How to Create a Privacy Policy for Your Mobile App

Google Play requires every app to complete the Data Safety form, and separately requires a public, live privacy policy URL on the store listing (Play Console > Policy and programs > App content > Privacy Policy). If what you declare in the Data Safety form doesn't match your policy text, that mismatch can also trigger review issues.

On Apple's side there are two separate requirements: the 'Privacy Policy URL' field in App Store Connect's App Information section, and the separate App Privacy tab (the privacy nutrition label) where you declare which data categories you collect. Missing or inconsistent answers in either one can trigger a metadata rejection.

The URL is required even if your app collects no data at all — even a short policy that simply states 'we do not collect data' must be published on an accessible web page. A field left blank or marked 'coming soon' gets rejected outright during store review.

The core skeleton should cover: what data types are collected (email, device identifiers, location, usage statistics, etc.), the purpose of collection, whether data is shared with third parties, how long it is retained, and a contact address for questions about the policy.

Every third-party SDK your app uses should be named individually. AdMob collects an advertising ID, IP address, and approximate location for targeting; Firebase Analytics processes usage and engagement data; Crashlytics collects the device model, OS version, and crash logs at the moment of a crash. AdMob's own publisher policy requires this data collection to be explicitly disclosed in your privacy policy — a policy that never mentions these SDKs can cause problems both in Play/App Store review and with AdMob itself.

If your users fall under KVKK (Turkey) or GDPR (EU), your policy is expected to address the data controller's identity, the legal basis for processing, and the user's rights (access, correction, erasure, objection). This is not legal advice; if your app's data handling involves a special case (e.g. an app aimed at children, or health data), consulting a lawyer is recommended.

In Play Console: select your app > Policy and programs > App content > Privacy Policy > enter your policy's address in the URL field and save. This step is independent of the separate Data Safety form — you need to complete both.

In App Store Connect: My Apps > select your app > App Information > enter the address in the Privacy Policy URL field. You also need to answer the App Privacy tab's questions, declaring which data categories your app collects and whether that data is used for user tracking.

It matters that the URL is permanent and public: use a web page that opens directly in a browser rather than a page requiring login, a temporary hosting address, or a file that needs downloading. Store review visits this address automatically.

The most common mistake is an unreachable URL: a 404 error, an address that doesn't resolve, or one that has been temporarily moved. This URL gets tested during review, and a broken link is a direct rejection reason.

Second is a generic boilerplate: text copied from the internet that never mentions any service your app actually uses (AdMob, Firebase, etc.). Such a policy won't match your Data Safety declarations and can be flagged as inconsistent.

Third is a stale policy: if you add a new SDK or analytics tool to your app without updating the policy text, that creates risk both in store review and for KVKK/GDPR compliance. Review your policy every time you ship a release that adds a new data-collection behavior.

1. List every service your app uses: ad SDKs (AdMob, Meta Audience Network), analytics tools (Firebase Analytics), crash reporting (Crashlytics), sign-in providers (like Google Sign-In), and any data collected by your own backend.

2. For each service, note what data it collects and for what purpose; this list forms the basis of both your policy and your Data Safety / App Privacy form answers.

3. Publish the policy at a permanent, public web address, and enter that address separately into both Play Console and App Store Connect.

4. Whenever you add a new service to the app, update the policy and re-check the declarations in your store forms.

Instead of writing all this by hand, Vibeloy's free privacy policy generator produces a policy aligned with KVKK and GDPR terminology in minutes once you enter your app details and the services you use (AdMob, Firebase Analytics, Crashlytics, and similar). With a free account you can copy the full text and publish it on your own site. If you want a permanent, hosted URL to hand to the stores, that is included in the premium plan.