Apple requires a privacy policy URL for every app on the App Store. Not just apps that collect data, and not just paid ones — every app, including the offline calculator that never touches the network. The field is not optional, and you cannot submit without filling it in.
That much is well known. What catches people out is the second half: the URL has to keep working, and a reviewer will open it.
What Apple actually checks
The reviewer opens the URL you entered, in a browser, without signing in to anything. They are confirming three things:
- It loads. No 404, no timeout, no "coming soon" placeholder.
- It is reachable without a login. A page behind a sign-in wall fails, which is the trap with a Google Doc or Notion page shared at the wrong level.
- It is a real policy for your app. A generic template that never names what your app collects is a rejection under privacy grounds, not a pass.
It is worth being precise about where this fits. The privacy policy URL is separate from your App Privacy labels — the nutrition-label questionnaire in App Store Connect — and separate again from the privacy manifest your SDKs ship. All three have to agree. A policy claiming you collect nothing while your labels declare an advertising identifier is a contradiction a reviewer can see from one screen.
Why the URL gets rejected
Almost every rejection we see quoted in developer forums is one of five things, and none of them are about the legal text:
- The link is dead. The page moved, the host expired, or the trailing slash matters and the URL was pasted without it.
- The link needs an account. Docs, Drive, Notion and Dropbox all do this depending on sharing settings.
- It points at your homepage rather than the policy, leaving the reviewer to hunt for it.
- It is a PDF download rather than a page. It technically works, and it is miserable to read on a phone.
- The policy is a template with the placeholder company name still in it. This is the same class of mistake as shipping "Lorem Ipsum" in the app, which is its own common App Store rejection.
Where to host the page
The requirement is unglamorous: one HTML page, on a public HTTPS URL, that stays up. You do not need a server, a CMS, or a domain purchase to satisfy it.
If you already have a marketing site, put the policy on it and use that URL. If you do not — and plenty of solo developers and agencies shipping a client build do not — you can host a static page free on BetaDrop: drop a single index.html or a zip, and you get a live HTTPS URL you can paste straight into App Store Connect. It is the same page you will need for Google Play, so one file covers both stores.
Whatever you choose, avoid hosting it somewhere you will forget about. The URL sits on your public App Store listing for as long as the app is live, and a policy that 404s two years later is worse than the day you submitted it — users see it, and the next reviewer does too.
What the page should contain
This is a legal document and this is not legal advice, but the structural expectations are consistent across both stores:
- Who you are — the developer or company name, matching your store listing.
- What data the app collects, named specifically rather than by category alone.
- Why you collect it, and who it is shared with, including third-party SDKs.
- How a user contacts you about their data, and how they request deletion.
- A last-updated date.
That last point about deletion is increasingly its own requirement rather than a line in the policy — if your app has accounts, both stores now want a dedicated account deletion route.
The other URL you will be asked for
Privacy policy is one of two URLs App Store Connect requires. The other is the support URL, and it fails for exactly the same reasons — dead links, login walls, and pointing at a social profile instead of a page. If you are creating one page, create both at the same time and get the whole submission chore out of the way at once.
Frequently Asked Questions
Does my app need a privacy policy URL if it collects no data?
Yes. Apple requires a privacy policy URL for every app on the App Store, free or paid, whether or not it collects data. An app that collects nothing still needs a policy that says so.
Can I use a Google Doc or a PDF as my privacy policy URL?
It is risky. The URL has to open in a browser without a login, and a Google Doc set to the wrong sharing level shows a sign-in wall to the reviewer. A plain HTML page on a URL you control is the safer choice, and it stays readable on a phone.
Where do I enter the privacy policy URL in App Store Connect?
Under App Information for the app, in the General Information section. It applies to the app as a whole rather than to a single version, so changing it does not require a new build.
What happens if the privacy policy URL breaks after the app is live?
The link stays on your App Store product page, so a dead URL is visible to every user who taps it, and it can be flagged on your next submission. Treat the page as part of the app rather than a one-off submission chore.
Do I need a separate privacy policy for the App Store and Google Play?
One policy can serve both, provided it accurately describes the data practices of both builds. Both stores require the URL to be publicly reachable, and both check that it loads.
