App Store privacy policy and support URL
Both app stores block a submission without a privacy policy URL and a support URL on a site you control. Apple provides no hosting for either, so you need a page of your own.
Quick answer
App Store Connect requires a Privacy Policy URL that is publicly accessible, and a Support URL that leads to real contact information users can reach you through. Apple does not host these, so both must live on your own site. One small site with a privacy page and a support page satisfies both stores. Publish it, then paste the two URLs into App Store Connect.
Step-by-step
- 1
Know which two URLs are required
The Privacy Policy URL must point at a publicly accessible privacy policy. The Support URL is separate, sits in your platform version information, and must lead to actual contact information so users can reach you about problems, feedback, and feature requests. They can point at two pages on the same site.
- 2
Publish a site you control
Apple does not provide hosting for these legal and support pages, so a Notes link or a Google Doc is not a durable answer, and reviewers regularly reject links that require sign-in. A small site on your own domain is the simplest permanent fix, and it doubles as the marketing page your listing links to.
- 3
Write the privacy policy against your actual data collection
Your policy has to match the App Privacy details you declare in App Store Connect. If you declare that you collect device identifiers for analytics, the policy needs to say so. A mismatch between the declared labels and the written policy is a common review rejection, and it is a compliance problem rather than a paperwork one.
- 4
Make the support page genuinely contactable
A support page that only says 'email us' with no address fails the intent of the requirement. Give an email address, and if you can, a short FAQ covering the three things users actually write in about. Reviewers check that the page leads somewhere real.
- 5
Keep both URLs live for the life of the app
These are not submission-time checks alone. If the privacy URL later 404s, the listing is in breach and the app can be removed. Point them at stable paths such as /privacy and /support, and avoid moving them when you redesign.
- 6
Paste the URLs into App Store Connect and Play Console
In App Store Connect, the privacy policy URL sits in App Information and the support URL in the version's platform information. Google Play requires a privacy policy URL in the Play Console app content section too, so use the same page for both stores.
Tips & best practices
- Use plain paths like /privacy and /support so you never have to change the URLs in either store.
- Localise the support URL if your app is listed in several languages, since Apple allows a localised support URL.
- If your app collects nothing, say that explicitly. 'We do not collect any personal data' is a valid and reassuring policy.
- Add the support email to the page as text rather than only a mailto button, so it survives a reviewer with scripts blocked.
Common questions
Can I use a free privacy policy generator page instead?
+−
You can generate the text, but it still has to be hosted at a URL you control and publicly reachable. The risk with generated policies is accuracy: it has to describe what your app actually collects and match the App Privacy details you declared, otherwise it fails review or misstates your obligations.
Is the support URL the same as the marketing URL?
+−
No. The marketing URL is optional and promotional. The support URL is required and has to lead to contact information for help. They can be different pages on the same website, and usually should be.
Does Google Play require the same thing?
+−
Play requires a privacy policy URL declared in the Play Console, and expects contactable developer details. Using one site with a privacy page and a support page covers both stores, which is why most indie developers publish a single small site rather than maintaining two sets of links.