Privacy policy for Android: what Google expects
The privacy policy requirements for shipping on Google Play, where the URL goes, and what gets a submission rejected.
Where the URL goes
In the Play Console, under Policy and then App content, there is a privacy policy field. It is required, and the same URL is checked against your Data safety answers.
What gets a submission rejected
- A deletion route that exists only inside the app, when Play wants one on the open web.
- Data safety answers that contradict the policy.
- A policy that never names the developer.
- A link that works today and expires with a free hosting trial.
Keeping it true after launch
A legal page stops being true the moment the product moves past it, usually by adding a payment provider, an analytics SDK or a sign-in. No store re-checks your pages against your build, so the drift is yours to notice.
- Re-read it whenever you add a dependency that sees user data.
- Re-open the Google console after any change to what the app collects: the listing and the policy have to agree.
- Keep the URL stable. Changing where a policy lives breaks every listing that points at it.
Common questions
Can I use the same policy for both stores?
Yes, one policy can serve both, as long as it covers everything both apps do. What cannot be shared is the store metadata: labels and data safety answers are entered separately and both have to agree with the policy.
Does the URL have to be on my own domain?
No. It has to be public, stable and reachable. A hosted page is fine, and often more stable than a page on a domain that lapses.