The URLs Apple and Google require before you can ship
Both stores require a privacy policy URL. App Store Connect also requires a support URL. If your app has accounts, Apple requires an in-app deletion flow and Google requires a deletion web link. The marketing URL and a custom terms of use are optional. Every required item is just a public HTTPS page that loads without a login — and a reviewer will open each one.
These fields hold up more otherwise-finished submissions than any code problem, because they get left to the last hour of a launch. Here is the whole list in one table, re-checked against Apple's App Review Guidelines and Google's Play Console policies in August 2026.
Every URL, in one table
| URL | Required by | The page must show | If it's missing |
|---|---|---|---|
| Privacy policy | Apple + Google, every app | What the app collects, why, who it's shared with, and a contact route | You can't complete the submission; a dead or login-walled URL gets the review rejected |
| Support URL | Apple, every app | A working way to reach you about the app — a form or an email address | Mandatory App Store Connect field; a 404 or a bare social profile draws a rejection |
| Marketing URL | Nobody — optional | Your app's landing page, if you have one | Nothing. Leave it blank rather than pointing it anywhere half-built |
| Account deletion | Both, if your app has accounts | Apple: a flow inside the app (guideline 5.1.1(v)). Google: an in-app pathway and a public web link, declared in the Data safety form | Apple rejects under 5.1.1(v); on Play the Data safety form can't be completed, which blocks the release |
| Terms / EULA | Optional — except subscription apps | Custom terms if Apple's standard EULA doesn't fit — and required outright for auto-renewable subscriptions | Nothing for most apps. A subscription app with no Terms of Use link is rejected |
Notice the pattern in the last column: the required URLs fail in two ways, not one. Leaving the field empty blocks the submission form itself, and filling it with a URL that doesn't hold up — a 404, a placeholder, a page behind a Google Docs sharing wall — fails later, in review, after you've waited for it. The second failure is the expensive one.
Two practical simplifications: the same privacy policy URL works in both consoles, so one page covers both stores, and nothing requires these pages to live on separate sites. One small static site with a privacy policy, a support page, and a deletion page is the entire deliverable — three files, three URLs, every required field filled.
Host them in 60 seconds
None of these pages needs a server, a CMS, or a deploy pipeline. They are the simplest possible websites: static HTML on a public HTTPS URL. If you already have a marketing site, put them there. If you don't — and plenty of solo developers and agencies shipping a client's app don't — BetaDrop's free static hosting exists for exactly this:
- Write the pages. One plain HTML file per URL: privacy policy, support page, and an account deletion page if your app has accounts. No framework, no build step — a heading and honest paragraphs are all either store checks for.
- Drag them onto BetaDrop. Upload a single index.html or a zip of all three pages to BetaDrop's free static hosting. You get a live HTTPS URL in seconds — no server, no FTP, no DNS. A free site stays live for 30 days and renews once free, so put a URL your live listing depends on on a paid plan or a host you control.
- Paste the URLs into the consoles. Privacy policy and support URL go into App Store Connect; privacy policy and the account deletion link go into Play Console's App content section.
One caveat, and it is ours rather than a general one: these URLs sit on your public store listing for as long as the app does, while a free hosted site here stays live for 30 days and then parks. Renew it, move it to a paid plan, or point the listing at a host you control — a privacy-policy URL that 404s is a problem for the next reviewer and for every user who taps it.
Each URL in detail
Privacy policy URL — App Store
Apple requires the link for every app, under guideline 5.1.1 — including apps that collect nothing. The reviewer opens it in a browser without signing in to anything, and the policy has to agree with your App Privacy labels: a policy claiming you collect nothing while your labels declare an advertising identifier is a contradiction visible from one screen. The five ways the URL itself gets rejected — dead links, login walls, homepage links, PDF downloads, unfilled templates — are in the App Store privacy policy URL guide.
Privacy policy URL — Google Play
Play asks for the URL in the App content section of Play Console, and Google is explicit that even apps collecting no user data must provide one (checked August 2026). The page must be publicly reachable, specific to your app, and consistent with what your Data safety form declares — mismatches between the two are the modern rejection, more than the policy text itself. The same HTML file you wrote for Apple covers this; the Google Play privacy policy URL guide walks through the Play-specific rules and rejections.
Support URL — App Store Connect
Apple-only, and mandatory for every app. The bar is low but real: a page where a user with a problem can actually reach you. What fails is pointing the field at a social media profile, a mailto: link with no page around it, or a site that has nothing to do with the app. A heading, one paragraph, and a contact email clears it — the app support URL guide includes what to put on the page.
Account deletion — both stores, different shapes
This is the one the table can't fully capture, because the two stores want different things. Apple's guideline 5.1.1(v) requires deletion to be initiable inside the app — a web page alone doesn't satisfy it. Google requires a web link, reachable by someone who has already uninstalled the app, entered in the Data safety form and displayed on your store listing. Most apps with accounts end up needing both, and the rule applies even when account creation is optional. The account deletion URL guide covers what the page should say and what you may legally retain.
Marketing URL and EULA — the optional two
The marketing URL is a free listing link if you have a landing page, and safely blank if you don't. The EULA field is similar: Apple applies its standard end user license agreement to every app that doesn't supply custom terms, which is the right default for most apps. Neither field has ever blocked a submission by being empty. Don't spend launch-day hours on them.
When a policy generator is the better call
Hosting is the easy half of this problem, and it's the half BetaDrop solves. The hard half is having a privacy policy that is actually true. If you don't have the text yet — if you're not sure what your analytics SDK collects, or whether GDPR or CCPA language applies to you — a generator service like TermsFeed or its competitors, or an actual lawyer, is the right first stop. They produce the document; we just give it a URL.
The order matters. A beautifully hosted template with someone else's company name still in it is a rejection, and a policy that misdescribes your data collection is a liability that outlasts the review. Write or generate something true first, then host it. If you already have the text — most teams resubmitting after a metadata rejection do — skip the generator and go straight to hosting.
Frequently asked questions
Which URLs are required before I can submit to the App Store?
Two fields in App Store Connect are mandatory for every app: a privacy policy URL and a support URL. The marketing URL field is optional. If your app supports account creation, Apple's guideline 5.1.1(v) additionally requires an account deletion flow inside the app — a web page explaining that route is good practice, but the in-app flow is what review checks.
Which URLs does Google Play require?
Every app needs a privacy policy URL, entered in Play Console's App content section — Google states that even apps that collect no user data must provide one. If your app lets users create an account, the Data safety form also requires a web link where users can request account and data deletion, and Play shows that link on your store listing.
Do I need a privacy policy URL if my app collects no data?
Yes, on both stores. Apple requires a privacy policy link in App Store Connect metadata for every app, and Google requires one for every app on Play even when the Data safety form declares no collection. A short, honest page stating what you do not collect satisfies both.
Can I use a Google Doc or Notion page as the URL?
Only if the sharing settings are exactly right, and that is the trap: a document that opens fine for you can still demand a login from an App Store reviewer, which reads as a broken URL and gets the submission rejected. A plain HTML page on a public HTTPS URL has no sharing settings to get wrong.
Is the marketing URL required in App Store Connect?
No — it is the one optional URL in this set. Leaving it blank costs you nothing. If you do fill it in, point it at a real page rather than a parked domain, because it appears on your public App Store listing.
Do I need a terms of service or EULA URL?
Not usually. Apple applies its standard end user license agreement to every app that does not supply a custom one, so the EULA field is optional, and Google does not demand a terms URL either. Write custom terms when you have something real to add — subscriptions, user-generated content, liability you need to limit — not because a form has a field for it.
The paperwork is three small HTML files. Write them once, host them, paste the URLs, and get back to the part of the launch that isn't a form field.
