Privacy policy for an Android app: what Google Play requires

Every app on Google Play needs a privacy policy. Google's User Data policy says it plainly: "Apps that do not access any personal and sensitive user data must still submit a privacy policy" (Play Console Help).

You'll need it before your closed test, not after. The Data safety form requires a privacy policy, and that form applies to apps on closed testing tracks too (Play Console Help).

This guide covers what the policy must contain, where to host it, and the two places to link it. Google also recommends asking a legal representative what your situation requires (Play Console Help). This page tells you what Google checks. It isn't legal advice.

What the policy must contain

Google's User Data policy lists the minimum. The policy, "together with any in-app disclosures", must comprehensively disclose how your app accesses, collects, uses and shares user data, and must include (Play Console Help):

1. Developer information and a privacy point of contact, or a way to send privacy questions.
2. The types of personal and sensitive user data your app accesses, collects, uses and shares, and every party that data is shared with.
3. Secure data handling procedures for that data.
4. Your data retention and deletion policy.
5. Clear labeling as a privacy policy, for example "privacy policy" in the title.

Two more requirements from the same policy:

• Name the right entity. The developer or company named on your Google Play store listing must appear in the policy, or the app must be named in it.
• Don't stop at the Data safety form. The policy must cover your data handling "not limited by the data disclosed in the Data safety section".

Count your SDKs in the second point. Data that an analytics, crash reporting or ads SDK sends off the device is part of what your app collects (Play Console Help).

If your app offers account creation, the retention part matters. Google requires you to delete the user data tied to an account when the user asks. If you need to keep some data for security, fraud prevention or legal reasons, you must tell users, "for example, within your privacy policy" (Play Console Help).

Where to host it

Google lists the requirements to avoid review delays (Play Console Help):

• An active, publicly accessible URL starting with http:// or https://, with a valid SSL certificate.
• Accessible worldwide, without geographical restrictions, geofencing or a login.
• A standard, non-editable web page, not a PDF or downloadable file.
• Specific to your app, and comprehensive about how it collects, uses and shares user data, including the types of parties it's shared with.

A plain page on your own website works. Before you submit, open the URL in a private window, from your phone, signed out.

Link 1: Play Console

1. Sign in to Play Console and select your app.
2. Go to the App content page (Monitor and improve > Policy and programs > App content).
3. Under "Privacy Policy", click Start declaration (or Manage if you added one before).
4. Enter the URL and save.

These are Google's steps (Play Console Help).

Link 2: inside the app

Google requires "a privacy policy link or text within the app itself" (Play Console Help). The Play Console link alone isn't enough.

Put it where users look for it: a settings, account or "About" screen. If your app has accounts, the screen that offers account deletion is a natural place too. Google requires that in-app deletion path to be easy to find, for example in the account settings (Play Console Help).

The policy doesn't replace in-app disclosures

When your app accesses personal and sensitive data in a way users might not expect, such as in the background, Google requires a prominent disclosure inside the app, shown during normal use, right before the permission request or consent. That disclosure "cannot only be placed in a privacy policy or terms of service" (Play Console Help).

Google suggests this format: "[This app] collects/transmits/syncs/stores [type of data] to enable ["feature"], [in what scenario]."

Keep it in sync with the Data safety form

Google's User Data policy says the Data safety section "must be consistent with the disclosures made in the app's privacy policy", and asks you to update both as your data handling changes (Play Console Help). If you add an SDK during your 14-day closed test, update the policy and the Data safety form in the same release.

What Google flags most often

Its "Don't" list for privacy policies (Play Console Help):

• Leaving out any user or device data handling.
• Leaving out the app or company identification.
• Presenting account freezing as a substitute for deletion.
• Adding hidden steps or obstacles to account deletion.

And from the hosting rules: a PDF, a page behind a login, or a page blocked in some countries.

A generic template that never names your app and lists data it doesn't collect fails the first two points. Write the policy from your real SDK list.

For the rest of the setup, see how to set up closed testing.