Both the App Store and Google Play require a privacy policy link for apps. The policy should explain what personal data the app and its third-party SDKs collect, why it is collected, how it is used and shared, how long it is kept, how users can access or delete it, and how to contact you, plus any extra rules for children or specific regions. Host it at a public, stable URL, link it in the store listing and inside the app, and keep it consistent with your App Privacy details and Data safety form.
Why every app needs a privacy policy
Apple requires every app to provide a privacy policy URL in App Store Connect, and Google Play requires a privacy policy for apps, displayed in the store listing and accessible inside the app. Privacy laws in many regions, such as the GDPR in Europe and state laws in the United States, also require clear privacy notices when personal data is processed.
Even apps that collect little data usually rely on SDKs for analytics, crash reporting, or ads that do collect data. A privacy policy that accurately describes this protects users, your listing, and your business. This guide is general information, not legal advice; consult a qualified lawyer for your situation.
What the policy should cover
At a minimum, describe what personal data you collect, including data collected automatically and by third-party SDKs; why you collect it; how you use it; who you share it with and why; how long you keep it; how you protect it; and how users can exercise their rights, such as access, correction, and deletion.
Include your identity and contact details, the date of the latest update, and how you will notify users of changes. Write in plain language. Users and reviewers should be able to understand it without legal training.
Account third-party SDKs
Analytics, attribution, ads, crash reporting, payment, and social login SDKs may collect device identifiers, usage data, location, or other information. Your policy must account for this data, not just data your own code collects.
Keep an inventory of every SDK, what it collects, and why. Review it whenever you add or update SDKs. Our guide to privacy labels and Data safety explains the same inventory approach for store disclosures.
Keep it consistent with store disclosures
Your App Privacy details on the App Store and Data safety form on Google Play summarise data practices for users. They must match your privacy policy and your app's actual behaviour. Inconsistencies are a common reason for rejection or enforcement.
When practices change, update the policy, the store disclosures, and the app together. Our guide to Google Play account suspensions explains how data disclosure problems can lead to enforcement.
User rights and account deletion
Many privacy laws give users rights to access, correct, delete, or port their data, and to object to certain processing. Explain how users can exercise these rights and how quickly you will respond.
Apple requires apps that support account creation to let users initiate account deletion from within the app, and Google Play requires apps that allow account creation to provide a way to request account and data deletion, including a web resource. Describe these options in your policy. Our App Store Review Guidelines explained guide covers the Apple requirement.
Children's data
If your app targets children or is likely to be used by them, stricter rules apply, such as COPPA in the United States and the GDPR's protections for children in Europe. Both stores also have specific policies for apps in kids or family categories, including limits on ads and data collection.
Our kids and family app ASO playbook covers store requirements for children's apps. Seek legal advice before collecting data from children.
Tracking and advertising
If your app tracks users across other companies' apps or websites for advertising, explain this in your policy, and on iOS request permission through App Tracking Transparency. Describe advertising partners and how users can opt out where applicable.
Our ATT prompt guide explains Apple's tracking rules, and our AdMob ad monetization guide covers consent for ads.
Where and how to host it
Host your privacy policy at a public, stable URL on your website, not a document that requires login or changes location. Google Play requires the policy to be at an active, publicly accessible, non-geofenced URL that is not a PDF. Link it in your store listing, inside the app, and on your website.
Make the policy easy to find in the app, for example in settings or account screens. Translate it into the languages your app supports where practical.
Region-specific requirements
Different regions add specific requirements: the GDPR requires a legal basis for processing and information about international data transfers; several US state privacy laws require disclosures about selling or sharing personal information and opt-out mechanisms; other countries have their own rules.
If you operate in many markets, consider a policy structure with a global section plus region-specific sections. Our European multi-country rollout guide touches on privacy expectations in Europe.
Privacy as a conversion factor
Users increasingly read privacy labels before installing, especially in health, finance, messaging, and kids categories. Collecting less data and explaining it clearly can support conversion and trust. Privacy-forward positioning is a genuine differentiator in some categories.
Our guides to password manager and security app ASO and messaging app ASO show how privacy supports growth.
Common privacy policy mistakes
Copying a generic template that does not match your app's real data practices is the most common mistake. Others include forgetting SDK data collection, hosting the policy as a PDF or behind a login, failing to describe account deletion, and letting the policy drift out of sync with store disclosures.
Teams also forget to update the policy when adding new features, SDKs, or markets.
A worked example: a fitness app's privacy update
A fitness app adds a new analytics SDK and a social login option. During its release review, the team updates its SDK inventory, revises the privacy policy to describe the new data flows, updates the App Privacy details and Data safety form, and adds an in-app account deletion option.
The update passes review without questions, and the team adds a clear privacy summary to its onboarding. Users who care about health data privacy see consistent information across the store listing, policy, and app.
How to do it, step by step
- Inventory data and SDKsList all personal data your app and its SDKs collect, why, and where it goes.
- Draft in plain languageCover collection, use, sharing, retention, security, rights, contact, and updates.
- Add special sectionsInclude children's data, tracking and ads, account deletion, and region-specific rights as needed.
- Host and link itPublish at a public, stable, non-PDF URL and link it in the listing, app, and website.
- Keep everything in syncUpdate the policy, store disclosures, and app together whenever practices change.
Before and after examples
Illustrative examples written for a generic app in this category, not client results. Swap in your own product, audience, and data.
We may collect some information.
We collect your email to create your account and workout history to show your progress. Crash data is collected by our crash reporting provider to fix bugs.
Why it works: Specific descriptions build trust and meet requirements.
Privacy policy as a downloadable PDF.
Privacy policy at example.com/privacy, publicly accessible.
Why it works: Google Play requires a public, non-PDF URL.
Email us to delete your account.
Settings, then Account, then Delete account, or use our web form at example.com/delete.
Why it works: Stores require in-app or web deletion options.
Action plan
- Inventory every SDK's data collection
- Write in plain language
- Describe user rights and deletion
- Host at a public, stable URL
- Keep store disclosures consistent
- Review with each release
Metrics to monitor
- Policy and disclosure consistency checks per release
- App review rejections related to privacy
- Account deletion requests handled on time
- Privacy-related reviews and support tickets
Record the baseline, release date, audience, markets, and external changes before interpreting movement. Rankings and conversion are useful signals, but a decision is stronger when activation, retention, and business value confirm that the page attracted the right users.
Frequently asked questions
Do all apps need a privacy policy?
Apple requires a privacy policy URL for every app, and Google Play requires a privacy policy for apps. Privacy laws may also require one.
What should an app privacy policy include?
What data is collected, why, how it is used and shared, retention, security, user rights, children's data if relevant, and contact details.
Can my privacy policy be a PDF?
Google Play requires a public, active URL that is not a PDF. A web page is the safest option for both stores.
Do I need to mention third-party SDKs?
Yes. Your policy and store disclosures must account for data collected by SDKs in your app.
Do apps need account deletion?
Apps that allow account creation must offer a way to delete accounts under Apple's rules and Google Play's requirements.
Can I use a privacy policy template?
Templates can help with structure, but the content must match your app's real practices. Consider legal review.
Keep reading
Go deeper on this topic
More in Policy and Compliance
Browse all 8 Policy and Compliance guides
Work with ASOWin
Primary sources
Platform capabilities and limits can change. Verify current requirements in these official resources:
