App Privacy Policies: When You Need One and What to Include

This guide explains store requirements in plain English. It is not legal advice — if your app handles health, financial or children's data, talk to a lawyer.

Do you need a privacy policy?

Almost certainly yes.

• Apple requires a privacy policy link for every app in App Store Connect, and the policy must also be easy to find inside the app (App Review Guideline 5.1.1).
• Google Play requires one for every app that handles personal or sensitive user data, and for every app that targets children. In practice that's nearly every app, because ad and analytics SDKs handle device identifiers.
• Privacy laws such as the GDPR (EU/UK) and CCPA (California) require you to tell users what you collect, regardless of store rules.

Even a simple offline app benefits from a short policy saying "we don't collect anything" — reviewers look for the link, and users trust it.

Your SDKs collect data even if you don't

The most common mistake is writing "we collect no data" while shipping SDKs that do. If your app includes any of these, your policy must mention them:

Check each SDK's documentation — most publish a "data disclosure" page written exactly for privacy labels and Data safety forms.

What a privacy policy should include

1. Who you are — the developer or company name and how to contact you.
2. What data you collect — each type (contact info, identifiers, usage data, location, photos…), and whether it's collected by you or by third-party SDKs.
3. Why you collect it — app functionality, analytics, advertising, account management, fraud prevention.
4. Who you share it with — list the third-party services with links to their privacy policies.
5. Advertising and tracking — whether ads are personalized and how users opt out (App Tracking Transparency on iOS, advertising ID settings on Android).
6. Data retention — how long you keep data and what happens when an account is deleted.
7. User rights — access, correction, deletion and how to request them.
8. Children — whether the app is directed at children and how you handle their data.
9. Security — the general measures you take.
10. Changes — how you'll notify users, with an effective date.

The privacy policy generator builds all of these sections from a checklist of your data types and SDKs, and warns you about common mismatches (for example AdMob without device identifiers).

Apple: privacy labels and privacy manifests

On the App Store, the policy is only one of three privacy disclosures that must agree:

• App Privacy details ("nutrition labels") — filled in under App Privacy in App Store Connect. You declare each data type, whether it's linked to the user's identity and whether it's used for tracking.
• Privacy manifests — PrivacyInfo.xcprivacy files in your app and in third-party SDKs. Since May 1, 2024, uploads must declare approved reasons for using certain "required reason" APIs (such as UserDefaults or file timestamps), including uses inside SDKs. Keep your SDKs up to date so their manifests are included.
• App Tracking Transparency — if you or an SDK track users across other companies' apps or websites (for example personalized ads), you must show the ATT prompt and respect the answer.

Google: the Data safety form

In Play Console under App content → Data safety, you declare which data types your app collects and shares, whether collection is optional, whether data is encrypted in transit, and whether users can request deletion. Google shows a summary on your store listing. Reviewers compare it with your privacy policy and with the SDKs detected in your app bundle — inconsistencies are a common reason for rejected updates.

Account deletion

If users can create an account in your app:

• Apple requires that they can also start account deletion from within the app (Guideline 5.1.1(v)).
• Google requires an in-app path and a web link where users can request deletion without reinstalling the app. The link goes in the Data safety form.

Mention the deletion process and timeline in your privacy policy.

GDPR, CCPA and children's apps

• GDPR (EU/UK): state your legal bases (contract, legitimate interest, consent), users' rights, and how to complain to a data protection authority. Personalized ads for EU users generally need consent — ad SDKs provide consent tools for this.
• CCPA/CPRA (California): describe the right to know, delete, correct and opt out of the "sale" or "sharing" of personal information. Personalized advertising can count as "sharing".
• Children (COPPA and store policies): apps for children face strict limits — no behavioral advertising, only certified ad SDKs on Google Play (Families policy), and restrictions on third-party analytics in Apple's Kids category.

Where to host it

The policy must be at a public URL that works without logging in: your app's website, a free GitHub Pages site or Google Sites page all work. Use the same URL in App Store Connect, Play Console and your app's settings screen, and keep it updated whenever you add a new SDK.

Sources: App Store Review Guidelines 5.1, Apple "Privacy manifest files" and "Upcoming requirements", Google Play "User Data" policy and Data safety help. Last checked October 2026.