The privacy policy URL requirement

Every app on both stores needs a privacy policy at a URL the store can reach. The requirement is not conditional on collecting data: an app that collects nothing still needs a policy saying so.

Most failures are not about the policy

They are about the link. A privacy policy URL fails review for ordinary reasons: an expired certificate, a redirect that lands on a home page instead of the policy, a page that sits behind a login, or a domain that lapsed since the last release.

Open the URL in a private window on a device that has never seen your site. That is approximately what a reviewer does, and it catches the redirect and the login cases immediately.

It has to match what the app does

A policy that does not mention the analytics SDK you ship is a policy that contradicts your own data disclosure. Both stores compare the two.

Keep it reachable after you ship

The URL is checked at review, but it is also the one a user follows years later. A policy on a domain you stop renewing becomes a rejection on your next update.

Where this comes from: the Play side is measured on our own submissions; the Apple side is Apple’s published guidelines, which we have not tested against a real submission.

Source: Apple App Review Guideline 5.1.1 (Data Collection and Storage) privacy policy requirement; Google Play Developer Distribution Agreement privacy policy requirement, verified 2026-09-15