How to get a privacy policy URL for your app

If you already maintain a website, create a dedicated Privacy Policy page there. Keeping the page on a domain you control makes it easier to preserve the address through product updates. You need the policy text first; hosting an empty page or linking a homepage will not give reviewers or users the information they need.

How to do it well:

1. Create a dedicated page with a clear heading such as Privacy Policy.
2. Paste the full text as HTML, not as an embedded PDF or image.
3. Make sure no cookie wall, login, or regional block hides the content.
4. Link it from your site footer and from your app's settings screen.
5. Use the exact same URL in every store listing.

Even a one-page landing site for your app is enough. Many website builders let you add a page in minutes, and our guide on privacy policies for Wix, Squarespace, and Webflow covers the steps on those platforms. Once your site has more pages, read where to put a privacy policy link so visitors can always find it.

The main risk is neglect: an expired domain or a site redesign that changes the path will break the link stores rely on.

Developers without a website often reach for free hosting. Some options work; some cause review problems.

• Static hosting such as GitHub Pages: works when it serves a real HTML page. Avoid linking to the raw file view of a repository, and remember the URL can change if you rename the repository or account.
• Google Docs, Notion, and similar tools: convenient, but riskier. Sharing settings can change, pages may prompt visitors to sign in or rely on heavy scripts, and a document shared with edit access is not non-editable, which Google Play requires.
• PDF files on any host: Google Play explicitly rules them out.
• Link-in-bio or URL shortener services: an extra redirect is one more thing that can break, and some reviewers will not follow it.

If you use any of these, open the link in a private browser window on a phone, signed out of every account, and confirm the full policy text appears as a normal page. Then check again before each release, because free services change their sharing and rendering behavior over time.

Some privacy policy generators can host your policy for you, which is the quickest route if you have no website. With Legal Policy Generator, the questionnaire, full preview, and simple HTML and PDF download are free with no account. Optional public hosting adds $0.99 once and gives you a public web page you can use as your privacy policy URL in Play Console, App Store Connect, or any other platform form.

If you need advanced regional or optional modules, such as GDPR, UK, California, COPPA, or the Brazil, Canada, Australia, and New Zealand modules, those cost $5, so an advanced policy with hosting totals $5.99. A $5 monthly subscription is also available and includes hosting while it is active.

Whatever service you choose, check a few things before relying on it:

• the page loads without login and is not region-blocked
• the content is your policy, labeled as a privacy policy, with your name and contact details
• you understand what happens to the page if you stop paying or close your account

Start from the app privacy policy generator if your URL is for an app.

A privacy policy URL is simply the web address where your privacy policy lives, for example a page at the end of your domain called privacy. Platforms ask for it because they want users and reviewers to be able to read your data practices before installing or connecting anything.

You will be asked for one in more places than you might expect:

• Google Play Console and App Store Connect
• the Chrome Web Store for browser extensions
• Google's OAuth consent screen and verification
• Meta app settings for Facebook Login and other platform features
• OpenAI's GPT builder for public actions, and the Discord Developer Portal for bots

The page itself has to contain an actual privacy policy that matches your product. A link to your homepage, a “coming soon” page, or someone else's policy will not pass review. If you need one for a browser extension or Google sign-in, the Chrome extension privacy policy guide and the Google OAuth verification guide explain those platform-specific checks.

Google Play's User Data policy is the most specific of the major stores, so it is a good standard to build to. It says you must:

• post the link in the designated field in Play Console
• include a privacy policy link or text within the app itself
• make the policy available on an active, publicly accessible and non-geofenced URL, with no PDFs
• make sure the policy is non-editable
• clearly label it as a privacy policy

The content requirements apply too: developer information and a privacy point of contact, the types of data accessed, collected, used, and shared, secure handling, and your retention and deletion policy. Google also asks that the entity named in the store listing appears in the policy, or that the app is named in it.

In practice, “non-geofenced” means the page must not be blocked in some countries, and “non-editable” means you should not link a shared document that visitors can change. The Google Play privacy policy generator page covers the matching Data safety and account deletion steps.

Apple's App Review Guidelines say all apps must include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner. On Apple's App Privacy details page, the Privacy Policy URL is marked as required and described as a link to your publicly accessible privacy policy, while a separate Privacy Choices URL, where users can manage their data, is optional.

Apple does not publish a list of banned formats the way Google does, but the safe approach is the same: a normal HTML page over HTTPS that loads on an iPhone without signing in. A reviewer who hits a login wall, a broken link, or a document download is likely to flag it.

Guideline 5.1.1(i) also sets out what the page must say: what data you collect, how, all uses, how third parties protect it, retention and deletion, and how users can revoke consent or request deletion. The Apple App Store privacy policy generator page explains how the policy lines up with your App Privacy answers.

Store reviewers open your link from their own devices and locations. Recreate that before they do:

1. Open the URL in a private or incognito window, signed out of everything.
2. Open it on a phone over mobile data, not just your office Wi-Fi.
3. Try it through a VPN or ask a friend in another country, to rule out geofencing.
4. Confirm it loads as a page, not a download, and that the text is readable without zooming.
5. Check that it uses HTTPS and does not redirect to your homepage.
6. Look for the heading Privacy Policy, your developer or company name, the app name, and contact details.
7. Compare the content with your Data safety and App Privacy answers.

If any step fails, fix it before submitting; a rejected review costs more time than the test. Keep a dated copy of the version you submitted, so you can show what the policy said at a given time if a user or regulator asks. Our guide on how to make a privacy policy for an app covers what the content itself should include.

Both stores want the policy reachable from inside the app as well as from the listing. Google Play accepts a link or the policy text within the app; Apple asks for it within the app in an easily accessible manner.

Good places for the in-app link:

• a Settings, About, or Legal screen that is reachable without an account
• the sign-up or onboarding screen
• the screen where you explain a sensitive permission before requesting it

Open the link in the system browser or an in-app browser view so users see the same page as the store listing. Avoid bundling a separate offline copy that can drift out of date.

One caution: linking the policy does not replace in-context notices. Google's prominent disclosure rules require an in-app disclosure during normal use when you collect personal and sensitive data in ways users might not expect, and they say it cannot only be placed in a privacy policy. Use the policy for the full picture and short in-app explanations for the moments that matter.

The URL you submit today will be printed in store listings, OAuth screens, and partner forms for years. Treat it like infrastructure.

• Never change the path casually. If you must move the page, set up a permanent redirect and update every platform field.
• Renew your domain and keep billing details current on any hosting service.
• Update the content, not the link. When your data practices change, revise the policy at the same address and change the effective date.
• Keep previous versions with dates, in case you need to show what users agreed to.
• Check the link quarterly and before each release.

Most stores do not tell you when a privacy policy link breaks; you find out during your next review or from an enforcement email. A small calendar reminder is cheaper. For a sensible review rhythm, see how often you should update your privacy policy.