Legal documents to publish on both stores

Both Apple and Google ask for a privacy policy as a link, not a file, because their review systems and your users need to open it at any time. The URL has to be reachable without a login, without an app install, and without a paywall, and it must keep working after you ship. A PDF buried in a Google Drive folder, a link that only resolves inside your app, or a page that returns a 404 will all fail review. In App Store Connect you paste the privacy policy URL into the app's App Privacy section. In Google Play Console you add it under the app content and Data safety areas. The safest setup is a plain, permanent web page on a domain you control, so the link never breaks and you can update the text whenever your data practices change. This is exactly the kind of page Releasely can host for you, published alongside your store listing so you are not chasing a separate website just to satisfy the stores.

These three documents are often lumped together, but they answer different questions and only one is strictly mandatory. A privacy policy explains what personal data you collect, why you collect it, who you share it with, and how users can access or delete it. This is the document both stores require. Terms of service, sometimes called terms and conditions or terms of use, set the rules for using your app: acceptable behavior, payment and refund terms, liability limits, and how disputes are handled. An end user license agreement, or EULA, governs the license you grant users to install and run your software. Apple provides a standard EULA that applies by default, so many apps never write their own, but you can supply a custom one. If your app takes payments, hosts user content, or runs a community, having clear terms of service protects you as much as it informs your users.

• Privacy policy: what data you collect and how you handle it. Mandatory on both stores.
• Terms of service: the rules and legal terms for using your app. Strongly recommended, especially for paid or social apps.
• EULA: the software license granted to the user. Apple supplies a default one; a custom EULA is optional.

Apple's App Privacy details, shown to users as privacy nutrition labels on your App Store page, are a structured questionnaire you complete in App Store Connect. You declare each type of data your app collects, such as contact info, identifiers, usage data, or location, and for each one you say whether it is linked to the user's identity and whether it is used to track them across other companies' apps and sites. Apple then generates the labels that appear before someone downloads your app. The critical rule is accuracy: your answers must match what your app and every third-party SDK inside it actually do. Analytics kits, ad networks, crash reporters, and social login libraries all collect data on your behalf, so you have to account for them too. Getting this wrong is one of the most common reasons an otherwise finished app is rejected or pulled after launch.

Google Play's Data safety form is the Android counterpart to Apple's privacy labels, completed in the Play Console under App content. It asks whether your app collects or shares user data, which categories, the purpose of each, whether data is encrypted in transit, and whether users can request deletion. Google turns your answers into the Data safety section that shoppers see on your Play Store listing. As with Apple, your declaration has to cover everything your code and your bundled SDKs do, and it should line up with your written privacy policy. If Apple's labels and Google's Data safety form tell different stories about the same app, that inconsistency is a red flag for reviewers and for privacy-conscious users. Fill both out from a single, honest inventory of your data flows and keep that inventory updated as you add features.

If your app lets users create an account, both Apple and Google require you to give them a way to delete that account and the associated data. Apple's rule is that apps offering account creation must also let users initiate account deletion from within the app, not just disable or pause it. Google Play requires developers with account-based apps to provide account deletion both inside the app and through a web link, so users who have uninstalled the app can still ask for their data to be removed. In the Play Console you enter that deletion URL in the Data safety form. The practical takeaway is that deletion cannot be a hidden email request. You need a real in-app flow and, for Android, a reachable web page where a user can request removal of their account and data. Planning this early is far easier than retrofitting it under a review deadline.

1. Add an in-app option that lets a signed-in user delete their account and data.
2. For Android, publish a public web URL where users can request account and data deletion without the app installed.
3. Enter that deletion URL in the Google Play Data safety form.
4. Document in your privacy policy exactly what gets deleted, what may be retained for legal reasons, and how long it takes.

GDPR and CCPA are privacy laws that apply based on where your users are, not where you are, so most apps with any international reach fall under at least one. The EU General Data Protection Regulation applies whenever you handle personal data of people in the European Union or the United Kingdom. It expects a lawful basis for collecting data, clear consent for things like analytics and advertising cookies, and honoring user rights to access, correct, and delete their data. California's Consumer Privacy Act, as amended by the CPRA, gives California residents the right to know what you collect, to delete it, and to opt out of the sale or sharing of their personal information. In practice, both laws push you toward the same good habits: collect only what you need, say clearly what you do with it, get consent where required, and make access and deletion easy. A well-written privacy policy and a working deletion flow cover most of what these laws ask of a small app, though a lawyer should confirm your specific obligations.

Before you hit submit on either store, run through the documents and disclosures in one pass so nothing blocks your release at the last minute. This checklist mirrors what reviewers look for and pairs naturally with the rest of your launch prep, like keeping your build and store metadata in sync across versions.

• Privacy policy written, accurate, and hosted at a public URL that opens without a login.
• Privacy policy URL entered in both App Store Connect and Google Play Console.
• Apple App Privacy details completed, covering your own data use and every third-party SDK.
• Google Play Data safety form completed and consistent with your privacy policy and Apple labels.
• Account deletion available in the app, plus a public deletion URL for Android, entered in the Data safety form.
• Terms of service and, if needed, a custom EULA prepared for paid, subscription, or social features.
• GDPR and CCPA obligations reviewed for the regions where your users actually live.

Managing these documents is one piece of a larger release process. If you are comparing how different platforms handle submissions, metadata, and legal hosting, our comparison of app release tools lays out the trade-offs, and our guide to app versioning shows how to keep everything aligned release after release.

Yes. Both the App Store and Google Play require a privacy policy URL for every app, regardless of whether you collect data. If you genuinely collect nothing, your policy can simply state that clearly, but the document still has to exist and be reachable. Remember that bundled SDKs and crash reporters often collect data even when your own code does not, so confirm your app is truly data-free before you claim it.

A generator is a reasonable starting point for a simple app, and many produce a serviceable draft. The risk is that a template may not match what your app actually does, especially your specific SDKs, data sharing, and user regions. Treat generated text as a first draft, edit it to reflect your real data practices, and if you handle sensitive data or operate at scale, have a lawyer review it. An accurate custom policy beats a generic one at review time.

Host it on a stable public web page on a domain or platform you control, so the link never breaks and you can edit it as your app evolves. Avoid file-sharing links, in-app-only pages, and anything behind a login, since reviewers must open the URL freely. Releasely can host your privacy policy and legal pages next to your store listing, which keeps the link permanent and everything in one place. Whatever you choose, verify the URL loads in a private browser window before submitting.

No. Tools that host or help you organize your privacy policy and terms, including Releasely, handle the publishing and store requirements, not the legal substance of your documents. This article and any such tooling offer general guidance only. For questions about your specific obligations under GDPR, CCPA, or other laws, and for wording you can rely on, consult a qualified attorney who can review your product and its data flows.