Privacy Policy for iOS Apps

Every app hosted on the Apple App Store must work properly, collect user data responsibly, and have a legally-compliant Privacy Policy. Apple sets strict rules about what your iOS App Privacy Policy must disclose. Your iOS app will be rejected from the App Store unless your Privacy Policy meets Apple's requirements.

This article will help you understand Apple's requirements and how to fulfill them with a legally-compliant Privacy Policy.

Does My iOS App Need a Privacy Policy?

Yes, your iOS app needs a Privacy Policy. Since October 2018, Apple has required all iOS apps to have a Privacy Policy:

Apple now gives this requirement in its App Store Review Guidelines:

All iOS apps must go through the App Store Review Process. Apple will reject your iOS app if you submit it without a compliant Privacy Policy.

Apple also states that every iOS app must comply with local law:

Therefore, you must also comply with the privacy laws that apply in your region, and any other regions in which your app is available.

Do I Need a Privacy Policy If My App Doesn't Collect User Data?

Even if your iOS app doesn't collect any user data, you still need a Privacy Policy. In your Privacy Policy, you can explain that your app doesn't access any user data, or that it only does so locally (i.e., any data that the app processes remains on the device).

Here's how iPad photo editing app Pixelmator handles this:

Pixelmator provides a clear and reassuring explanation of its practices to its users. This is much more professional than simply not publishing a Privacy Policy. It also shows that you're aware of privacy laws and are complying rather than just hiding your privacy practices.

Apple's Privacy Policy Requirements

Apple's App Store Review Guidelines tell developers what an iOS Privacy Policy should contain:

Let's break that down. To comply with this section of the App Store Review Guidelines, your Privacy Policy must:

• Disclose what user data you collect
• Explain how you collect user data
• Explain you use user data
• Confirm that you only share user data with companies that have good privacy practices
• Disclose how long you store user data
• Explain how your users can revoke their consent to your use of their data
• Explain how your users can request you delete their data

We're going to explain each of these obligations and give examples so you can understand exactly what Apple requires.

What Data Your App Collects

Apple's first Privacy Policy requirement is that the policy must "identify what data, if any, the app/service collects."

Note that Apple uses the term "data." Due to the context, you can reasonably conclude that "data" includes "personal information" and you should apply a very broad definition of this term.

Bear in mind that Apple doesn't allow iOS apps to collect unnecessary or excess personal information. Your app should collect user data sparingly. This is stated in this section of the App Store Review Guidelines on "data minimization":

Here's how iOS app Drafts discloses the types of data it collects:

Drafts breaks down the types of data it collects into categories to make it easier for users to understand.

Note that even if your app doesn't transmit user data from the device, you should still disclose any permissions that your app requests.

How Your App Collects Data

Your Privacy Policy must explain how your iOS app collects user data. Depending on what your app does, it might collect user data by requesting it (e.g., names, usernames, email addresses) or by collecting it automatically (e.g., device data, usage data, location data).

This might be quite a technical section of your Privacy Policy. You should try to explain your data collection practices in language that your users will understand.

Here's how Chemdata explains how it collects the data its users provide directly:

After this section, Chemdata describes how its app collects user data automatically:

How Your App Uses Data

Your Privacy Policy must explain how your app uses any data it collects. And, to reiterate: You must always have a good reason to collect user data.

Here's how Cultured Code explains its uses for the user data it collects:

Keep in mind that Cultured Code's Privacy Policy applies over all of its products, plus its mailing list and website. Your Privacy Policy should also cover any other means by which you collect personal information.

Information About Sharing Data With Third Parties

Apple places strict rules on how developers share user data with third parties. Your Privacy Policy must confirm that any third parties will take equally good care of your users' data as you do.

Your app must be compliant with Apple's privacy standards. Therefore, any third party your app shares user data with must also be compliant with Apple's privacy standards.

Apple gives some examples of the types of companies it considers third parties:

• Analytics tools providers
• Advertising networks
• Third-party software development kit (SDK) providers
• Parent companies, subsidiaries, or other related entities

Sports news app Võrumaa Nutimängud is very specific. Its Privacy Policy identifies the specific third parties with whom it shares user data:

How Your Users Can Revoke Consent

Apple states that your Privacy Policy must "describe how a user can revoke consent." Apple's App Store Review Guidelines states that you must only collect user data with consent. If a user revokes consent, you must stop collecting their data.

iOS apps will often ask for consent by using the permission request mechanisms provided in iOS SDKs. You can provide a method for your users to revoke this sort of consent within your app settings. Your Privacy Policy should explain how users can do this.

Here's how Võrumaa Nutimängud explains how its users can revoke consent:

In any situation where you have asked for a user's consent, they must be able to revoke it, and your Privacy Policy should explain how.

Your Data Retention Policy

Apple states that your Privacy Policy must explain your "data retention/deletion policies." You must not keep user data longer than you need it. This means thinking carefully about how long you need to store user data and, if necessary, creating a retention schedule.

Your Privacy Policy should explain your data retention practices. Here's how Easybrain does this:

Be as specific as possible here with your timeframe, and make sure you're disclosing your actual practices.

How Your Users Can Delete Their Data

Apple states that your Privacy Policy must "describe how a user can [...] request deletion of the user's data." This implies that you must offer users a way to delete any user data you hold on them. Apple doesn't explicitly state that you need to do this in its App Store Review Guidelines.

However, Apple does require that you give users control over their data. Apple states this in a document called "Protecting the User's Privacy:"

Enabling your users to request the deletion of their personal information is also a legal requirement under several privacy laws, including the GDPR and the CCPA.

Your app could provide the user with the ability to delete their data. Or you can invite your users to send you an email to make a deletion request.

Here's how the alarm clock app EY presents this type of information in its Privacy Statement:

After you meet Apple's requirements, there are more you'll need to be familiar with.

Legal Requirements

Along with Apple's Privacy Policy requirements, you need to obey the law. Privacy and data protection laws strictly regulate how you handle your users' personal information, and determine what you need to disclose in your Privacy Policy.

The law will give different Privacy Policy requirements depending on where you and your users are based.

Note: You must obey the privacy law of the regions where your users are based and not just where you are based.

Where these or any other privacy laws apply to you, you must ensure that your Privacy Policy is compliant with them.

How to Add a Privacy Policy URL in Apple App Store Connect

You can download these instructions as PDF file.

1. Log in to your Apple App Store Connect account.

2. Select your app:

   

3. Under the General section, select App Privacy:

   

4. Next to the Privacy Policy title, click Edit:

   

5. In the modal that opens you'll see a field to enter a Privacy Policy URL. Optionally, there is a User Privacy Choices URL field:

   

   If you do not have a Privacy Policy, you can use our App Privacy Policy Generator and create it within minutes. TermsFeed will host your Privacy Policy URL for free.

6. Once you have the Privacy Policy created by TermsFeed, click Copy from the Link to your Privacy Policy section to copy the URL:

   

7. Paste the Privacy Policy URL in the field box:

   

8. Click Save:

   

9. You're done!

   

Publishing Your iOS App Privacy Policy

Once you've hosted your Privacy Policy online, Apple requires you to:

• Provide a link to your Privacy Policy with your app information when submitting your app on App Store Connect, and
• Provide a way for your users to access your Privacy Policy from within your iOS app

The best place to host your Privacy Policy is your company's website if you have one. If you by chance don't have a website, you can set up a simple WordPress site, or even a publically-available Google Doc.

Submitting Your Privacy Policy to Apple

Apple states that "all apps must include a link to their privacy policy in the App Store Connect metadata field."

To get your app hosted in the App Store, you first need to add it to your App Store Connect account. When you add an app to your App Store Connect account, you must provide Apple with certain app information, including the URL of your Privacy Policy.

If you're submitting an app bundle (up to ten apps sold together at a reduced price), you should submit your Privacy Policy along with your app bundle's primary app. You don't need to submit a Privacy Policy with each bundled app you submit.

Apple explains this in its App Store Connect Help for bundles:

Once your iOS app is approved, your Privacy Policy will show alongside other information about your app in the App Store. Here's how it looks:

This is important because it gives potential users the opportunity to check out your privacy practices before deciding to download your app. If the link wasn't available before downloading and you collect any information during the download process or before the Privacy Policy was available within the app, you can see how this would violate privacy rights of your users.

Providing Access to Your Privacy Policy Within Your App

Apple requires that you provide users access to your Privacy Policy "within the app in an easily accessible manner." Most apps provide Privacy Policy access via a "Settings," Legal," or "About" menu, or something similar. Here's an example of how the Fitbit app displays its Privacy Policy.

Users must click on the main Account icon to open the Account menu. From here, there's a Legal menu:

Within the Legal menu, users can find the Privacy Policy within the list of important legal information:

When a user clicks on the Privacy Policy link, a mobile browser opens up and takes the user to a mobile version of the company's Privacy Policy:

This is a good example of how to make a Privacy Policy accessible within an app.

You could also link to your Privacy Policy directly within your app's "Settings" menu, or even as an item within your app's side or drop-down menu, like WeatherBug does here:

You need to make sure your users can access your Privacy Policy at any time, and keeping a static link somewhere in your app accomplishes this.

Other Places to Link to Your Privacy Policy Within Your App

Although Apple doesn't require it, you also should link to your Privacy Policy whenever you ask your users to provide personal information. Some such areas include when users sign up for an acccount with your app, or on a checkout page for an ecommerce app.

For example, here's how SoundHound directs users to its Privacy Policy when signing up for an account:

Here's how Amazon links users to its Privacy Policy when confirming a purchase:

Take every reasonable opportunity to appear transparent in your privacy practices by making your Privacy Policy link available often.

Summary of Your iOS App Privacy Policy

To meet Apple's requirements, your iOS app Privacy Policy must disclose:

• What user data your app collects
• How you collect user data
• How you use user data
• Whether you only share user data with companies that have good privacy practices
• How long you retain user data
• How your users can revoke consent
• How your users can request you delete their user data

Your iOS app Privacy Policy must also be legally compliant.

You must:

• Submit your Privacy Policy to Apple within your App Store Connect metadata
• Provide a link to your Privacy Policy within your iOS app