Privacy policy for iOS: what Apple expects
The privacy policy requirements for shipping on the App Store, where the URL goes, and what gets a submission rejected.
Where the URL goes
In App Store Connect, under App Information, there is a Privacy Policy URL field. It is required before you can submit. Guideline 5.1.1 asks for the same link inside the app as well, somewhere easy to reach, and both have to work without a login and keep working, because they are checked again on updates.
What gets a submission rejected
- A privacy policy URL that 404s, redirects to a homepage, or sits behind a login.
- A policy that does not mention a permission the app asks for, most often the microphone, the camera or location.
- Privacy labels in App Store Connect that say less than the policy does.
- An account you can create in the app but not delete in the app.
Keeping it true after launch
A legal page stops being true the moment the product moves past it, usually by adding a payment provider, an analytics SDK or a sign-in. No store re-checks your pages against your build, so the drift is yours to notice.
- Re-read it whenever you add a dependency that sees user data.
- Re-open the Apple console after any change to what the app collects: the listing and the policy have to agree.
- Keep the URL stable. Changing where a policy lives breaks every listing that points at it.
Common questions
Can I use the same policy for both stores?
Yes, one policy can serve both, as long as it covers everything both apps do. What cannot be shared is the store metadata: labels and data safety answers are entered separately and both have to agree with the policy.
Does the URL have to be on my own domain?
No. It has to be public, stable and reachable. A hosted page is fine, and often more stable than a page on a domain that lapses.