Do You Need a Privacy Policy for Your App? (Apple & Google Rules)
Short answer: yes. If you plan to publish on the Apple App Store or Google Play, you need a privacy policy — no exceptions, no "my app is too simple" loophole. This is one of the most common reasons first-time makers get their submission bounced, and it's also one of the easiest to fix.
This post breaks down exactly what Apple and Google require, when the rule applies (spoiler: always), what your policy has to say, and how to get a compliant one live in a few minutes.
Quick note: This is a plain-English explainer, not legal advice. It reflects Apple's and Google's published store rules as of 2026. If your app handles sensitive data — health, kids, finance — or you operate in a regulated space, get a lawyer to review your policy before you ship.
Do I really need a privacy policy for my app?
Yes, and it's not optional on either store. Here's the state of play in 2026.
Apple's rule
Since December 8, 2020, Apple requires every app to provide a privacy policy URL in App Store Connect before you can submit — new app or update, free or paid. This lives under App Review Guideline 5.1.1. The link has to be publicly accessible, and Apple expects the policy to be reachable both on your App Store product page and from inside the app itself.
On top of the policy, Apple makes you fill out App Privacy details — the "nutrition label" questionnaire in App Store Connect that becomes the "App Privacy" section on your store listing. That's a separate step from the policy, but the two need to agree with each other.
Google's rule
Google Play is even more explicit: every app must have a privacy policy, and every app must complete the Data Safety form in Play Console — including apps that collect zero user data. You provide a public privacy policy URL in the console, and the answers in your Data Safety form must match what your policy says.
So on both stores, the answer to "do I need a privacy policy for my app" is the same. The only real question is what it needs to contain.
When does the privacy policy requirement apply?
Always. But it's worth understanding why, because it changes how much detail your policy needs.
You need a privacy policy the moment your app does any of these — and most apps do at least one without the maker realizing it:
- Collects an email, name, or phone number (sign-up, contact form, newsletter)
- Uses analytics or crash reporting (Firebase, Google Analytics, etc.)
- Shows ads or uses an ad network SDK
- Uses a login provider (Sign in with Apple, Google, Facebook)
- Stores user-generated content on a server
- Accesses location, camera, contacts, photos, or the microphone
- Processes payments or subscriptions
Even if you answer "none of the above," you still need a policy — because Google Play mandates one regardless, and Apple requires the URL to submit at all. The requirement is universal; the contents just get shorter for a genuinely no-data app.
What has to be in an app privacy policy?
Apple's guidelines are the clearest checklist here. Your policy must clearly and explicitly:
- Identify what data you collect — and how you collect it (directly from the user, automatically, from third parties).
- Explain all the ways you use that data — the specific purposes, not vague catch-alls.
- Confirm third-party protection — any third party you share data with provides equal protection of that data.
- Describe retention and deletion — how long you keep data and how a user can request deletion.
- Explain how users revoke consent — and how they contact you about their data.
Google Play adds one hard requirement that trips people up: the disclosures in your policy must be consistent with your Data Safety form. If your policy says you collect email addresses but your Data Safety answers say you collect nothing, that mismatch is a rejection risk. We cover that form in depth in how to fill out Google Play's Data Safety section.
A practical policy for an indie app usually includes these sections:
| Section |
What it covers |
| What we collect |
Categories of data (account info, usage, device) |
| How we collect it |
Directly, automatically, via SDKs |
| Why we use it |
App function, analytics, support, ads |
| Sharing & third parties |
Who gets data and why (e.g. Firebase, Stripe) |
| Data retention |
How long you keep it |
| User rights |
Access, correction, deletion, how to contact you |
| Children's data |
Whether the app is directed at kids (COPPA-relevant) |
| Changes & effective date |
How you'll notify users of updates |
| Contact |
A real email address |
Where do I put the privacy policy?
Two places, and both stores check:
- Store metadata field. A public URL you paste into App Store Connect and Google Play Console. It has to resolve to a live page at review time — a 404 or a "coming soon" page is an instant reject.
- Inside the app. An easily accessible link — a settings screen, an about page, or the sign-up screen. Apple specifically wants the policy reachable within the app "in an easily accessible manner."
Host the page anywhere stable: your website, a subdomain, or a hosted policy page. Just don't put it behind a login or on a link that expires.
What happens if you skip it
Nothing good, and it's not subtle. On Apple, you literally can't submit — App Store Connect won't accept the build without a privacy policy URL in the metadata field, so you're blocked at the door. On Google Play, a missing or broken policy link (or one that contradicts your Data Safety form) gets flagged in review and bounced back with a policy violation, costing you a full review cycle.
The most common ways makers trip up here:
- A dead link. The URL 404s or points to a "coming soon" page at review time.
- A locked page. The policy sits behind a login or paywall, so reviewers can't read it.
- A website-only policy. It's on the store listing but there's no in-app link — Apple wants it reachable inside the app too.
- A generic template that doesn't match the app. It claims data practices you don't have, or omits an SDK you do use.
All four are avoidable in about ten minutes, which is why it's worth doing properly the first time rather than eating a rejection.
How to create one fast (without a lawyer)
You have three realistic options:
- Hire a lawyer. Most accurate, most expensive. Worth it for regulated or high-risk apps.
- Write it yourself. Free, but easy to miss a required disclosure — and inconsistencies with your Data Safety form cause rejections.
- Use a generator, then edit. The pragmatic middle path for most no-code makers: answer a few questions about your app, get a structured draft that already includes the required sections, then adjust it to match your actual data practices.
Adalo Studio's app privacy policy generator is built for exactly this — it walks you through what your app collects and produces a mobile-app-specific policy with the sections Apple and Google expect, hosted at a live URL you can paste straight into both consoles. If you want a walkthrough of the fastest path, see creating a free app privacy policy in minutes.
Whatever route you choose, the policy has to describe your app truthfully. A generator gives you the skeleton and the required sections; you're responsible for making the answers real.
Don't stop at the policy
The privacy policy is one line item on a longer submission list. Before you hit "submit for review," run through the rest — App Privacy details, Data Safety answers, screenshots, and metadata — using the complete app store submission checklist so a missing field doesn't cost you a review cycle.
Bottom line: yes, you need a privacy policy for your app. It's required, it's universal, and it's a 10-minute job when you tackle it directly instead of discovering it during a rejection email.
Frequently asked questions
Do I need a privacy policy for my app if it doesn't collect data?
Yes. Google Play requires a privacy policy for every app, even ones that collect no data at all. Apple requires a privacy policy URL for every app submitted since December 2020. There is no exemption for simple or offline apps.
Where do I put the privacy policy for my app?
In two places: the metadata field in App Store Connect and Google Play Console (a public URL), and somewhere accessible inside the app itself, such as a settings screen or an about page. Both stores expect the link to work at review time and stay live afterward.
Can I write my own app privacy policy?
You can, but it needs to accurately describe what data you collect, how you use it, who you share it with, and how users can request deletion. Most no-code makers use a generator to produce a compliant draft, then edit it to match their actual app before publishing.