Privacy Policy for Mobile Apps
An app collects different things than a website, in different ways, and both app stores require you to disclose it before anyone can even download your app.
Last updated: August 2026
How an app policy differs from a website's
A website privacy policy mostly deals with cookies, form submissions, and analytics. An app introduces categories a website usually doesn't have to think about: device permissions (camera, location, contacts), push notification tokens, and in some cases, background data collection the user never directly interacts with. Your policy needs to name these specifically, not just gesture at "app usage data."
What to cover
- Permissions you request. Camera, location, contacts, microphone, whatever your app actually asks for, and why.
- Data collected automatically. Device identifiers, crash logs, usage analytics.
- Account data, if applicable. Anything tied to a login or profile.
- Third-party SDKs. Analytics platforms, ad networks, or crash-reporting tools built into the app, each of which may have its own data access.
- How to delete an account or opt out. Increasingly expected, and required outright under some state privacy laws.
App Store and Play Store listing requirements
Both major app stores require a privacy policy link before your app can go live, not as a nice-to-have. Apple requires a working privacy policy URL in your App Store Connect listing. Google requires the same in your Play Console listing, and additionally requires you to complete a Data Safety form describing what the app collects, independent of the policy text itself. Neither store will approve a submission with a broken or missing privacy policy link, so test the link itself before you submit.
A privacy policy isn't the only document worth having ready. If you're licensing the app rather than giving it away outright, see our EULA generator, it covers licensing terms a privacy policy doesn't touch. Not sure what a EULA actually is or whether you need one? Start here.
Frequently asked questions
Can I use the same privacy policy for my website and my app?
You can use one document, but it needs a section specifically addressing app permissions and device data, not just website language repurposed. A policy that never mentions camera or location access doesn't actually describe what your app does.
Do I need a separate policy for iOS and Android versions?
Not necessarily two separate documents, but if the two versions request different permissions or use different SDKs, your single policy needs to account for both accurately.
What if my app doesn't collect any data?
You still need a privacy policy stating that plainly. Both app stores require a policy link regardless of how much or how little you actually collect.
Sources
- Apple Developer, App Store Connect privacy policy URL requirement
- Google Play Console, Data Safety form and privacy policy requirement
Both stores' specific submission steps and form names can change between platform updates; the core requirement, a working privacy policy link before an app can go live, has stayed stable.