PrivacyPage

Apple App Store · Platform guide

Privacy policy for iOS apps

Every iOS app on the App Store needs a public privacy policy URL, entered in App Store Connect and linked inside the app (App Review Guideline 5.1.1). The policy must match your App Privacy answers in App Store Connect and the data your SDKs collect, including anything declared in a PrivacyInfo.xcprivacy privacy manifest.

§ 1

What Apple App Store requires

App Review Guideline 5.1.1(i) — Privacy Policies

“All apps must include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner.”

Source: developer.apple.com verified 2026-10-29

1.1App Privacy answers (the “nutrition label”) must cover third-party code. In App Store Connect you answer what data your app collects, whether it is linked to the user, and whether it is used for tracking. Apple says you must include “the practices of third-party partners whose code you integrate into your app”, and the answers are required to submit new apps and updates. Your privacy policy should describe the same data — a policy that says “we collect nothing” next to a label listing Analytics and Identifiers is a mismatch reviewers and users can see. App Store Connect’s help repeats it: “You must include information about your app's privacy practices and those of third-party partners whose code you integrate into your app.” Source: developer.apple.com
1.2Privacy policy URL is a required field. App Store Connect: “A privacy policy URL is required for all apps, while a user privacy choices URL is optional.” Changes to the URL are not instant: “Any changes to the URLs releases with your next app version.” Source: developer.apple.com
1.3Privacy manifest (PrivacyInfo.xcprivacy). Apps and third-party SDKs can ship a privacy manifest that records the types of data they collect and the required-reason APIs they use. Certain SDKs on Apple’s list must include a signed manifest. Treat the manifests in your dependencies as an input to both your App Privacy answers and your policy. Source: developer.apple.com
1.4Required-reason APIs. Some APIs can be misused for fingerprinting, so you must declare an approved reason for each category you (or an SDK) use. Apple: “Starting May 1, 2024, apps that don’t describe their use of required reason API in their privacy manifest file aren’t accepted by App Store Connect.” Source: developer.apple.com
§ 2

What common SDKs collect

SDK / APIData it collectsSource
Firebase Crashlytics
  • Crashlytics installation UUIDs
  • Firebase installation IDs
  • Crash traces
Source: firebase.google.com
Firebase Cloud Messaging
  • Firebase installation IDs (to route push messages to devices)
Source: firebase.google.com
Google Mobile Ads SDK (AdMob)
  • IP address
  • User product interactions
  • Diagnostic information
  • Device and account identifiers

Google publishes this list for its Android SDK's Play disclosure; check Google's iOS documentation and the SDK's privacy manifest for the iOS build.

Source: developers.google.com

Everything in this table must appear in your policy if the SDK ships in your build.

§ 3

Where to put the URL

  1. 3.1Answer the privacy questions: App Store Connect → Apps → your app → App Privacy (sidebar) → Get Started. Say whether you or your third-party partners collect data, select every data type (including what your SDKs collect), answer the questions for each, then click Publish.
  2. 3.2Add the policy URL: App Privacy (sidebar) → Edit next to Privacy Policy → enter the privacy policy URL → Save. It is required for all apps.
  3. 3.3URL changes release with your next app version, so update it before you submit that version.
  4. 3.4Inside the app: a Settings or About link that opens the same URL (Guideline 5.1.1(i)).

Source: developer.apple.com

§ 4

Sample clause

§ 4.1 · Crash and diagnostic data

When the app crashes, we use Firebase Crashlytics (Google) to receive a crash trace and an installation identifier so we can find and fix the bug. This data is not used to track you across other companies’ apps or websites. It is listed under “Diagnostics” in our App Store privacy details.

Illustrative wording. Your generated policy is written from your own answers.
§ 5

Questions

Do I need a privacy policy if my iOS app collects no data?
Yes. Guideline 5.1.1(i) says all apps must link a privacy policy, and App Store Connect says a privacy policy URL is required for all apps. A short policy that truthfully says what the app does not collect is fine.
Does the policy have to match my App Privacy answers?
It should. Both describe the same data practices, including third-party SDKs. If they disagree, one of them is wrong — fix the one that does not reflect the app.
Is the privacy manifest the same as the privacy policy?
No. PrivacyInfo.xcprivacy is a file inside your app bundle for Apple’s tooling. The privacy policy is a public web page for people. Both should describe the same data.