When is a privacy policy required for an app?

Have your privacy policy ready before app store submission and before collecting personal information where applicable law requires notice. Apple’s App Store and Google Play require a policy even for apps that do not collect personal data.

Privacy obligations can begin during beta testing if you process real testers’ information. Under GDPR, information about direct collection is generally provided when data is obtained. For indirectly obtained data, different deadlines apply—generally within one month, or earlier upon first communication or disclosure, subject to exceptions.

Keep the policy accessible after launch. Use just-in-time privacy notices where additional explanations are needed, and obtain permissions or consent before the relevant activity when required. Publishing a policy later does not remedy an earlier failure to inform users.