A privacy policy is mandatory for every app on Google Play, whether or not it collects data, and its absence or inadequacy is one of the fastest rejections. For a website-based app you almost certainly have a policy for the website already; this guide is about making it satisfy Play without writing a second one.
Google's requirements
- Linked in two places: the store listing's privacy policy field, and inside the app (the builder's About screen shows the link).
- A live, publicly accessible URL — not a PDF download, not behind login, not a Google Doc that might be deleted. On your own domain is best; a page on your website builder is fine.
- Names the developer (the entity in your Play account) and gives a working contact.
- Comprehensively discloses how the app accesses, collects, uses and shares user data — including data handled by third-party libraries and services — and covers sensitive data explicitly if any.
- Consistent with the Data safety form and with what the app actually does.
- Not a placeholder. A generator template with "[Company Name]" still in it is a rejection.
One policy for site and app
Add a short section to your existing website policy — or a paragraph at the top — that says the same policy governs the Android app, and then make sure every app-specific data flow is covered: push notifications, the analytics that run inside the app, ads shown in the app, and any native permissions. Reviewers look for the word "app" or the app's name in the document; a policy that only ever says "this website" reads as not applying.
A structure that passes
- Who we are. Legal name (matching the developer account), country, contact email. "This policy covers our website at … and our Android app [App Name] on Google Play."
- What we collect and why. One bullet per data flow, in plain language, each with the purpose:
- Usage data via Google Analytics (pages viewed, device type) — to understand what is used.
- A push notification token via OneSignal, if you enable notifications — to send you notifications.
- Name, email and address when you place an order — to fulfil it; payment card details are handled by [gateway] and never reach us.
- Your name and message when you contact us — to reply.
- Advertising identifiers via Google AdSense/AdMob — to show and measure ads.
- Who receives it. Name the processors: Google (Analytics, AdSense/AdMob), OneSignal, your hosting provider, your payment gateway, your email tool. Link their policies.
- Legal basis (if you have EU/UK users): consent for analytics and ads where a banner asks; contract for orders; legitimate interest for security.
- Retention. How long each category is kept, in general terms.
- Your rights and how to exercise them. Access, correction, deletion, objection. "Email … to request deletion of your data; if you have an account, you can also delete it at …".
- Children. State the intended audience. If not for children: "Our app is not directed at children under 13 and we do not knowingly collect their data."
- Permissions the app requests, and why (notifications; storage for downloads if enabled). Keep it accurate to the build.
- Changes. How updates are announced; the effective date at the top.
- Contact. The same email as the developer account's public email.
Account deletion, specifically
If users can create an account on your site, Play requires an in-app deletion path and a web URL where users can request deletion without the app. Your policy should link that URL, and the Data safety form asks for it separately. A settings page with "Delete my account" satisfies both when it is reachable inside the app.
Common failures
- Policy says "we collect no data" while the site runs analytics — rejection under User Data.
- Policy URL returns a redirect chain, a cookie wall or a 404 after a site redesign — the app is removed until fixed. Keep the URL stable forever.
- Policy for a different product (copied from another business) with their name left in.
- Policy hosted only inside the app, not at a public URL.
Generators
Privacy policy generators (including those built into Shopify, Wix and Squarespace) produce acceptable baselines. Edit them to add the app, push notifications and the specific third parties you use; remove sections about data you don't collect. A reviewer can tell a tailored policy from a generic one, and so can a user.