmark in the browser tab. Coding generates bugs, failed tests, and the humbling realization that your side project is further from launch than you thought.

Paperwork is procrastination with a notary.

So here's the rule I've written into my lab notebook going forward: no legal work on a project that hasn't shipped anything in 30 days. Build first, incorporate later. The state of Delaware will still be there when your project has users — and honestly, the users are the hard part.