Privacy policy for an Android app: what Google Play expects

Every app on Google Play needs a privacy policy, even one that collects no personal data. It must sit on an active, public web page (not a PDF), describe what data your app handles and how, and be linked both in Play Console and inside the app. You'll need it before your closed test can start, because app setup has to be complete first.

Here is what Google asks for, in its own words, and how to get it right the first time.

Do you really need one?

Yes. Google's User Data policy says: "Apps that do not access any personal and sensitive user data must still submit a privacy policy."

The Data safety form, which is required for apps on closed, open or production tracks, also asks for a privacy policy link. So a new app can't reach closed testing without one.

Where it has to appear

The User Data policy asks for two places:

1. In Play Console: a privacy policy link in the designated field. You add it under Policy and programs > App content, in the privacy policy section (App content).
2. Inside the app: "a privacy policy link or text within the app itself." A link in your settings or about screen is the usual choice.

What the policy must cover

Google says the policy must comprehensively disclose how your app collects, uses and shares user data. The User Data policy lists the required elements:

• Who you are: "Developer information and a privacy point of contact or a mechanism to submit inquiries."
• What data: "The types of personal and sensitive user data your app accesses, collects, uses, and shares; and any parties with which any personal or sensitive user data is shared."
• How you protect it: "Secure data handling procedures for personal and sensitive user data."
• Retention and deletion: "The developer's data retention and deletion policy."
• A clear label: it must be clearly labeled as a privacy policy, for example with "privacy policy" in the title.

One more detail that catches people out: the entity named in your store listing (your developer name) "must appear in the privacy policy or the app must be named in the privacy policy."

Technical requirements for the page

Google requires the policy to be "available on an active, publicly accessible and non-geofenced URL (no PDFs) and is non-editable." In practice:

• Active: the link loads, today and every day after. A dead link is a problem even after launch.
• Public: no login, no paywall, no "request access" document link.
• Not geofenced: reviewers and users in any country must be able to open it. Check that your hosting or firewall doesn't block some regions.
• No PDFs: use a normal web page.
• Non-editable: not a shared document anyone can change.

Writing it so it matches your app

A generic template is a starting point, not a finished policy. The policy has to describe your actual app. Before you write, list what your app really does with data:

1. What you collect directly: account details, email, name, content users create.
2. What the device provides: location, contacts, photos, camera, microphone, device identifiers.
3. What your SDKs collect: analytics, crash reporting, advertising and sign-in libraries often collect data on their own. Check each SDK's documentation.
4. Who receives it: your hosting provider, analytics and ad networks, payment processors.
5. How long you keep it and how users can ask for deletion.
6. How to contact you about privacy.

Then write the policy from that list, in plain language. Short and accurate beats long and vague.

Keep three things consistent

Google sees your app from several angles, so they need to agree:

• The privacy policy
• The Data safety form in Play Console
• What the app actually does (permissions, SDKs, network traffic)

If your policy says you collect nothing but an analytics SDK sends device identifiers, or your Data safety answers say "no data shared" while an ad SDK is present, you have a mismatch. Fix the source of truth (the app) first, then update the form and the policy together. Our Data safety form guide covers the form side.

Step by step: adding it in Play Console

1. Publish the policy on your own domain or a reliable host as a normal web page.
2. Open the URL on a phone, in a private window, to check it loads without a login.
3. In Play Console, go to Policy and programs > App content.
4. Open the privacy policy section, paste the URL and save.
5. Add the same link inside your app.
6. Complete the Data safety form so it matches the policy.
7. Send the changes for review from Publishing overview.

Common mistakes

• A placeholder URL (your homepage, a "coming soon" page or a broken link).
• A policy for a different app copied from another project, with the wrong app or developer name.
• A PDF or a shared editable document.
• Ignoring SDKs. Third-party libraries are part of your app's data handling.
• No contact method for privacy questions.
• Forgetting to update it when you add a feature, permission or SDK.

Privacy policy and your closed test

Closed testing requires app setup to be complete, and the privacy policy is part of it. Sort it out on day zero along with the other items in our closed testing checklist; it's one less thing to block the review of your closed testing track.

If your app has a login, the same App content page is where you give reviewers working credentials. See giving testers and reviewers access.

Key takeaways

• Every app needs a privacy policy, even if it collects no personal data.
• Link it in Play Console and inside the app.
• Host it on an active, public, non-geofenced web page, not a PDF.
• Cover who you are, what data, who it's shared with, how it's protected, and retention and deletion.
• Keep the policy, the Data safety form and the app consistent.

This article explains Google's requirements. It isn't legal advice, and depending on where your users are, other privacy laws may apply as well.

Once app setup is complete, your closed test can begin. If you need testers, GoPlayTester runs the 14-day test with 12+ real testers on real devices; the setup guide shows the Play Console steps.