App Privacy Policy for iOS: What Apple Requires

Why Apple requires a privacy policy

As soon as you create a listing in App Store Connect, Apple asks you for a privacy policy URL, plus a support URL that actually works. This isn't just a box to tick: the App Review guidelines require every app to have one, whether or not your app has user accounts. Without that page live and accessible, your submission is blocked before a reviewer even looks at it.

A missing privacy policy, or one that doesn't match what the app actually does, is one of the most avoidable rejection reasons. It's also one of the first things I check when I review a submission before sending it to Apple.

What your privacy policy actually needs to include

The text has to describe what your app really collects, not a generic list copied from somewhere else. Four things come up in most cases:

The data you collect. Account, email, content created in the app, technical data like the advertising identifier if you use one. If you don't collect anything in particular, say that clearly too.

The reason for each piece of data. Why you need that data to make the app work, not a vague justification.

The third parties involved. If you use an authentication provider, a payment, analytics or AI provider, name it. An app that sends a photo to an external AI service, for example, has to say so explicitly and, most of the time, ask for permission before sending it.

How to delete your data. Apple requires any app with user accounts to offer a way to delete the account from inside the app itself, not just by email. The flow has to be easy to find, not buried in some obscure submenu.

The difference between the policy and the privacy declarations

Beginners often mix up two separate things. The privacy policy is a text hosted on a web page, reachable through a link. The privacy declarations are a form you fill out directly in App Store Connect, in the "App Privacy" section. It lists the data you collect and how it's used, by category, and then shows up on your public listing.

Both have to tell the same story. A declaration saying "no data collected" while your app uses an analytics SDK that collects an identifier is exactly the kind of mismatch a reviewer, or a later audit, can catch. Fill out that form by actually checking what your code does and what your privacy manifest declares, not by ticking whichever box looks easiest.

What about GDPR?

If your app targets users in Europe, GDPR applies on top of Apple's requirements. The CNIL (France's data protection authority) publishes a guide for mobile app developers that lays out the principles: collect only what's necessary, inform clearly, allow access to and deletion of data. Apple's requirements and GDPR overlap a lot, but meeting Apple's rules doesn't automatically mean you meet GDPR if your app processes personal data in the broad sense.

If your app stays simple, with no account and no personal data collected beyond what iOS handles natively, your policy can stay short: say so clearly instead of copying a long, off-topic text.

A real example: rejections under guideline 5.1.1

While publishing my apps, I got an Apple rejection for an online privacy policy that was out of date, and another for a feature button shown before the expected camera permission request. Both fall under guideline 5.1.1 on data collection and storage. The guide on Apple rejections under guideline 2.1 covers another common reason, this time about what the tester can actually do in the app.

The lesson from both cases: the reviewer compares what your policy promises, what your app actually does, and what you declared in the form. A mismatch between those three is enough to block your submission, even if the rest of it is solid.

How to write yours without making things up

For a first app, start from the real list of services you use: authentication, database, payments, analytics, AI. For each one, write down what it receives from your app and why. That list becomes the skeleton of your policy: you don't need a ten-page legal document for an app with a simple account and a subscription.

If your app is built with Expo, the guide on API keys in an Expo app explains where to put calls to third-party services, which also helps you know exactly what data goes through which service when you write your policy.

Once this text and the privacy declarations are ready, they join the rest of your submission before it goes to Apple: listing, screenshots, notes for the tester. The page on publishing an app on the App Store walks through all these steps, in the order App Store Connect asks for them.

Next step: a submission reviewed before you send it

I can't guarantee Apple will accept your app on the first try, and honestly, nobody can. What I can help you do is avoid the avoidable rejections, privacy policy included. To check your submission before sending it, the Apple Review Kit bundles my checklist and Claude Code skills that review your project, your paywall and your listing.

Want a free list first? The free diagnostic sends you my Apple anti-rejection checklist, with the privacy points I check before every submission.

Frequently asked questions

What is a privacy policy for an iOS app?

It's a text hosted on a web page, reachable through a link, that describes what your app really collects. You give Apple its URL in App Store Connect when you create your listing. It's not a generic list copied from somewhere else: it has to match how the app actually behaves.

Is a privacy policy required to publish an iOS app?

Yes, Apple's guidelines require every app to have a privacy policy, whether or not your app has user accounts. Without that page live and accessible, your submission is blocked before a reviewer even looks at it. If your app stays simple, the policy can stay short. Say clearly what you collect, or that you don't collect anything in particular, instead of copying a long, off-topic text.

What should an app's privacy policy include?

Four things come up in most cases: the data you collect, the reason for each piece of data, the third parties involved, and how to delete your data. For collected data, think account, email, user-created content and the advertising identifier if you use one. An app that sends a photo to an external AI service has to say so explicitly.

What's the difference between the privacy policy and the privacy declarations (App Privacy)?

The policy is a text hosted on a web page, reachable through a link. The declarations are a form you fill out in App Store Connect, in the App Privacy section, that lists the data you collect and how it's used, by category, and then shows up on your public listing. Both have to tell the same story: fill out the form by checking what your code actually does.

Do I need to comply with GDPR on top of Apple's rules?

Yes, if your app targets users in Europe: GDPR applies on top of Apple's requirements. The two overlap a lot, but meeting Apple's rules isn't automatically enough if your app processes personal data in the broad sense. The CNIL publishes a guide for mobile app developers: collect only what's necessary, inform clearly, allow access and deletion.

Can Apple reject an app because of its privacy policy?

Yes, a missing policy, or one that doesn't match how the app actually behaves, is an avoidable rejection reason. The reviewer compares what your policy promises, what your app does and what you declared in the form. A mismatch between those three is enough to block your submission. I got a rejection for an online policy that was out of date.