Does an iPhone app need a privacy policy? Apple's rules (2026)
Yes: every App Store app needs a privacy policy link, even one that collects nothing. What Apple requires, App Privacy details and account deletion.
By Sigsten Gustavii· · 9 min read
Every iPhone app on the App Store needs a privacy policy: Apple requires a working link to one in App Store Connect and inside the app, whether or not the app collects any data.
Privacy is one of the areas where new apps most often stumble at review, usually not because they misuse data but because a link is missing or the policy does not say what Apple asks. This guide sets out what Apple requires in October 2026, with the guideline numbers, what a good policy covers, how it relates to App Privacy details, and how to get it right without a lawyer for a simple app.
| Requirement | Where it applies | Apple's source |
|---|---|---|
| A privacy policy link in App Store Connect | Every app | Guideline 5.1.1(i) |
| The same link inside the app, easy to find | Every app | Guideline 5.1.1(i) |
| App Privacy details (the product page's privacy section) | Every new app and update | App privacy details |
| Account deletion inside the app | Apps that let people create accounts | Guideline 5.1.1(v) |
| A clear reason for each permission | Apps that use the camera, location, photos and so on | App Review |
| Permission before tracking | Apps that track people across other companies' apps or sites | Guideline 5.1.2(i) |
Yes, even if your app collects nothing
The rule has no exception for small or offline apps. Guideline 5.1.1(i) says all apps must include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner. If your app collects no data, the policy can say exactly that, in a few sentences. It still has to exist, be public, and load.
Apple's App Review page also lists broken links among common issues, and says a link to user support with up-to-date contact information and a link to your privacy policy are required for all apps.
What Apple says the policy must cover
Guideline 5.1.1(i) spells out three things the policy must clearly and explicitly do:
- Say what data the app collects, if any, how it collects it, and every use of it.
- Confirm that third parties protect it equally. Any analytics tool, advertising network, SDK or related company that gets the data must give it the same or equal protection as your policy promises.
- Explain retention and deletion: how long you keep data, and how someone can withdraw consent or ask for their data to be deleted.
What a simple app's privacy policy includes
Beyond Apple's three points, a clear policy for a small app usually has these parts. Laws differ by country, so if your app handles sensitive data or serves a large audience, get advice for your situation.
| Section | What it says |
|---|---|
| Who you are | Your name or company, and how to contact you |
| What the app collects | For example an email for sign-in, the content people create, photos they choose |
| Why | To run the app's features, to keep accounts working, to fix crashes |
| Where it is stored | On the phone, or with your cloud provider |
| Who else sees it | Each service provider, such as hosting or AI, and that they protect it equally |
| How long you keep it | Until the account is deleted, or a fixed period |
| People's choices | How to see, export or delete their data, and withdraw consent |
| Children | Whether the app is meant for children, and what that changes |
| Changes | How you will tell people when the policy changes |
The privacy policy is not the same as App Privacy details
App Store Connect also asks a set of questions that become the privacy section of your product page, sometimes called privacy labels. According to Apple's App privacy details page, you must answer them to submit new apps and updates, and the answers must include the practices of third-party code in your app.
- "Collect" has a specific meaning: sending data off the device in a way that lets you or your partners access it for longer than needed to answer the request in real time. Data processed only on the phone is not collected.
- Some data is optional to disclose, but only if it meets every one of Apple's criteria, such as being infrequent, optional and not used for tracking or advertising.
- The privacy policy URL is required on the same page; a Privacy Choices URL, where people manage their data, is optional.
The two must agree. A policy that says "we collect nothing" next to App Privacy answers that list an email address is the kind of mismatch reviewers notice. Our App Privacy details glossary entry explains the labels in more depth.
Account deletion
If your app lets people create an account, guideline 5.1.1(v) requires that they can also delete it from within the app. Apple's account deletion guidance adds the details:
- Start it in the app, somewhere easy to find, typically account settings. A link to a web page is fine only to finish the process.
- Delete, not deactivate. Offering only to disable the account is not enough; the account and its personal data must go.
- No support hoops. Outside highly regulated industries, apps should not make people call, email or chat to delete an account.
- Say how long it takes if deletion is not instant, and confirm when it is done.
The same guideline says apps should not require a login unless they have significant account-based features.
Permissions and purpose strings
Every time an app asks for the camera, microphone, location, photos or contacts, iOS shows a system prompt with a sentence the app provides, called a purpose string. Apple's App Review page says apps that access user data must include a clear purpose string. "This app needs your camera" is weak; "Take a photo of your receipt to add it to an expense" says why.
A short policy for an app that collects nothing
If your app keeps everything on the phone and sends nothing anywhere, the policy can be very short. It still has to be a real, public page that loads, and it still has to cover Apple's points in plain words. A structure like this works:
- Who you are and an email address for questions.
- A clear statement that the app does not collect personal data, and that anything you enter stays on your device.
- Third parties: that no data is shared with anyone, because none leaves the phone.
- Deletion: that deleting the app deletes its data from the device.
- Changes: that you will update the page if this ever changes.
The moment you add sign-in, cloud sync, analytics or an AI feature that sends text to a server, the policy has to grow with the app, and so do your App Privacy answers.
Common privacy mistakes that lead to rejection
- No privacy policy link in the app itself, only in App Store Connect.
- A link that does not load, or points to a generic page.
- A policy that does not match the app: it omits the email you collect, or the AI service you send text to.
- Accounts with no way to delete them in the app.
- Vague permission prompts that do not say why the app needs access.
- Forcing a login for an app without significant account features.
Our post on how long App Store review takes explains what a rejection costs in time, which is the strongest argument for getting these right before you submit.
How Borel handles privacy when you publish, step by step
Borel builds the privacy parts into its Publish flow, so a simple app does not need a lawyer or a website of your own to meet Apple's rules.
- Build the app with Borel. If it has sign-in, Borel's accounts use email and password with a database Borel runs.
- Review the drafted privacy policy. Borel drafts a privacy policy and a support page for your app from what the app does, and you read and edit them before publishing.
- Borel hosts them. The privacy, support and terms pages are served at public addresses on Borel's servers, so Apple's link check finds a real page.
- Run the review check. Before you send the app, Borel's check reads its code for a clear reason for each permission, for anything it collects that its privacy answers leave out, and for the rules apps are most often rejected for, such as a missing Delete account option.
- App Privacy answers. Borel works out the App Privacy answers from your app's code, never claiming tracking, and files them in App Store Connect; if it cannot, it tells you and links you to App Privacy to finish them yourself.
- Send and submit from the same window, with Pro and Apple's Developer Program.
Before I publish: add a Delete account button in Settings that removes the account and its data, add a Privacy policy link in Settings, and make every permission prompt say exactly why the app needs it.The privacy page in Learn explains how Borel itself handles your data, and getting ready for Apple covers the review check.
The bottom line
Every iPhone app needs a privacy policy, linked in App Store Connect and inside the app, that says what it collects, who else sees it and how people can delete it. Add matching App Privacy answers, account deletion if there are accounts, and honest permission prompts, and privacy stops being a reason for rejection. If you build with Borel, start free: the policy, the hosting and the review check come with the Publish flow.
Questions people ask
Does every iPhone app need a privacy policy?
Yes. Apple's guideline 5.1.1(i) requires every app to link a privacy policy in App Store Connect and inside the app, even if it collects no data.
What if my app does not collect any data?
You still need a policy. It can be short and say that the app collects no personal data, and your App Privacy answers should then say Data Not Collected.
Where does the privacy policy link go?
In two places: the Privacy Policy URL field in App Store Connect, and somewhere easy to find inside the app, such as Settings.
Can I use a privacy policy generator?
A generator can give you a starting structure, but the policy must describe your actual app: what it collects, which services see the data and how deletion works. A generic policy that does not match the app is a common problem.
What is the difference between a privacy policy and App Privacy details?
The policy is your own document at a public link. App Privacy details are Apple's questions in App Store Connect that become the privacy section of your product page. Both are required, and they must agree.
Do I need a website to host my privacy policy?
You need a public link, not a whole website. With Borel, your app's privacy, support and terms pages are hosted for you.
Does my app need account deletion?
If people can create an account in it, yes: guideline 5.1.1(v) requires that they can delete it from within the app.
Do I need App Tracking Transparency?
Only if your app tracks people across apps and websites owned by other companies, for example for targeted advertising. Then guideline 5.1.2(i) requires asking permission through App Tracking Transparency. Borel's App Privacy answers never claim tracking.
Privacy is where I would rather an app say too much than too little. If anything in Borel's privacy pages for your app looks unclear, tell me.
– Sigsten
Make your iPhone app in Borel
Describe the app you want and see its first screens before you pay anything.
See your app free