Almost every small site publishes a terms of service and a privacy policy together, links them from the same footer, and updates neither until something forces it. They are not two halves of one document. One is a contract that only works if somebody agreed to it; the other is a factual statement that is true or false whether anybody reads it, and which one you are writing changes how you write it.
Different instruments, different failure modes
The terms fail when nobody accepted them, when they describe a service you no longer run, or when a clause overreaches and gets read down. The privacy policy fails when it stops matching what your tools actually do: a new analytics script, a mailing tool nobody canceled, a support desk that now stores attachments in a different country. One document is falsified by a missing checkbox, the other by a tag manager change, and no single review cycle catches both.
What belongs in each
Terms: who you are as a legal entity, what the service is, price, billing, renewal and cancellation, acceptable use, intellectual property and user content, liability, termination, governing law and how the terms change. Privacy policy: what personal data you collect and from where, why, the legal basis where a European regime reaches you, who receives it, transfers, how long it is kept, the rights people have and how to exercise them, and how to complain. Nothing on the second list is a promise the user gives you in return, which is precisely why it is not contract language.
Where the two touch
Three places. The terms should point at the policy rather than restating it, so there is only one description of your processing anywhere. The acceptance step usually names both, which is fine as long as pressing it is presented as agreeing to the terms and acknowledging the notice, not consenting to everything. And a change to either has to reach the user: a terms change through the notice route the terms promise, a policy change through the update mechanism the policy describes and, in California, an update at least every twelve months.
Two files, one footer
Keep them at stable, separate URLs, link both from the footer and from the point of sign-up, and give each its own effective date. Separate files make the review cycles independent, which is the whole point: the policy gets checked whenever a tool changes, the terms whenever the entity, the service or the money changes. Merged into one page, both get reviewed on whichever schedule somebody remembers, which in practice is neither.
Questions people ask about terms of service and privacy policy
Can we combine them to save space?
You can, and the cost arrives later when the privacy half needs changing monthly and the contract half should not move. Two documents cost nothing and stay honest for longer.
Does agreeing to the terms count as privacy consent?
No. Where a regime requires consent it has to be a specific, informed, freely given act for a named purpose, and burying it in a contract acceptance is the shape regulators reject.
Which one is legally required?
The privacy policy, in practice. California requires a conspicuously posted policy of a commercial site collecting personal information about its residents, with no size threshold. Terms are optional and useful.
Should both be linked at checkout?
Yes, beside the button, with the terms presented as something being agreed and the policy as something being disclosed. That distinction is what your acceptance record needs to be able to show.