How to write an app privacy policy for the App Store
Why every app needs one
Guideline 5.1.1 is explicit: all apps must include a link to their privacy policy. This applies even if your app collects no data at all, because Apple still wants users to be able to confirm that. Apps that skip the policy, or whose policy does not actually describe their data practices, are a common cause of rejection.
The privacy policy is also tied to two other things you fill out in App Store Connect: the App Privacy details, which are the data labels shown on your product page, and your answers in the App Privacy questionnaire. All three need to agree with each other and with what the app really does. If your privacy policy says one thing and your App Privacy labels say another, that mismatch can get the app rejected. The labels are covered in the app privacy nutrition label guide.
What the policy needs to cover
A usable app privacy policy is plain and specific. At a minimum, cover:
- What data you collect. Account details, contact info, usage analytics, device identifiers, location, and anything else, named clearly.
- How you use it. The purpose for each kind of data, such as running the account, analytics, or crash reporting.
- Who it is shared with. Name the third-party services involved, for example a backend, an analytics tool, or a crash reporter, and link their policies where relevant.
- How long you keep it and how it is protected.
- How users exercise their rights. How to request access or deletion of their data. If your app supports account creation, Apple requires that users can also request account deletion from within the app.
- A contact method and the date the policy was last updated.
Write it for the specific data your app actually touches. A generic template that lists data you do not collect is as much of a problem as one that omits data you do collect.
How to add the policy in App Store Connect
Once the policy is written and hosted at a stable public URL, connect it:
- In App Store Connect, open your app and go to the App Information section.
- Enter the privacy policy URL in the Privacy Policy field for each platform your app targets.
- Optionally add a user privacy choices URL, which is where users manage or opt out of data use. This one is optional.
- Make the same policy reachable inside the app, commonly from a settings or about screen, so it satisfies both the metadata requirement and the in-app expectation.
- Confirm the policy text lines up with your App Privacy answers before you submit.
Keep the URL live. A privacy policy link that returns an error during review is treated as a missing policy.
Where AppFlight fits
Your privacy policy is a legal document about your specific app, so writing it stays with you, and AppFlight does not generate it. What AppFlight does is make the facts easy to get right: it shows which connectors are wired in, such as Supabase, analytics, or crash reporting, and what data each one handles, so your policy and your App Privacy labels describe reality. It then runs the rest of the submission flow once your policy URL is in place. Apple reviews every app, so submitted is not approved.
FAQ
Does every app need a privacy policy?
Yes. Apple requires a privacy policy URL for every app on the App Store, even one that collects no personal data, under guideline 5.1.1. The URL goes in App Store Connect and the policy should also be reachable from inside the app.
What does an app privacy policy have to include?
At a minimum it should describe what data the app collects, how that data is used, who it is shared with including third-party services, how long it is kept, and how a user can request that their data be deleted. It also needs to match the App Privacy answers you give in App Store Connect.
Does AppFlight write my privacy policy?
No. A privacy policy is a legal document specific to your app and your jurisdiction, so you are responsible for it. AppFlight does show you which connectors are wired in and what data they handle, which makes the policy easier to write accurately, and it runs the rest of the submission flow.