How to prepare privacy docs for App Store review

---

App Store privacy nutrition labels

Both Apple and Google ask you to declare the data your app collects and how it is used in a "privacy nutrition label." Reviewers compare that label to your app's actual behavior and your privacy policy. A mismatch is a common rejection reason.

Align labels with your policy

The label, the policy, and the code must agree. If the label says "no data linked to you" but an SDK sends an advertising ID, you will be flagged. Generate the policy from what you actually collect, then set the label to match — not the other way around.

List trackers accurately

Every SDK that receives data is a tracker. Inventory them (analytics, crash, ads, attribution) and disclose each. Under-applying "we don't track you" while shipping three trackers is the fastest way to a rejection and a trust hit.

Host a public URL

App stores require a publicly reachable privacy policy URL — not a local file, not a login-gated page. Keep it stable so the link in your store listing never 404s.

Update when SDKs change

Adding a analytics SDK or switching a payment provider changes what you collect. Re-run the policy and re-set the label on every meaningful dependency change. A generator like PolicyDeck makes the re-generation fast, but the accuracy still depends on honest inputs.

Authoritative references

Apple App Store Review Guidelines (Privacy): https://developer.apple.com/app-store/review/guidelines/
Google Play Policy (User Data): https://play.google.com/about/privacy-security/
GDPR Art. 12–14: https://gdpr-info.eu/art-12-gdpr/

FAQ

Why was my app rejected for privacy?

Usually a mismatch — the nutrition label or policy contradicts what the app/SDKs actually do. Align label, policy, and code before resubmitting.

Does the privacy policy URL have to be public?

Yes. Stores require a reachable public URL, not a local or login-gated page. Keep it stable so it never 404s.

Do I need to update docs when I add an SDK?

Yes. New SDKs change what you collect; re-run the policy and re-set the label on every meaningful dependency change.

Can a generator replace my lawyer?

No. PolicyDeck generates drafts; counsel should review, especially for EU/UK/US regulated markets.

Is a generated doc a guarantee of approval or compliance?

No. A generated document is a template and a starting point. Approval and compliance depend on accurate disclosures and counsel review.

## Disclaimer

Disclaimer (template, not legal advice): PolicyDeck generates plain-English legal document templates (privacy policy, terms, EULA, cookie policy) from your answers. It is not a substitute for a qualified attorney, and a generated document is a starting point, not a guarantee that your app meets GDPR, CCPA, or any other regulation. Have counsel review before relying on a document, especially for high-risk data or regulated markets.

Get an App Store-ready privacy policy that matches your labels — try PolicyDeck — try PolicyDeck.