Privacy policy for an app that collects no data: still required

Why it matters

Without the link you cannot finish a store submission. Apple lists the privacy policy address as required in its app privacy details, and Google needs a privacy policy to complete the Data safety form, which every published app fills in, including apps that collect nothing.

A short policy is fine when your app really collects nothing, but it still has to be accurate. Apple asks that the policy name the data the app collects, if any, along with the way it's collected and every use of it. It also asks the policy to explain how long data is kept and how someone can ask for it to be deleted. Google adds a privacy contact, secure handling, and the app or developer name on the policy itself. Google also wants it on an active, public web address that isn't a PDF and isn't limited to some regions.

The catch is the word collect. Apple counts data as collected when it leaves the device in a way that lets you or a partner read it later, and data that stays on the device is not collected. Apple's answers have to include the data your analytics, crash reporting, sign-in and ad tools collect, so an app that uses any of them can collect data even when your own code never does.

Who it applies to

It applies to every app on the App Store and Google Play, whatever the app does. A calculator, a game with no accounts and an offline notes app each need a privacy policy link before they can be published.

Apple and Google both expect you to keep the policy and your privacy answers up to date when the app changes, such as when you add an analytics or crash reporting tool.