Privacy policy for your app: what Apple and Google require, with a template

Every app needs a privacy policy before Apple or Google will publish it. Here is what it must say, where to put it, and a template for your app.

Both stores want the same core: what your app collects, why, who else receives it, how long you keep it, and how users can have it deleted. Write it for this app, not for your website, publish it at a public address, and link to it from the store listing and from inside the app. If you build with GoodBarber, the Privacy Center gives you a complete template to fill in.

Yes, even an app that collects nothing.

• Apple asks it of every app. Guideline 5.1.1 of the App Store Review Guidelines requires a link in App Store Connect and another one inside the app.
• Google Play is explicit: apps that do not access any personal or sensitive data must still submit a privacy policy, according to its User Data policy.
• In the European Union, the GDPR adds its own list as soon as your app collects personal data, and most apps do: an email address at sign-up, a device token for push notifications, a location for a map. Article 13 of the GDPR says what you must tell people when you collect it.

Google also wants your developer details, a privacy contact and your secure data handling procedures in the policy. And one rule sits next to the policy at Apple: if users can create an account in your app, they must be able to delete it from inside the app (guideline 5.1.1 (v)). Google Play has the same rule, and also asks for a web page where users can request deletion outside the app, linked in the Play Console.

Copy this structure and replace everything in brackets. It follows the order the stores and the GDPR expect, and covers the essentials. If you build with GoodBarber, start from the Privacy Center's template instead, which is more complete. Either way, it is a starting point, not legal advice: if your app handles health data or is made for children, have it checked.

1. Title and scope. “[App name] privacy policy. This policy applies to the [App name] app for iPhone and Android, published by [legal name], [address].”
2. What we collect, and when. One line per type of data, for instance: “your name and email address, when you create an account; a device token, to send you push notifications; your location, only when you open the map and allow it; usage statistics, to see which sections are read; the messages and photos you send through our forms.”
3. Why we use it. “We use your email address to manage your account, and your location to show [places] near you.” In the European Union, add the legal basis of each use, usually contract, consent or legitimate interest.
4. Who receives it. “Our hosting provider [name, country], our analytics provider [name], our advertising partner [name]. They protect your data at the same level as this policy.” Apple asks you to confirm that last sentence. If a provider stores data outside the European Union, say where, and on which safeguard: “[Provider] stores data in [country], under the European Commission's standard contractual clauses.” Purchases made through the App Store or Google Play are processed by Apple or Google.
5. How long we keep it. “Account data: as long as your account is open, then [period]. Statistics: [period].”
6. How we protect it. “We protect your data with [encryption in transit, restricted access, our hosting provider's security measures].” Google Play requires this part.
7. Your rights. “You can access, correct or delete your data, restrict or object to its use, receive it in a reusable format, and withdraw your consent at any time. Delete your account in [menu path], or write to [email]. You can also complain to [your data protection authority].”
8. Contact. “[email]” and, if you have one, the contact of your data protection officer.
9. Changes. “Last updated: [date]. We will tell you in the app if this policy changes.”

• A policy written for your website. It must describe the app. Google checks that it names the app or your company, and both stores check that it covers the data the app collects.
• A page that is not public. Behind a login, deleted during a redesign, or sent as a PDF: Google Play wants an active, public web page.
• No link inside the app. Both stores require one. A menu entry or the settings screen is enough.
• A policy that says less than the app does. If your app uses an analytics tool or an advertising network, the policy has to say so, and so do your answers in Apple's App Privacy form and Google's Data safety form. Marc covers those two forms step by step in our mobile app privacy checklist.
• No way to delete an account. If users can sign up, both stores require that they can delete their account from inside the app, and Google Play also wants a web page for deletion requests.

The Privacy Center gives you a complete privacy policy template, more detailed than the one above. Replace the parts in blue with your own information, name your app, and add a contact email.

Once you save it, the policy has its own public page on your app's web version (PWA). That is the address you give Apple and Google. If the web version is not published, the back office gives you an HTML address in Settings > Other Settings > My Files. Then add a link to it in your app's menu.

Two details from our help center:

• On iOS, if your app uses comments, the Submit section, in-app purchases or login, the policy must be set before you can build the app, as our App Store help explains.
• If you already have your own policy, you can keep its address. Copy into it the parts of the template that describe your app's features: Google Play checks them, as our Google Play help explains.

If GoodBarber Takes Care publishes your app for you, give the address in your review brief.

A privacy policy is not written once. Each time you add a feature that touches personal data, such as a sign-up form, a map, an advertising network or a new analytics tool, update the policy first, then your App Privacy and Data safety answers, before you submit the update. Apple keeps the address from one version to the next and checks it with each update; you can only change it while a new version is in preparation. Google Play also reviews apps already live, without a new submission, and can remove an app that breaks its rules, as its enforcement page explains. Keep the page online and up to date at all times, at the same address: change the text, not the link.

Does my app need a privacy policy if it collects no data?

Yes. Apple requires one for every app, and Google Play states that apps that access no personal or sensitive data must still submit one. In that case, the policy says so in plain words.

Can I use my website's privacy policy?

Yes, if it covers the app: it names the app, describes the data the app collects, and sits at a public address. Otherwise, publish a separate page for the app.

Can my privacy policy be a PDF?

Not for Google Play, which asks for an active, public web page and excludes PDFs. A web page works for Apple too.

Where should the privacy policy appear in the app?

Where users find it easily, such as the menu or the settings screen. Google Play accepts a link or the full text inside the app.

What happens if the privacy policy link stops working?

The stores check it at review, so a broken link can block your next update, and Google Play also reviews apps already live, without a new submission. Keep the page online and up to date at all times, and keep its address when you change the text.

Is a privacy policy generator enough?

It gives you the structure. What the stores check is that the text matches what your app actually does, so read it against your features before you submit.

GoodBarber's Privacy Center gives you a complete privacy policy template and publishes your policy on your app's web version, ready to paste into App Store Connect and the Play Console. Start your app with the 30-day free trial, no credit card required.