Publishing a policy for the Apple App Store

What guideline 5.1.1(i) requires

All apps must include a link to their privacy policy in the App Store Connect metadata field and within the app. The policy must clearly and explicitly identify what data, if any, the app or service collects, how it collects that data, and all uses of that data. It must confirm that any third party with whom the app shares user data, such as analytics tools, advertising networks, third-party SDKs, and affiliates, will provide the same or equal protection of user data as stated in the policy. It must explain data retention and deletion policies and describe how a user can revoke consent or request deletion of their data.

App Privacy details

App Store Connect asks you to declare data types collected, grouped into categories such as Contact Info, Health and Fitness, Financial Info, Location, User Content, Identifiers, Usage Data, and Diagnostics, and whether each is linked to the user's identity or used for tracking. A publicly accessible privacy policy URL is required; a privacy choices URL is optional. The declaration must include the practices of third-party partners whose code you integrate and must be kept accurate and current.

Account deletion in the app

Guideline 5.1.1(v) states that if your app supports account creation, you must also offer account deletion within the app. Apple's guidance explains that deletion should remove the account and associated personal data, subject to legal retention, and that apps using Sign in with Apple should revoke tokens. Describe the deletion route, timing, and any retained records in the policy.

Tracking and App Tracking Transparency

Apple defines tracking as linking user or device data collected from your app with data from other companies' apps, websites, or offline properties for targeted advertising or measurement, or sharing it with data brokers. Tracking requires permission through the App Tracking Transparency framework. If you track, the policy should explain it and the choice users have; if you do not, do not describe advertising identifiers as collected.

Third-party AI and data sharing

Guideline 5.1.2(i) requires apps to clearly disclose where personal data will be shared with third parties, including with third-party AI, and to obtain explicit permission before doing so. If your app sends user content to an external model provider, name the provider in the policy and add an in-app permission step before the first transfer.

Permissions and purpose strings

Each permission request needs a purpose string that explains why the app needs access. The policy should describe the same purposes. Requesting access that the policy does not mention, or describing a purpose in the policy that the purpose string contradicts, is a common review problem.

SDK defaults

Analytics, crash reporting, authentication, advertising, attribution, and social SDKs may collect data by default beyond what your interface suggests. Apple requires privacy manifests for commonly used third-party SDKs; read each SDK's manifest and documentation and reflect the collected data types in both App Privacy details and the policy.

Keeping labels and policy in sync

Treat the App Privacy answers, the privacy policy, the privacy manifest files in your build, and your permission purpose strings as one set of documents. When a release adds an SDK, a new data type, a sign-in provider, or an AI feature, update all four before submission. Apple allows the App Privacy details to be edited at any time, but the answers must describe the app version users can download, and inaccurate labels can lead to rejection or removal.

Kids Category and children

Apps in the Kids Category face stricter rules on third-party analytics and advertising and on sending data to third parties. Outside that category, apps directed to children under 13 in the United States must still comply with COPPA. If your app is for adults, say so in the policy and set the age rating accordingly.

Generating an App Store-ready policy

Select the application platform, then answer the account, provider, payment, AI, and deletion questions. The generated policy describes the confirmed data and recipients, retention approach, and request and deletion methods, and a hosted version gives you a stable URL for App Store Connect and your in-app settings screen.

Common questions