App Privacy Policy Generator

What each store checks

Apple wants the policy URL in App Store Connect and reachable inside the app. Under guideline 5.1.1(i), the policy has to say what you collect and how, every use of the data, that third parties give it the same or equal protection, how long you keep it, and how users can revoke consent or request deletion. If your app supports account creation, guideline 5.1.1(v) requires account deletion inside the app. Deactivating an account doesn’t count.

Google Play wants the link in Play Console and a link or the text inside the app. The policy must be labeled as a privacy policy, name the app or the developer shown on the listing, give a privacy contact, list the data and who it’s shared with, describe secure handling, and state your retention and deletion policy. Apps with accounts also need an in-app deletion path and a web page where users can request deletion without reinstalling the app. The HTML this tool exports has an #account-deletion section you can link for that. Our account deletion guide compares what each store expects from the deletion flow itself. If your app collects nothing, you still need a policy on both stores; here’s why, and what it should say.

Common privacy-policy rejections

• The link is broken or unusable. A 404, a page behind a login, a PDF, or an editable document. Play requires a public, non-geofenced, non-editable page.
• The policy doesn’t match your declarations. You declared crash data or device IDs in App Privacy or Data safety, but the policy never mentions them, or the reverse.
• SDK data is missing. Apple says you’re responsible for disclosing what third-party SDKs collect. Firebase Analytics, AdMob, and Meta collect device identifiers by default.
• No deletion path. An app with accounts but no in-app deletion, or no web deletion link on Play.
• Third-party AI isn’t disclosed. Guideline 5.1.2(i) requires you to disclose, and get permission for, sharing personal data with third-party AI.

Related tools

Work through the rest of a release with the App Store submission checklist and the Google Play publishing checklist. For your store listing, make the 1024 × 500 banner with the Play feature graphic generator, every icon size with the App Icon Generator, and framed screenshots with the App Store Screenshot generator.

Frequently asked questions

Do I need a privacy policy if my app collects no data?

Yes, on both stores. Apple’s guideline 5.1.1(i) says all apps must link a privacy policy in App Store Connect and inside the app, and the policy must say what data, if any, the app collects. Google Play’s User Data policy says apps that do not access any personal and sensitive user data must still submit a privacy policy. Click “My app collects nothing” and the generator writes a short policy that says so plainly, plus the retention, contact, and changes sections both stores expect.

Where should I host my privacy policy?

Google Play requires an active, publicly accessible, non-geofenced URL that is not a PDF and that visitors cannot edit. Download the HTML file and put it on your own website, GitHub Pages, Cloudflare Pages, or any static host. A published, view-only page from a site builder works too, but a shared Google Doc or any page visitors can edit does not. Paste the same URL into App Store Connect and Play Console, and link to it from inside your app, usually from the settings or about screen.

What does Apple’s guideline 5.1.1 require in a privacy policy?

The policy must clearly identify what data the app collects, how it collects it, and every use of it. It must confirm that any third party you share data with, including analytics tools, ad networks, SDKs, and related companies, will provide the same or equal protection of user data. And it must explain your retention and deletion policies and how a user can revoke consent or request deletion. Guideline 5.1.2 adds that sharing personal data with third-party AI must be clearly disclosed. Every policy this tool generates covers those points.

Does using this generator make my app GDPR or CCPA compliant?

No. A privacy policy is one disclosure, not compliance. GDPR also requires a lawful basis for each use, consent where you rely on it, and handling of access and erasure requests. Apple’s App Tracking Transparency prompt, Google Play’s in-app prominent disclosure for unexpected data access, and COPPA’s verifiable parental consent are separate obligations that happen inside the app. The CCPA section is optional because the law only applies to businesses above certain revenue or data-volume thresholds. Other laws, such as Brazil’s LGPD, Canada’s PIPEDA, and other US state laws, may also apply.

Can I use it for a kids’ app?

As a starting point. If your app is directed to children or has a mixed audience, the generator adds a COPPA section covering operators, what you collect from children, a written retention policy, and parents’ rights. It also warns you about SDKs that Apple’s Kids Category and Google Play’s Families policy restrict, such as ad and attribution SDKs, the advertising ID, and precise location. COPPA also requires direct notice to parents and verifiable parental consent, which a policy page cannot provide. Have a lawyer review a kids’ app policy.

How does this map to App Privacy labels and the Data safety form?

Each data type you tick maps to Apple’s App Privacy categories and Google Play’s Data safety types, for example email address becomes Contact Info › Email Address on Apple and Personal info › Email address on Play. The Store cheat sheet tab lists what to declare on each form, including purposes, whether data is linked to the user, used for tracking, or shared, and the data your selected SDKs collect by default. Google Play requires your Data safety answers to be consistent with your privacy policy, so fill both from the same answers.

Are the SDK descriptions accurate?

They are written from each vendor’s own privacy policy and store-disclosure docs as of October 2026, and they describe default settings. Your configuration changes what is collected. Turning off advertising ID collection in Firebase Analytics, or using PostHog’s EU cloud with IP capture off, are two examples. Check each vendor’s current documentation, and on iOS compare against Xcode’s privacy report. One known gap: Mixpanel’s iOS privacy manifest declares no data types, so Xcode under-reports it.

Is my information uploaded anywhere?

No. The policy is generated in your browser, and your answers are saved only in this browser’s local storage so you can come back to them. Nothing you type is sent to us. Clearing your browser data deletes the draft, so download the HTML or Markdown when you’re done.