App privacy policy: what Google Play and the App Store require

Before Google Play or the App Store will publish your app, you need a privacy policy at a public URL. Reviewers check that it exists, that it matches what your app does, and that it covers what each store asks for. This page explains what goes into a mobile app privacy policy, where each store's rules come from, and why apps get rejected. When you are ready, the free app privacy policy generator writes one from your answers.

What is an app privacy policy?

It is a public page that tells people what information your app collects, why, who receives it, how long you keep it and how they can get it deleted. For an app, it also has to cover things a website policy skips: device permissions such as the camera or location, the SDKs inside your app, in-app purchases, and account deletion.

It is a legal statement as well as a store requirement. In the US, the FTC treats a privacy policy that does not match an app's real behavior as a deceptive practice. Laws such as California's CCPA, the EU and UK GDPR and the US children's privacy rule COPPA each add content requirements.

Does my app need a privacy policy?

Almost certainly:

• Google Play requires a privacy policy link for every app, including apps that collect no personal data, entered in Play Console and also shown inside the app.
• Apple requires a privacy policy URL for every app in App Store Connect, and guideline 5.1.1 asks for a link inside the app too.
• Any app that collects personal information from US, EU, UK or California users is also covered by those places' privacy laws.

A short, honest policy for an app that collects nothing is fine. A missing one is not.

What must a mobile app privacy policy contain?

Combining Google Play's User Data policy and Apple's guideline 5.1.1, a store-ready policy covers:

1. Who you are: the developer or company name as it appears on the store listing, and a privacy contact.
2. What you collect: every type of personal and sensitive data the app accesses, collects or shares, including through permissions and SDKs.
3. How you use it: the purpose of each kind of data.
4. Who receives it: the types of third parties, such as analytics, advertising or payment providers, and a statement that they protect it as well as you do.
5. How you keep it safe: how data is handled and transmitted securely.
6. How long you keep it and how people can delete it: your retention periods and how to request deletion, including without the app.
7. How people can withdraw consent, plus any rights that apply to them under GDPR, CCPA or COPPA.
8. How you announce changes, and the date of the current version.

It must be clearly labeled as a privacy policy and must not be a PDF, geo-blocked or editable by visitors.

What does Google Play require?

Google Play checks the policy against three other things you provide: your Data safety form, your permission declarations and your app's real behavior. Apps that let people create accounts must also offer account deletion inside the app and through a web link. Apps that collect sensitive data need a prominent in-app disclosure before asking for consent. Our Google Play privacy policy guide covers each of these.

What does the App Store require?

Apple asks for a privacy policy URL, App Privacy details (the "nutrition label" on your product page), App Tracking Transparency consent before any tracking, in-app account deletion for apps with account creation, and privacy manifests for certain SDKs. Our App Store privacy policy guide walks through them.

Why do apps get rejected over privacy?

The rejections developers run into most often:

• The privacy policy link is missing, broken, behind a login, or points to a home page instead of the policy.
• The policy does not name the app or the developer shown on the listing.
• The policy says "we collect nothing" while the app includes analytics or ad SDKs.
• The Data safety form or App Privacy details disagree with the policy.
• The app requests a permission, such as location in the background, that the policy does not explain.
• The app lets users create accounts but offers no way to delete them.
• A children's app includes advertising or analytics SDKs not approved for children.

Every one of these is a mismatch. The fix is the same each time: describe what the app actually does, in the policy and in the store forms, and keep them in step.

How does the generator map to each requirement?

The generator runs on this page; nothing you type is sent to us; our host still sees ordinary request logs. You can copy the result, download it as HTML or Markdown, or print it.

What else should I prepare?

• The privacy policy template, if you prefer to fill in placeholders yourself.
• Three worked examples: a note-taking app with no account, a fitness app with accounts and health data, and a free game with ads and purchases.
• A terms and conditions template for apps, which Apple expects for auto-renewing subscriptions.

Host the policy on a page you control, keep it at the same URL, and update the date when anything changes.